Analysis
- max time kernel
142s - max time network
142s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
08/06/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
Zenith_1.0.0_x64_en-US.msi
Resource
win10-20240404-en
windows10-1703-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zenith_1.0.0_x64_en-US.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target Zenith_1.0.0_x64_en-US.msi
- Size 4.9MB
- Sample240608-ckfk6afe4x
- SHA256 fc7951a89153fe45d256c1c232fc564d6811fc69201f60f0ae5c57ab39593844
- MD5 9e98e26180fa72c4e6b817d46a670ead
- SHA1 db0e2d5ddbc579f7e606d1bffdcc515a5e92d3a8
- SHA512 91c6bee694d2f4aed4701bc574d09fa20e00fd3b0fe4f31793dde12a5c786209f658fc08919ed621c7809a27efbc49b583cf1c8b8fa5cf1271b66ef47de59b75
- SSDEEP 98304:3MnzBetL5W2tYd3RGIO7AfZ4NKrnTUQjDqOZjYG4ssycQDn2bsyD7YhaiZrRrzA:8wL5WNGIO7AxBrTUOxjYG7syHD2bsy/U
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 13 4760 powershell.exe 15 4760 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 4760 powershell.exe 4760 powershell.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Zenith.exe - Downloads MZ/PE file
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini bcastdvr.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation msedgewebview2.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 MicrosoftEdgeUpdate.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ko.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Cryptomining setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\copilot_provider_msix\copilot_provider_neutral.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ko.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\icudtl.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\pwahelper.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Content setup.exe File created C:\Program Files\Zenith\tools\tools.exe msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdateOnDemand.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\sl.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\bg.pak setup.exe File opened for modification C:\Program Files\Zenith\config.json Zenith.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_sl.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\mk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\pt-BR.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\vk_swiftshader_icd.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\microsoft_shell_integration.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\libEGL.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\win11\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Edge.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\bs.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\nl.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\th.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\win10\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\BHO\ie_to_edge_bho_64.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\ur.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Social setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\lo.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\mip_protection_sdk.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\pa.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\internal.identity_helper.exe.manifest setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\lb.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\dxil.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\msedge.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\LICENSE setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\msedgewebview2.exe.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Cryptomining setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\nb.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\psuser.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_sr-Cyrl-RS.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Sigma\Analytics setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\prefs_enclave_x64.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\LICENSE setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Sigma\Social setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\lb.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Analytics setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ug.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\identity_proxy\win10\identity_helper.Sparse.Internal.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Mu\Fingerprinting setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\tr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\MEIPreload\preloaded_data.pb setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\Entities setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Trust Protection Lists\Mu\Advertising setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\sq.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Trust Protection Lists\Sigma\Entities setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_bn-IN.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\hi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\Locales\ka.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Locales\sq.pak setup.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC728.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57c60f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6B1D6757-2411-44E0-8FC3-EE251D0CA482} msiexec.exe File created C:\Windows\Installer\e57c611.msi msiexec.exe File created C:\Windows\Installer\e57c60f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{6B1D6757-2411-44E0-8FC3-EE251D0CA482}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{6B1D6757-2411-44E0-8FC3-EE251D0CA482}\ProductIcon msiexec.exe - Executes dropped EXE 23 IoCs
pid Process 4272 MicrosoftEdgeWebview2Setup.exe 4124 MicrosoftEdgeUpdate.exe 4848 MicrosoftEdgeUpdate.exe 3788 MicrosoftEdgeUpdate.exe 4916 MicrosoftEdgeUpdateComRegisterShell64.exe 4912 MicrosoftEdgeUpdateComRegisterShell64.exe 2216 MicrosoftEdgeUpdateComRegisterShell64.exe 3128 MicrosoftEdgeUpdate.exe 2648 MicrosoftEdgeUpdate.exe 4160 MicrosoftEdgeUpdate.exe 2336 MicrosoftEdgeUpdate.exe 1972 Zenith.exe 4112 MicrosoftEdge_X64_125.0.2535.92.exe 1140 setup.exe 1200 setup.exe 4916 MicrosoftEdgeUpdate.exe 204 Zenith.exe 4224 msedgewebview2.exe 4604 msedgewebview2.exe 2192 msedgewebview2.exe 2204 msedgewebview2.exe 3500 msedgewebview2.exe 4748 msedgewebview2.exe - Loads dropped DLL 30 IoCs
pid Process 3416 MsiExec.exe 4124 MicrosoftEdgeUpdate.exe 4916 MicrosoftEdgeUpdateComRegisterShell64.exe 3788 MicrosoftEdgeUpdate.exe 4912 MicrosoftEdgeUpdateComRegisterShell64.exe 3788 MicrosoftEdgeUpdate.exe 2216 MicrosoftEdgeUpdateComRegisterShell64.exe 3788 MicrosoftEdgeUpdate.exe 4160 MicrosoftEdgeUpdate.exe 2648 MicrosoftEdgeUpdate.exe 3416 MsiExec.exe 204 Zenith.exe 4224 msedgewebview2.exe 4604 msedgewebview2.exe 4224 msedgewebview2.exe 4224 msedgewebview2.exe 2192 msedgewebview2.exe 2204 msedgewebview2.exe 2192 msedgewebview2.exe 2204 msedgewebview2.exe 3500 msedgewebview2.exe 2192 msedgewebview2.exe 3500 msedgewebview2.exe 2192 msedgewebview2.exe 2192 msedgewebview2.exe 2192 msedgewebview2.exe 4748 msedgewebview2.exe 4748 msedgewebview2.exe 4748 msedgewebview2.exe 4224 msedgewebview2.exe - Registers COM server for autorun 1 TTPs 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 GamePanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MicrosoftEdgeUpdate.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7576D1B611420E44F83CEE52D1C04A28\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1992 msiexec.exe 1992 msiexec.exe 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe 4124 MicrosoftEdgeUpdate.exe 4124 MicrosoftEdgeUpdate.exe 4124 MicrosoftEdgeUpdate.exe 4124 MicrosoftEdgeUpdate.exe 4124 MicrosoftEdgeUpdate.exe 4124 MicrosoftEdgeUpdate.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4224 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 412 msiexec.exe Token: SeIncreaseQuotaPrivilege 412 msiexec.exe Token: SeSecurityPrivilege 1992 msiexec.exe Token: SeCreateTokenPrivilege 412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 412 msiexec.exe Token: SeLockMemoryPrivilege 412 msiexec.exe Token: SeIncreaseQuotaPrivilege 412 msiexec.exe Token: SeMachineAccountPrivilege 412 msiexec.exe Token: SeTcbPrivilege 412 msiexec.exe Token: SeSecurityPrivilege 412 msiexec.exe Token: SeTakeOwnershipPrivilege 412 msiexec.exe Token: SeLoadDriverPrivilege 412 msiexec.exe Token: SeSystemProfilePrivilege 412 msiexec.exe Token: SeSystemtimePrivilege 412 msiexec.exe Token: SeProfSingleProcessPrivilege 412 msiexec.exe Token: SeIncBasePriorityPrivilege 412 msiexec.exe Token: SeCreatePagefilePrivilege 412 msiexec.exe Token: SeCreatePermanentPrivilege 412 msiexec.exe Token: SeBackupPrivilege 412 msiexec.exe Token: SeRestorePrivilege 412 msiexec.exe Token: SeShutdownPrivilege 412 msiexec.exe Token: SeDebugPrivilege 412 msiexec.exe Token: SeAuditPrivilege 412 msiexec.exe Token: SeSystemEnvironmentPrivilege 412 msiexec.exe Token: SeChangeNotifyPrivilege 412 msiexec.exe Token: SeRemoteShutdownPrivilege 412 msiexec.exe Token: SeUndockPrivilege 412 msiexec.exe Token: SeSyncAgentPrivilege 412 msiexec.exe Token: SeEnableDelegationPrivilege 412 msiexec.exe Token: SeManageVolumePrivilege 412 msiexec.exe Token: SeImpersonatePrivilege 412 msiexec.exe Token: SeCreateGlobalPrivilege 412 msiexec.exe Token: SeCreateTokenPrivilege 412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 412 msiexec.exe Token: SeLockMemoryPrivilege 412 msiexec.exe Token: SeIncreaseQuotaPrivilege 412 msiexec.exe Token: SeMachineAccountPrivilege 412 msiexec.exe Token: SeTcbPrivilege 412 msiexec.exe Token: SeSecurityPrivilege 412 msiexec.exe Token: SeTakeOwnershipPrivilege 412 msiexec.exe Token: SeLoadDriverPrivilege 412 msiexec.exe Token: SeSystemProfilePrivilege 412 msiexec.exe Token: SeSystemtimePrivilege 412 msiexec.exe Token: SeProfSingleProcessPrivilege 412 msiexec.exe Token: SeIncBasePriorityPrivilege 412 msiexec.exe Token: SeCreatePagefilePrivilege 412 msiexec.exe Token: SeCreatePermanentPrivilege 412 msiexec.exe Token: SeBackupPrivilege 412 msiexec.exe Token: SeRestorePrivilege 412 msiexec.exe Token: SeShutdownPrivilege 412 msiexec.exe Token: SeDebugPrivilege 412 msiexec.exe Token: SeAuditPrivilege 412 msiexec.exe Token: SeSystemEnvironmentPrivilege 412 msiexec.exe Token: SeChangeNotifyPrivilege 412 msiexec.exe Token: SeRemoteShutdownPrivilege 412 msiexec.exe Token: SeUndockPrivilege 412 msiexec.exe Token: SeSyncAgentPrivilege 412 msiexec.exe Token: SeEnableDelegationPrivilege 412 msiexec.exe Token: SeManageVolumePrivilege 412 msiexec.exe Token: SeImpersonatePrivilege 412 msiexec.exe Token: SeCreateGlobalPrivilege 412 msiexec.exe Token: SeCreateTokenPrivilege 412 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 412 msiexec.exe Token: SeLockMemoryPrivilege 412 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 412 msiexec.exe 1972 Zenith.exe 412 msiexec.exe 204 Zenith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1972 Zenith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3416 1992 msiexec.exe 75 PID 1992 wrote to memory of 3416 1992 msiexec.exe 75 PID 1992 wrote to memory of 3416 1992 msiexec.exe 75 PID 1992 wrote to memory of 2268 1992 msiexec.exe 79 PID 1992 wrote to memory of 2268 1992 msiexec.exe 79 PID 1992 wrote to memory of 4760 1992 msiexec.exe 81 PID 1992 wrote to memory of 4760 1992 msiexec.exe 81 PID 4760 wrote to memory of 4272 4760 powershell.exe 84 PID 4760 wrote to memory of 4272 4760 powershell.exe 84 PID 4760 wrote to memory of 4272 4760 powershell.exe 84 PID 4272 wrote to memory of 4124 4272 MicrosoftEdgeWebview2Setup.exe 86 PID 4272 wrote to memory of 4124 4272 MicrosoftEdgeWebview2Setup.exe 86 PID 4272 wrote to memory of 4124 4272 MicrosoftEdgeWebview2Setup.exe 86 PID 4124 wrote to memory of 4848 4124 MicrosoftEdgeUpdate.exe 87 PID 4124 wrote to memory of 4848 4124 MicrosoftEdgeUpdate.exe 87 PID 4124 wrote to memory of 4848 4124 MicrosoftEdgeUpdate.exe 87 PID 4124 wrote to memory of 3788 4124 MicrosoftEdgeUpdate.exe 88 PID 4124 wrote to memory of 3788 4124 MicrosoftEdgeUpdate.exe 88 PID 4124 wrote to memory of 3788 4124 MicrosoftEdgeUpdate.exe 88 PID 3788 wrote to memory of 4916 3788 MicrosoftEdgeUpdate.exe 89 PID 3788 wrote to memory of 4916 3788 MicrosoftEdgeUpdate.exe 89 PID 3788 wrote to memory of 4912 3788 MicrosoftEdgeUpdate.exe 90 PID 3788 wrote to memory of 4912 3788 MicrosoftEdgeUpdate.exe 90 PID 3788 wrote to memory of 2216 3788 MicrosoftEdgeUpdate.exe 91 PID 3788 wrote to memory of 2216 3788 MicrosoftEdgeUpdate.exe 91 PID 4124 wrote to memory of 3128 4124 MicrosoftEdgeUpdate.exe 92 PID 4124 wrote to memory of 3128 4124 MicrosoftEdgeUpdate.exe 92 PID 4124 wrote to memory of 3128 4124 MicrosoftEdgeUpdate.exe 92 PID 4124 wrote to memory of 2648 4124 MicrosoftEdgeUpdate.exe 93 PID 4124 wrote to memory of 2648 4124 MicrosoftEdgeUpdate.exe 93 PID 4124 wrote to memory of 2648 4124 MicrosoftEdgeUpdate.exe 93 PID 4160 wrote to memory of 2336 4160 MicrosoftEdgeUpdate.exe 95 PID 4160 wrote to memory of 2336 4160 MicrosoftEdgeUpdate.exe 95 PID 4160 wrote to memory of 2336 4160 MicrosoftEdgeUpdate.exe 95 PID 4160 wrote to memory of 4112 4160 MicrosoftEdgeUpdate.exe 101 PID 4160 wrote to memory of 4112 4160 MicrosoftEdgeUpdate.exe 101 PID 4112 wrote to memory of 1140 4112 MicrosoftEdge_X64_125.0.2535.92.exe 102 PID 4112 wrote to memory of 1140 4112 MicrosoftEdge_X64_125.0.2535.92.exe 102 PID 1140 wrote to memory of 1200 1140 setup.exe 103 PID 1140 wrote to memory of 1200 1140 setup.exe 103 PID 4160 wrote to memory of 4916 4160 MicrosoftEdgeUpdate.exe 104 PID 4160 wrote to memory of 4916 4160 MicrosoftEdgeUpdate.exe 104 PID 4160 wrote to memory of 4916 4160 MicrosoftEdgeUpdate.exe 104 PID 3416 wrote to memory of 204 3416 MsiExec.exe 106 PID 3416 wrote to memory of 204 3416 MsiExec.exe 106 PID 204 wrote to memory of 4224 204 Zenith.exe 109 PID 204 wrote to memory of 4224 204 Zenith.exe 109 PID 4224 wrote to memory of 4604 4224 msedgewebview2.exe 110 PID 4224 wrote to memory of 4604 4224 msedgewebview2.exe 110 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 PID 4224 wrote to memory of 2192 4224 msedgewebview2.exe 111 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Zenith_1.0.0_x64_en-US.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:412
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C640F0DCF0F274CD56D8C81F4C493AC C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Program Files\Zenith\Zenith.exe"C:\Program Files\Zenith\Zenith.exe"3⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Zenith.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=204.3828.134633720118267086324⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4224 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=125.0.2535.92 --initial-client-data=0x11c,0x120,0x124,0xf8,0x12c,0x7ffc23474ef8,0x7ffc23474f04,0x7ffc23474f105⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4604
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView" --webview-exe-name=Zenith.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,11425832034577578860,14605728928527264507,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView" --webview-exe-name=Zenith.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1940,i,11425832034577578860,14605728928527264507,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView" --webview-exe-name=Zenith.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1652,i,11425832034577578860,14605728928527264507,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3500
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\125.0.2535.92\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView" --webview-exe-name=Zenith.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3328,i,11425832034577578860,14605728928527264507,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4748
-
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Modifies registry class
PID:4848
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4916
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4912
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2216
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjY0RDE2NTEtMEI0Qi00QTk4LUI2MkItQ0JBREJDNTlEMEU0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDM0Y4M0Y4NC1BNkIwLTQyRTItQUFDNy1DMUVERUQ1NkMwNzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTM4MzY3NzUzIiBpbnN0YWxsX3RpbWVfbXM9IjUzMSIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Checks system information in the registry
- Executes dropped EXE
PID:3128
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{664D1651-0B4B-4A98-B62B-CBADBC59D0E4}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3180
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjY0RDE2NTEtMEI0Qi00QTk4LUI2MkItQ0JBREJDNTlEMEU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDY3RDA0QTQtMzMyMi00NDYwLUI5OUYtQ0U3Q0FGQUM2NjlEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlFFTVUiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjY0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTIyMzM3MjIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1NjcwNjU5MjgzNjIyMjciPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTQyMjc0MDA1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2336
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\MicrosoftEdge_X64_125.0.2535.92.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\EDGEMITMP_ED1F0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\EDGEMITMP_ED1F0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\EDGEMITMP_ED1F0.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\EDGEMITMP_ED1F0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EBE26838-FC0F-4732-B1A5-8A0517999C21}\EDGEMITMP_ED1F0.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ff779c14b18,0x7ff779c14b24,0x7ff779c14b304⤵
- Executes dropped EXE
PID:1200
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjY0RDE2NTEtMEI0Qi00QTk4LUI2MkItQ0JBREJDNTlEMEU0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCQUQ5NTY3Ni1DMjE0LTRFMDAtQTNFRi00NDM5QjI5NjBBNUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyNS4wLjI1MzUuOTIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5ODAzOTk0MzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTgwNTU1Mjk4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE4OTE0OTAwNyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMTk5ZDZiMjItNmY4ZS00NjIwLTgwMjktZjdlM2EyYTNmZGVhP1AxPTE3MTg0MTczMjImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SUtIJTJmZnlIeDJ1RURyWW5WR0lXajFKNG13RmhtaGgybzg1JTJmM0NPNXByMWlyendEM0t6cUQlMmZVM1NZQVNnMGZ5YzhxMEg3blFPbXo3WXdycVN0JTJiR2paQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MzgxMDc1MiIgdG90YWw9IjE3MzgxMDc1MiIgZG93bmxvYWRfdGltZV9tcz0iMTY0ODQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTg5MzA1MTU3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIwMzIxMTg5NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTY0MjY5NDU1NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3NSIgZG93bmxvYWRfdGltZV9tcz0iMjA4NzUiIGRvd25sb2FkZWQ9IjE3MzgxMDc1MiIgdG90YWw9IjE3MzgxMDc1MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDM5MzMiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4916
-
-
C:\Program Files\Zenith\Zenith.exe"C:\Program Files\Zenith\Zenith.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1972
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 0000000000070238 /startuptips1⤵PID:3336
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Drops desktop.ini file(s)
PID:4900
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 000000000004023E /startuptips1⤵
- Checks SCSI registry key(s)
PID:3324
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 0000000000060228 /startuptips1⤵PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57c610.rbs
- Size 10KB
- SHA256 96e740e953432b9dc00babbd666d65954f3167cfbf23167ff90f7630df71f719
- MD5 ef760046c16712028c023831ca794f52
- SHA1 4114b6bbaca40451ecd6f9050204ab998f61e433
- SHA512 02f8a1eee3406e50e8ab2480e7c0bb67a8ef767b0cdb0f3bfc8d3af539cbb8f85605f8d89e7bb9f240b39d19388d01d5fb19de599ceb741c9d3e0b66a4f9408a
- SSDEEP 192:zj2YQC6c8c7ItZCZAjO4AjO0VYymWTiqefwKp/:v2YQC6c8c7ItY+b+0b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Installer\setup.exe
- Size 6.9MB
- SHA256 9595008f51be8ca7c82618c84d30f0a7fdac9fe7433b806af504da0d38aef10a
- MD5 d42926508ba6626be0143a2aa5275ba9
- SHA1 ca2b45426611211dcd47fe66c9255ab81b843943
- SHA512 53aabfbf20389f4d28746c41109b5a194ed5d21521fa67042bd5a0fb38407e877bed5481a7502bec848a54d0fd4e33b09e3c6bc47a576f8e14a4458c64bc14e2
- SSDEEP 98304:MKD4hdFWw+WvfChX+OMh3JusMkobsmOnQhpHhWTi:DD4hdFr6xAWkobfUQdWTi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\EdgeUpdate.dat
- Size 12KB
- SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
- MD5 369bbc37cff290adb8963dc5e518b9b8
- SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
- SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
- SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeComRegisterShellARM64.exe
- Size 179KB
- SHA256 ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
- MD5 687ccc0cc0a4c1de97e7f342e7a03baa
- SHA1 90e600e88b4c9e5bb5514a4e90985a981884f323
- SHA512 4da91ee55de7abb6ce59203edd9ae7e6fcacd5528ac26d9e0bfbd12169db74758a9bc3fde437e3c1d10afc95d74b04b0e94586472b0a0bb15b738f5e6ec41d8d
- SSDEEP 3072:S8czsqXKwYG9gjcxiN7ICOqnPgHHu7uB+4aP:esCKwYG9WcwKIv1j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdate.exe
- Size 201KB
- SHA256 d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
- MD5 e3f7c1c2e2013558284331586ba2bbb2
- SHA1 6ebf0601e1c667f8d0b681b0321a73e8f4e91fa3
- SHA512 7d4fd7ad06b05d79211144cbaa0047bdb4910212565b79f292a6bea652735dacf69435b24c73bc679cbdad4207f6352726eb297a1e7af4f7eef14dbc8a2ca42d
- SSDEEP 3072:9HrfzYac6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+uW/1+gKFxRL+835LD42QA:tAel/DRfkTC3dM7B+WC8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
- Size 212KB
- SHA256 9c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
- MD5 a177a23ca2ed6147d379d023725aff99
- SHA1 1a789e5ef7bf9f15f2ccbac5f9cf3750ee41f301
- SHA512 c508ffd3e2cc953d857a2128e29dfdfe0f9e729da38c9cc3022c4376342aec946c6e79176e7885f6637008573c85339bdc8a9e261b3811887ecf5a7dd78383c3
- SSDEEP 3072:1pWTMUXEV0tle+5IbvBCM2g5nCC8IZoY46MuAicfB85y10ygnmm:1pqhUVwleMITT2Yxoh51nPm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\MicrosoftEdgeUpdateCore.exe
- Size 258KB
- SHA256 2ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
- MD5 4f840a334c7f6d2a6cba74f201e83a7f
- SHA1 cb032c7b1293190f8f1cd466f6ded4bbe71c47a1
- SHA512 575c20fcdbebb16bcd17a137a656769d355a81817e7fa3743981976998e00bdf3ce42bbfa046c42a835e9e9e7a10ef6f8d7b306de9940fa332817cb2885db833
- SSDEEP 6144:JhyJ1jOiaJtSgT2OGlCfo7C0QdYbAOCvXYe2h+H7:3yLuLSgT2OGlCfodsPYph+H7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\NOTICE.TXT
- Size 4KB
- SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
- MD5 6dd5bf0743f2366a0bdd37e302783bcd
- SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
- SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
- SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_af.dll
- Size 29KB
- SHA256 5995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
- MD5 3a8fa737407a1b3671d6c0f6adaabd8a
- SHA1 b705b27c99349a90d7a379d64fd38679eed6ec30
- SHA512 9872f32a727b248d3edafe303e5290e1bae0c270a988500424221970c0041268c1626ebb94712a0b8ba0f21d2f29d833ab9dbc4db884f7f9af5a5063f94d71b5
- SSDEEP 384:8RvvF49o8NVFXh7pWmIIWTjrYiVDxlwC3W+J5yEFHRN7hmh9R9z3pD:8RXFpsmW+JgEl49zF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_am.dll
- Size 24KB
- SHA256 921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
- MD5 86465afa3ac4958849be859307547f57
- SHA1 9bbde5e4df719b5a7d815dd1704ab8215602f609
- SHA512 13e178e317280cbd585261aa22a840ea2203d4ef5c845f4fd6d5b4fbf216d45aae55153aed43c1fe4284d45391c72e580e612347b2903effece8a2252a13b90e
- SSDEEP 384:npnQVFXh7pWmIIWd0Kl8js/c5yEFHRN7XASR9zwM76Q:3Ue8js/cgElXAe9zj9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ar.dll
- Size 26KB
- SHA256 588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
- MD5 819e3c9e056c95b894f1863208d628a2
- SHA1 596993f5d21cfd92f29e2ea5b0a870dc2ac19917
- SHA512 3a7e67248895ac2cbb1874514bffe62a23cdfff2c3674d21589f528ec283ccf3cc2e3abfea0d81f49046c7ba920f3e64cda100c5a20be69b91ce05095b50c06b
- SSDEEP 384:PRvvFZLPBbpWmIIWCYwTPsQ8XvPGR5yEFHRN7PcTR9ziLgY:PRXFOIbQXvPygElUV9zq1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_as.dll
- Size 29KB
- SHA256 3dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
- MD5 d1aa2764e05f7c8c88a17bb0cd25b537
- SHA1 2bee78f103faffe3e25ca20c915cc6b46e2134e4
- SHA512 80762e4611b8ac451490e5238c0650be048bf315526ed405d9c5837e5002bd6a9526f335a06c6baa009cba671ecb0613c76dce23086e13333f332480cbd9ced0
- SSDEEP 768:ORXFFmVZ452DuUu3+F/D06DpJKIlHpIgElukXC4dC9zZj7rh:pWZfC4dezJx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_az.dll
- Size 29KB
- SHA256 afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
- MD5 1e4093c3b0af3eed6f95d2620d45bf40
- SHA1 e29a10ede562f2d057d6fc04c3a286996051a14d
- SHA512 843480e2d2b431f32892830c26fc3e4b80656d069f83f9a9df78d10b1e22c9ceca99171360b2baa921d156995d87ea5223f18b11e2a8ac18fabdf905881940b1
- SSDEEP 768:3lIOFe5FEuo//rtkPFS5OrF9FTFYF+uOgElwhCK9zR:3fFe5FEuobuFJrF9FTFYF2ZQzR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_bg.dll
- Size 29KB
- SHA256 d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
- MD5 c30674009659b56bdb6a60f8629f0eb2
- SHA1 4b6fc6ea93620a206a621875513455b57fd24e83
- SHA512 8947a9bada21ed2e0f2cf080d58f9473a5c54092a5c1f75ca9523b48143caed346e831714e80466cc2e88513e507aef422d8560b69cbf8663eb21ab05c61707c
- SSDEEP 384:CuJVFXh7pWmIIWddsSCCdrwdPMQgv6Sf46s5yEFHRN75rFDR9zzA6co0:6jdshCJCgCz6sgEljl9zlk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_bn-IN.dll
- Size 29KB
- SHA256 18d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
- MD5 a8817334810c093e0c280e2a61caf36b
- SHA1 9b3b2a8e33de3fa8df0b6b6ab4a40ab1d088ab28
- SHA512 24ee9a0c29d42c96ccec7f4f3322c3b6a2ed0e4d68b17a5b424a364f789adaa8f1404784c8feae77986cd0be39579dacc9ca89a3fa868bb0bf11d94c95f0bb23
- SSDEEP 768:f03tDfvAGEtJtVWCZsnM9/r94amPdQ8JBlHxALJ9zr:CXAGEbO/ALrzr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_bn.dll
- Size 29KB
- SHA256 cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
- MD5 4d2988ce0b2cf5cb02269a2455e1174b
- SHA1 d89cd05805965648c9e7b8bb4bc8bd3605ce2d4a
- SHA512 64cee7e579367faca4864ebb5feb9dee310915f8640780a5a52c19f5c68d817adab7ef357913a68fe841a3b2e801e85de173a37402cdd49cf35319571ff6ce44
- SSDEEP 768:8RXFmSvAGEtJtVWCZsnM9/r94amPdQ8JBlH8A9V9zqo:FOAGEbO+A9nzqo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_bs.dll
- Size 29KB
- SHA256 7c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
- MD5 3e817089a18c72bd505dd6bbe5ce6163
- SHA1 2c21b568c2fda5e475a1a996b73874ba6fe420dd
- SHA512 20534eee7c59a9cdb595c3f6d01abc8cfa534aaf84a693d3b011e4dada3fde080142a95ba036270a6a2ad2b65e6fdb18b08e53552715cc4edfcb87662fbf8100
- SSDEEP 384:2RvvFNDVFXh7pWmIIWwaDAmqRDU5NLCdJlwcSXp+U1s4715yEFHRN7WpR9zep2s:2RXF+N6lwcSXp+2s4pgElWD9zVs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
- Size 30KB
- SHA256 ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
- MD5 e0de8c3f8252202d2f68341290c45e34
- SHA1 1d3322ab111774484be8865c1893dd834c3f52f7
- SHA512 bb22666ba675c88715aa1b906f2b356c0d4289723052b942f416d3b56f727666f4fb8cc51609ca96be0c76ffda85cfbdcea917979e8a1ada5a5ba1b82e5bf816
- SSDEEP 768:WdHdbkbkbOnMffoBWfRPgElMEpw9zhyVbp:q1f1ZMEp4zg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ca.dll
- Size 30KB
- SHA256 8bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
- MD5 9e4ddaa68d6d4f210905092096051b36
- SHA1 f38198c364da7b5ebcc75aafdf42a7d55699d8d4
- SHA512 d65102c0f4337cea443c5f8e65531f0f7b628c5edeff17257b427d1073a1b291d1cc90fe46dc4bbd2c2988f940480d46e5abb2cbb9985bcbafa7e5f3bc727151
- SSDEEP 384:yRUVFXh7pWmIIWbHEWdvDNfNFoBq1ZqFt5yEFHRN7vgpEpcR9zUmy0s:8tHEWdvpffoBqitgElMEpw9zhyn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_cs.dll
- Size 28KB
- SHA256 829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
- MD5 731cb513cd866dfc65e12446a0d4d62d
- SHA1 be32570fb7fd50c43cf1ae24e7a35302eb5278fe
- SHA512 6357f965c183e89e5a1c485a0e3becf56ab91265241568d7df7fdc1c01f1ac8fa58bd206762ada8cec99b6988eff60c41cf4836290d5e007fff63a69a78de68c
- SSDEEP 384:HRvvF/PVFXh7pWmIIWFTL7PGmxQEnwd/95yEFHRN7oFDR9zzA6cC:HRXFIvTL7o9gElMl9zlD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_cy.dll
- Size 28KB
- SHA256 5410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
- MD5 04ee3ec0e73eae42509bdfb689927610
- SHA1 6176e7ae836dcacea10f7004b04ba85e3e081da8
- SHA512 89c41d77066fde1cad219603d1bbdd812a65bb0680d3c545ee4cb63135486296f1af934a69161e76ca53d00037729e75bdcc22a2eca954eba98cf3f34af5d839
- SSDEEP 384:uRvvFKcVFXh7pWmIIWttZEmiuTHsyi7zAaaVamYylVb2UFxOF6dJA/5yEFHRN7lo:uRXF2LDVEUjxdJA/gElliD9z7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_da.dll
- Size 29KB
- SHA256 157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
- MD5 9fa41c3ba8bbd84e85f71c3cd377d90d
- SHA1 363c1d61c84fee42987193e8edeffa522eccbfdc
- SHA512 34569a917bf08ac7d50add115b09cd8bf4583a3bc7652fa54c1cd606cb94e752f4e4e278fbb99ea1e41e2d712f82893ca5f59bbed05a57c8d29b2d7037d835e5
- SSDEEP 384:ARvvF0IhVFXh7pWmIIWgm4HcyvBdcb/NEHRN7hFDR9zzA6cYUn:ARXFnap4PchADl9zlI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_de.dll
- Size 31KB
- SHA256 84ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
- MD5 896c0f7b03a6cd211fea53ecc71a1308
- SHA1 434eac60a992ea77945a77964050a5d0e41d48b2
- SHA512 7d2f9fc0086b3dc60275c6a2e17b0562626a57fb080dc1bc4cd5ad80c2501f366e89533aa961613eacd3a0bce343bf831e8cfa3d3a691c33481042b1ee02908f
- SSDEEP 384:DRvvFMPVFXh7pWmIIWAeI4FBhj3ZnswxWbzi5yEFHRN7O4fpR9zepsOC:DRXFdietj3Zn7xWbzigElzfD9zxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_el.dll
- Size 31KB
- SHA256 e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
- MD5 8cb60db631b0939688f39e76564505cc
- SHA1 6dee577de716460737f7a330f440880b4e73c5c8
- SHA512 d43216c1a8ed2daf51d70d476b789a3797bd62f69c1a556e306dfccc41efea73117eafb970010d7db151cd3ebfb7cd82de01efb4e2a2c0757b2027732a3361f5
- SSDEEP 384:kRvvFajSVFXh7pWmIIWRnBzBUBOTG94vTZtfFtSmFK9q8LPgbw5yEFHRN7IwpR93:kRXFEvpnxmFTzgElzD9zpt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_en-GB.dll
- Size 27KB
- SHA256 fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
- MD5 1b79536b20df86a2bd8b232abe07d533
- SHA1 a9d24de616055f9800d5c4bc902cb2d0f625d178
- SHA512 ac4704fade4879992f0a67888e1e4098be2879e5e3ce2bd80275ce68729f0037497d975e1ececb587ace4d72f3e71b038f616725831d4fca12280d583cd77d7b
- SSDEEP 384:0a03tY6RVFXh7VWmIIWjkagyorTmX5yEFHRN7EcTR9ziLBR:0a03tdWaagyo+XgEllV9zq/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_en.dll
- Size 27KB
- SHA256 c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
- MD5 a430ce95b80c07bb729463063e0c7c48
- SHA1 cc488bdc18c191d88dd93e45bb85fda19d496591
- SHA512 cc9c24b95d079a949a8e725002494b0c75c19bce9ec6457cb4307f5803b7433eed738944f1baf770df8e034212224b1d9662fa533aa5bc5c01568d192fa49efc
- SSDEEP 384:e8WVFXh7pWmIIWakagyDl9FR3h5yEFHRN7ILIpR9zepWqf:p1agyDld3hgElZD9z4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_es-419.dll
- Size 29KB
- SHA256 39e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
- MD5 31177139af7d1da131c31d7d5cbe8099
- SHA1 113f3b38baeab35d2d0f51f1238f5b9e11402f26
- SHA512 6828a1cab2fdefe642a0b58f47c31e02b9dba7b15ad28cdb8039b194d9a86e2d24ff0e658fdf982e3d2d4208a2b57eb7546136e4739e64d714939c14a3d58410
- SSDEEP 384:F1wVFXh7xWmIIWpaduUrFaT/NEHRN7gHR9zskE0O:liBrAJA29z2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_es.dll
- Size 29KB
- SHA256 2d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
- MD5 dd3dd031e05a54c4bbf6660dd8053608
- SHA1 f32870bb0f7f522fd536c4ffae8c39c9d2f266f1
- SHA512 7b0bb0ae619baea45cddab042d10d7e4b394c70a29c01632585fec7ff9aaa54a50a8fbc894f02af5e2130cff11c4573cf41ab6b5fc4c29392b69e72212c41c2d
- SSDEEP 384:8HrVFXh7pWmIIWZt34jmIB5yEFHRN7U2IR9zDXxB:Vzt34jmIBgEl3U9zX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_et.dll
- Size 28KB
- SHA256 83a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
- MD5 2e1b7c75e1ee567906a62eb19ee4308d
- SHA1 10b77bc1040db4a3712a94c2e5ba56be3a54bfd4
- SHA512 9bcbb626945390ca07c99b4a698036b2a59869040944866edb893f4e5f7a6524b8980183f9825b33bafa41b10165b7ef6d20dd7750e38edd880fc22362110c08
- SSDEEP 384:VoqVFXh7pWmIIWSVc0dEyjELtX7gid1LFdsTwAiDi0/NEHRN7VvFDR9zzA6c1:kw5jELBgG1LFd/AwHAVtl9zlq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_eu.dll
- Size 29KB
- SHA256 698dd9be2f9edce221977a6c076e894f72ffd1287c4a67423d1ea06ddfa90b21
- MD5 60417e3a859f5e728bb9edeacc439309
- SHA1 ee96ac74353e0e1725e09a6e5e6d070767286e45
- SHA512 2470f2cb04c720e3b0259ea2440761adef1493253a7a93242ff543d52936a67685a59d36d3e7f39c7807c2ee1d2932109534337e3096137441668f9cf507d16c
- SSDEEP 384:qPNVFXh7pWmIIWMcLpNrX58FOXAzt4OzJ5yEFHRN7f15t2R9zBi5l:xnRuFOkt4QgEl95tK9zyl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_fa.dll
- Size 28KB
- SHA256 a66e9dc8829de13dfaf3e727ddf5a1655e0dd8844ab95fe461b61f996287a802
- MD5 3d30bd97390f100a3dc9cf3263623434
- SHA1 ac328d192b4218722e0994c8c3c67df1aa8383ba
- SHA512 bb45aaca5f13bab5ebb5b542a71635e15cf0a111ddf752db510f7f161bd889f58ff30d0fcc4f36e9882564271a32281d4d9a48cfffe06172e2a46041b2af62f9
- SSDEEP 384:uoDcPBbpWmIIWbXlQEqtOW0QSGf15yEFHRN7R5MR9zyz:x5KnuC1gElRe9zQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_fi.dll
- Size 28KB
- SHA256 c3800427be8e5550e6fa985f28bb4cf183f8b49d398533ad0eacea53a5a573d6
- MD5 7483cb4ff3f422d05af3267a242130e3
- SHA1 f723b294d2088cf8a4ff2478e18470b256116979
- SHA512 fc5ef6b792a9c2f113f5fc6cef1bf268e8688ae8f5de369224458c07b4fa229da3b6bcf698b0d9962d4644b7e1b9c682cf4f4dfe66c46c0297a41a14fc6e53ed
- SSDEEP 384:2MLVFXh7pWmIIWZJWHJWEFIxnyELZWEYXSN6ZKFl+EoJth0vga5yEFHRN7ocqFD+:ODJOJOURxagElul9zl3E1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_fil.dll
- Size 29KB
- SHA256 e1f0c497bb4d9b2a9f4cb6cf6e382fb4fb8827979c5eb230737af3953db24bda
- MD5 1b18f02bac918465032f9c4c6226f3ee
- SHA1 8173e1be4375ba1ab5fcd35da8b8a4399bee1fbb
- SHA512 baadab3af2d3988acc31a94f9b1321a613a794cd8b8da2ec2e938b7cf7774d586f566fa2bfdfff6da4f05c90e8cb101e261883faa4de48b9a911cc37576ec999
- SSDEEP 384:2HVFXh7pWmIIW2sXsjbjkbZz9IrJqPDDiuz/NEHRN7eA5FyFDR9zzA6cT4aM:PQsXsjboFz9IrJqLDTpAe0FKl9zl2rM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_fr-CA.dll
- Size 30KB
- SHA256 40b00c38c1cb9b0ef6b916ffe1e52605f2523659592e29d06f3f08716033df69
- MD5 a2ca38f79d18fd44b0288fab8cb6f31f
- SHA1 5e94d1265d5dee58d9ff7c72b7b1ba7b07eb4948
- SHA512 37a1aacbe69b90fb3b89bf92b6851a8f7038061dd009bb372db64227657224604ab01f0b09bee54d43205a08536cc43f992ede01cdab64cbad404cd557ccb34c
- SSDEEP 384:2wVFXh7VWmIIWKs7otIR300n/NEHRN7XR9zMkBLanh:qsINR3VlAh9zXIh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_fr.dll
- Size 30KB
- SHA256 5f2461703e6da108b61709078bd19ddf18ff673e8059ec795d52ded554846fac
- MD5 9666bd1ba06b37249980b198b22aa208
- SHA1 a26043d46dd8767f76e111cc971a53237ce720d3
- SHA512 61b893bf94fb3efb70b8da1412d6eb149734da1bb2d3eef2a62fefac469e0e0f3f25b851c6cc0ef2062f826e32ef777bd6469a3402d6dd7aa596600476f14331
- SSDEEP 384:0gtVFXh7pWmIIWK8bW6h0Mf5yEFHRN7UdEpcR9zUmyW:aM8nh9fgElIEpw9zhyW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ga.dll
- Size 29KB
- SHA256 5ac439af44574f3b1c5557edcf8bc416babdba89aaebd51bd5d13d9c023ba5fe
- MD5 ee66c6c39b414cd5adc1c59be87074b1
- SHA1 6f34917e48c5e55850ba55b528faa6e075a76230
- SHA512 451fdf3331b8f02bb60530dc184a0ff5e2193bc05b59e602e8b633047209ca668e38968e7cdae268e993d619be44685fa0e06a46f2ac3c0f8c606a3e4b4825ff
- SSDEEP 384:KZlVFXh7pWmIIWH5vCQkcYoIoAHsc37GxA5yEFHRN7lncTR9ziLPS:/B5vTYoIoAHsaCCgEllcV9zq6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_gd.dll
- Size 30KB
- SHA256 e18b53fd3b34c85dad87f43b7833b518e61c712c3b48c6967408312ff9e43b35
- MD5 e4dbb357e40a839f9c8caaa5a1c1b827
- SHA1 10c66bf5312110a2feed763afa41a448d4070bd7
- SHA512 a09ca0ae932a81919c37faf138dcf017bd2fe9ad21ae8a560444d7c7d3338213274e205d04b7378512603537af2d5fa0235c2ba2bd458cad947ece24c99c9e71
- SSDEEP 384:P/5VFXh7pWmIIWWFYiA73DpfDfqegs2/jRkx//NEHRN7gxEpcR9zUmyp:iwFYiA73NbqpTkxNA0Epw9zhyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_gl.dll
- Size 29KB
- SHA256 0ea76700d2286185f0b65d24106b81258e1593e617a4e66a129004b659518bd7
- MD5 d53c4b0747cd028a7a4a59fcdfe6f375
- SHA1 edbb5606edb9f9899c18853872a2380bb02f39bc
- SHA512 56ff2ed53a6b9f3a2c2f36713b18049ac2bba2494992f0c1dc8d92d2d9dcfe0cb1296041e9a53394bb4d5402e03794b99a774f9054609dd48d42622eb192ac72
- SSDEEP 384:HAhVFXh7pWmIIWksCi2RK1eoY5yEFHRN7YMR9zym2j:zCs281eoYgElf9zbQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_gu.dll
- Size 29KB
- SHA256 9208225c1d83b314ead913c9c5a4f7d5d353a048642f102cfd06bc94598a41a1
- MD5 099eef142a6e8af6f7bb01895dcac818
- SHA1 02d320adb865e6cc6bc22c70ac51102b3473d1a2
- SHA512 e2586b5660ee6e0cd0030895f9c4c398432d041b2db03d1f94e2df47d404d78baa8a18eecab1736d313eb031fdfd2600cf3025b7a39c00cbb82d2b7b094de24a
- SSDEEP 384:eH8VFXh7pWmIIW2t7vdQrsojGtCAPPFZdxjACT6hytA5yEFHRN7Lcu2R9zBiEm:WgCrwXAgElLcuK9zS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_hi.dll
- Size 29KB
- SHA256 c591dbd7563109d709a6fd6b897a3439fca8e14270c4905e6cfbba98590fb6be
- MD5 8ae7c60978f1797c22819452c28e5755
- SHA1 e3c595e988d06248da11f415d279b7371b068e8a
- SHA512 fff4683ee4b0233f37bb8196e9b30e34d66712e0c462207b48c7e5ae40b36c440aeb6015f3b7db3f723bf02c5b0a3853cf2d0a424d187e2587bb4c568f93f3c9
- SSDEEP 384:6uIVFXh7pWmIIWfQj9qYmmqkKo5yEFHRN7UR9zMkBm6Ki:NhQxqYmmqkxgElY9zXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_hr.dll
- Size 29KB
- SHA256 771d490248327bbed8e0f666284b02f691252198034f5b4873c4f5863b60dbda
- MD5 99298a89e5aaddd4c5d31c8159e9df40
- SHA1 980b0840b77f5dfba8af1fe1132afeefa7343e55
- SHA512 0776b89edf8a6be71e813db06c48f0bd97afb4f90387f39f882b255dbd818bd6edffa6ae719d758a63d7d0c236b303e0a053a3741bc9941f3b850e9298820b7d
- SSDEEP 384:LcbVFXh7pWmIIWI/fbmrsCCa9PNV8qa0a/Y35yEFHRN7ep9R9z3pLk:1QsDJna/qgEleR9z9k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_hu.dll
- Size 29KB
- SHA256 a96e5b1a84537708d5ed1e16e59f593cfc35599024e333f0ebaba631f4655ce0
- MD5 3b3917a776c95d41114b590f31513253
- SHA1 6aaf5c9054a4c661f1374f4828ce15cb065d1db1
- SHA512 f22b73146cd84f1e14eb83c461bebc56317bd32b3f734c5f2103cfe6f395a822da33873ff7331330b54c734c2f15685a2b9fac9dfc1895f80e46ee8f2fcc2155
- SSDEEP 768:lWKkZ2hSV6S8+i5bufJHw1DNJgDgElyl9zlQy/:lWKkZh38+BRHQDYZy3zlf/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_id.dll
- Size 27KB
- SHA256 f66d54d3e1ab099d8df66700a9dd04018d088d3d47422b59636bbe1868de495c
- MD5 eb92a889850152a3c67a046b26afb1de
- SHA1 25744a9c829c08faa644d4fdddbaaef2c662605b
- SHA512 14f353ed295e9b2adf1bae45e9eb8ffaeb738f1ca75b7bfdae9c1162b48e24d32ff8c2472d701924c341d9ad4a8216576f666bd08cf012167d325f013987f64b
- SSDEEP 384:RXHWVFXh7pWmIIWQPC8kJZT9rLVcvQCt5yEFHRN7Zr/6fR9z84G:tmtFgEl69zPG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_is.dll
- Size 28KB
- SHA256 b5b48151003cdbf1368b2fc3431fcb5a9646504439b14a95248048706e0b89cd
- MD5 3f3efa36258e2aa2e06d692e25003a72
- SHA1 eb263e69ae3242a518ea0e4c6563e4a99e294292
- SHA512 a5b20784e9531f37a0d25352b033a75d2d5286d914ffba2d401f37ac34fb3acfe024b70c1cbe8ba4a8e9f447db3cc5f45990e2e7e71461961a33d2ef2409efb4
- SSDEEP 768:dDBkg5TpAhr+8wh0xo8pGArPLgEl8K9zQ5:dDBkg5TpAhr+8wh0xo8pbrzZ1zY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_it.dll
- Size 30KB
- SHA256 45f3d6c9396208c5a92af53562db2924a6369004a1f6a06bafdc5c51bbf7c084
- MD5 7a928cdc306a15eca2acba8c6e7fb49c
- SHA1 1d61d526ea7b21b5efcd70d40942bb0b2a3e78d9
- SHA512 843d93cea038ace31ad92e9cf92f2d3b7b6a627c4926605c67760740c6b1e6d7adf965fd549c0aee327b409227e5afef8758944e0015278a035c8b9efd2ac8f7
- SSDEEP 384:rFfVFXh7pWmIIWLuu1+JsJD95yEFHRN7y1RxB+R9z00eX:GT1+JCD9gEly1Rxw9zsX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_iw.dll
- Size 25KB
- SHA256 34eca96f268259a6a67308cb4acd4ec00f33ca3b03c29d5e7cff47d83c137b4c
- MD5 8e4ca001a9ae5aa92c5e74b9b6d490fa
- SHA1 70e3a474c967873aad7d2ad9cb4831f17e032701
- SHA512 997b66aa0c70e26b9b3893f61d9c26a05f87c6d8eb7c1d4a579bfcd1bd54382978f76c1fa6cb59cca20749bfa43890b6c4a65922d77e7914b00821c49fc5e0a2
- SSDEEP 384:sLufPBbpWmIIW0bW1x4SCJ54LGA/t+Qq5yEFHRN7HpR9zepz:0wcCbXgElHD9zm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ja.dll
- Size 24KB
- SHA256 1708bf78de41b10f3fe8c3f56de08af88670f672390970de76878dfcb5cfb1a7
- MD5 52a48aa3c01cb348b109e7e2233b85aa
- SHA1 8bb93772ada23ad818788de655c2b1f68bfbf9ee
- SHA512 3c3246ab0b780576304765cad51aabf71dae49181983ea7eb4b084f31aef500794604db4c7153e9866abf09dcf5be971808eaf0910fdca7ef1e36fe10bedda92
- SSDEEP 384:A3yVFXh7pWmIIWs9gu2/Ju4U5yEFHRN7sRxB+R9z09Hfvrk:ay7pgElsRxw9zUk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ka.dll
- Size 29KB
- SHA256 2a3830279c80da4ce28b02391703d5315e4b674cc81195bbd9cc18f1bcd6f67f
- MD5 b2447c1b8586e9d659bd6c236589e60e
- SHA1 9f0642a974738bd5eb0569dcea308d46d3235dce
- SHA512 7c2fb588fa440473436318e1028303831941988ea9f36ca56c5acd8936b4f52246973c6c76a1e7b3b25ba5069bdd986ec04709c6e0a4f6f2bafaa2029c1c0c91
- SSDEEP 384:OTOVFXh7pWmIIWeodoA7s4THm1l4cVOkt5yEFHRN7ATRxB+R9z0ikwM:ctEtgElqRxw9zI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_kk.dll
- Size 28KB
- SHA256 3573e2e52e84b9ce87e535244376f8fb57c9bc565c5ef3a6defaeb7433a3a958
- MD5 fe09bc3153f94b68208f3ae813e15cb0
- SHA1 7e7264fe77a31826549919aa99c7af6ad3769c40
- SHA512 a6cd7185c47496a3fb666f8fa53cdf40fa1f71cb3759a68088da5f20f54bc4198d0d0c85fc0f0fc215827f4631c1022eca43878487f9fc379a7cfbbd229fb102
- SSDEEP 384:sFdSVFXh7pWmIIWZ9MvPQwL/NEHRN73D9R9z3pPP:iHWvPQwRAr9ztP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_km.dll
- Size 27KB
- SHA256 ee917d39a77d9a66491da123f0a54242c444f3a0e72645121488f7cdc75c8889
- MD5 a01f834efd28c57faee53d79949ecec5
- SHA1 c3cf458bb2f1315f5d2fc4e2c4dfe2bdf8dcb0f7
- SHA512 b767e3be9a164736e8b5aca1768cba4452c2c2fe543f30e08707f6a63ce0d345474c922c9af09f702c437887d4d9dd2d1be59ba69395e9f0f0a47273d7a2e3df
- SSDEEP 768:86xdPX1GBAuN/J/gElxkXC4dC9zZj7re+:88AZ/hZqC4dezJu+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_kn.dll
- Size 29KB
- SHA256 84b3f954cb61c4a87c769c215ec570e8974141c6534517b128989931e881e7ee
- MD5 9360c3a97180c78044c67fcfa2f51a8b
- SHA1 b1fe6cf821e6dedb1f961833c791a9ce7b2c5754
- SHA512 f65c857c1f6364fccf512125d841ac86d4457e0d1d8aae24bab65b1aaf79502993218a2e41916fe32d2ef10af3f8691fdf76c0b280d4778a67b3984fd3af2d8f
- SSDEEP 384:i40DVFXh7pWmIIW9Qd4SMXP7wag5yEFHRN7/xGMR9zyYYN:/vQ6+ngElJJ9z3YN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_ko.dll
- Size 23KB
- SHA256 bd4f94f7d9e3617d7b05fefe59925b7cbfe7dfbdcf051b6fb378291b7b7bfb25
- MD5 83995c5253aabdd4bd236d8238809ceb
- SHA1 18c763f657ee6d3270829290564fb0199615f122
- SHA512 ebbf4bbd8970b6f7eac79d73a6858c0b9546d3ee7ec189f05e74045f6c91385376d4110256aced247828e17812e505919babcd5f623006289021dc3e5a2abb69
- SSDEEP 384:DdPNVFXh7pWmIIWplte7yWYDeYhHNjLUJCB1SGGgrxYQ8lJDuZ5yEFHRN73u/7RV:wrM+OWFzZgEl3uF9zT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_kok.dll
- Size 28KB
- SHA256 9c9a0984b09ec8ace7e6879dabc5ca60cac45c00992972a91dd6425bf2bffe62
- MD5 4140a967a1579c92bf488998b934fd86
- SHA1 9a174bec29f2c166c612e9cf2b25b47d99ef9be7
- SHA512 12436a277adcea2aefcdacc3d96f78a759e8eabe313887dd7c2fe9a5f6c02b75bd301b82a8120a11f51b6c8120d56b47eb7988b3f9c7bada34dea2de182e27c4
- SSDEEP 384:ZEnaVFXh7pWmIIWGRr+hjZ+hjgOjWtYG/NEHRN7jTFDR9zzA6cnh:2L3MKaaAjBl9zlO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_lb.dll
- Size 30KB
- SHA256 3a4342864e18ea9050f0c5c58a89c95fc5a1b868c835290a3be244965b08f314
- MD5 c6b06f583f3e048363e22c24caadbda6
- SHA1 3c119a1008c463f7efb55492ad88ce56fbb3533c
- SHA512 4aef4224601b9a8df3b07188133b9d97fa90e06a245f49397baec7fbcb85996ba886f13b41c3b909a6b87f821c4f969f77f6be112b1c71c21f8a585d087acdc1
- SSDEEP 384:wOeVFXh7pWmIIWbse3swt/bmTRhgNSOw/NEHRN7cxR9zq8o:hJs4sSunskAq9zNo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_lo.dll
- Size 27KB
- SHA256 b7285701b7a1ee1089568caa05a1e527825f578baf188eabf5d43179a934669f
- MD5 96c98965a7904d7adaa31f5f8a1f1f95
- SHA1 1d9fb588e7cca9c2a7836ec49eb9202081adeb1d
- SHA512 d316000ad7e65f9b131664411b8adbd0e27842e9f61a016b5f5f1624202c5281939459f9380ef63977b217126ac5bdb481d5ae9ae318beffa44aa57303930372
- SSDEEP 768:XKADgApU01duiHkJhbMEpZZZPUngEle9zX8:XhD7pU010iHkJhbMEpZZZP8ZazX8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_lt.dll
- Size 28KB
- SHA256 ace485702162345de29b705b3be37826db72f568a44410d7961732d1cd62e56c
- MD5 41bb0d130f5466432a94b2a45028ed5c
- SHA1 23a81de294a82986da25eb86b73097195a629e78
- SHA512 f106ee7052352d41b0c56d0a557239860dc7e885823cf21ad2cffc00ecae603227ccd18f7d9d1edb2c6752263c9b159e444124d1256b8c442c921d1add69cfbb
- SSDEEP 384:0twnUVFXh7pWmIIWErVs2BZJ1f+jmU55z6B60Amq6wD05yEFHRN72/7R9zHN0Ann:bVmrB31f+jmUnz6B606D0gEl2F9zHuA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_lv.dll
- Size 29KB
- SHA256 5a4fbb96bd165f7dc7a55d56f70ede22068819835b60ffc14d7a370c2c891804
- MD5 14c89980237895b168b2805db7964212
- SHA1 8c2bccf5b24869c2ffc19e6230e866d5721bbc3c
- SHA512 83f436072281daa4d6ad7ae4e27912ff661ff72bc3ad34e41f96574925e9abbedc1e3381d557320208aa23978c50a8b46c2d9ee2f6fdc630e30658d207803438
- SSDEEP 384:dpdVFXh7pWmIIWkYppSepDyvK5xYmQ05yEFHRN7L9DMR9zyTIT:yi0gEli9z0o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_mi.dll
- Size 28KB
- SHA256 49e02d60f70fcd0d7ab35cd0deea17ba1f8c687dcd0484ed34a31a529d63ac46
- MD5 761440b1b177daf4f51beb2f66d79c16
- SHA1 76577f1e098e7e81b2ce9e61d6e853c5491a5dd2
- SHA512 ebcb7c62427fe303d3f381b626fabbf4d1aa35583db7333b90889f0b3462b6196dc2dd8649d1071e893c1461870e046476f6089cdc2024f7a71dbc533e2fa103
- SSDEEP 384:uXuVFXh7pWmIIWMHDPvhHXBRDEWUDrF1/rzLOWY8iwwH9hlnyvZNCC5yEFHRN70O:EwRp8fgElr9zwrS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdateres_mk.dll
- Size 29KB
- SHA256 ef2578df3ec1bc94a9624f80af4bcf8e70392553ae28930063692dd7d1d4c46a
- MD5 c3aeb80795b68157737bcf7535c69bd1
- SHA1 163c1cb7d0ae484f1cb9e6eb25c80969efe2f702
- SHA512 ebef893a8e82f7fa99a5e6a5d94da72788c83e7ba4e385a8dc189c622e5759200f136742dcb812d1cae6f1564f97ee4ffc9d10650bde2b88e5bff298918b9432
- SSDEEP 384:jjVVFXh7pWmIIWUHbnGAYeBxVHpEXeZ5q5/NEHRN73IRxB+R9z0IyU+P:WmLj/9p0IOA4Rxw9zK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\MsEdgeCrashpad\settings.dat
- Size 280B
- SHA256 631369b2f7d070f1674bbe180e009d2f79ec47c3df3bc302e64250a199e00b3a
- MD5 0b552c7ac317acf6347e0bd5d95a7aba
- SHA1 2c5c20322dcc7d13087c1a4c9b92595a74cb5a41
- SHA512 a2a0f95f41c9108dd3b200bdab7aa6f17ddb0fddfba45e7b136ec8f4bdc5136de2dc4af6be64382b92bdadc9ce256c079d72f10fef608ad43980e314aef12137
- MD5 SHA1 SHA512
- Path C:\Program Files\Zenith\Zenith.exe
- Size 9.4MB
- SHA256 59370e8af8a400aa7ebd448d4b709b93bc46df13521690f8fa7588fad69027d8
- MD5 e965514e4f584d9c14f3b93853a945ea
- SHA1 07d3e9dcfcd3d989e24e9fc8f4fed4e9395f548a
- SHA512 14befb89f475a016496f8dc7f11a6a6bb03db7afca89fb88f12babc197b403fab4640571f24a095e88e38e52a3e0968582e14750503a08858c92942d8b809404
- SSDEEP 98304:OABPRq8qJsF/rXX2zLWQ0xtBo9DZ0SUO/xpnEq3lA:mW2LWbHBoZVUuz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
- Size 16KB
- SHA256 df64d026c6586330cd4c487690221ae99396e5c849af2cda2d882e1842870553
- MD5 d5823d4daeec8e57f509880d3b93f25e
- SHA1 599a90c6133eace4bce14f6b61c8a64250ba9881
- SHA512 415352003ad8d8ee3eb985c3736faeebe3f256b4bc1472cd38bddddb4be547d8ec6b3082d815ab637833f6197acf30ab2455fb25c63137187210a8216f38920d
- SSDEEP 192:jNQS4FpIruNQS4FpAiNQS4FpeINQS4FphNQS4Fp9cNQS4FphNQS4FpRNQS4Fpu:WIrtAhevc9Dcsu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zenith\Zenith.lnk
- Size 1KB
- SHA256 9d63eb4c6a3c3bfc3a3a2c5bf75d886f82e451b5f77d4561052e472715e67dff
- MD5 fffa6cdabd6ca3d79d1a46e4807db90d
- SHA1 54700256fec279836fb9d0c8531866924aa27629
- SHA512 846d08061ec573506e3f3c0abf6dd5c98f9f2e0e0e3bf6f20dc56a99912884ed639071fa3550ea3c0e8bc3d658186969795dea27ff3298d256753be2ac97b531
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zenith\Zenith.lnk~RFe57c822.TMP
- Size 1KB
- SHA256 ac0dc14eba6237615da00f081606562e0ce30392a34d8c5e19e7ccd5f6058bec
- MD5 3f37775f2a6bf1e6aff12496a361c9c0
- SHA1 98dff7d3f15f7ec1b803f07fc4342e086f5e53dd
- SHA512 9a8c75dd3d5c15d496cb34140be7bc4b03e3109316c0e8689645c8c8294d252cdf56a5fe5faada5c8ed415be138b9f18ab85d62f287db2413cb6e16fd3c16180
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI8B67.tmp
- Size 113KB
- SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
- MD5 4fdd16752561cf585fed1506914d73e0
- SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
- SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
- SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
- MD5 db7fb67fcec9f1c442de25f3ad59f50c
- SHA1 b600aa26d1cded59760304c6d77f4ff75722eabd
- SHA512 c14ec7d252a6f201dfea476d302fbc5140713cb4ea7bc8d4e610bfd806b3fa3c141153e2e9b8cb36255fba1fab4d4400ed83f5f5c1228d77d77bace41d5de7fe
- SSDEEP 49152:5iE43+3Abe4zwweoW+ny23MPqqz/mKYnyW:5ikAbeayoWYtqTeyW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w2hpis42.kjj.ps1
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 18612bc8c39bde9f99f13acef3d3382dfebacbb5cf7d4e6ca3bd60ff0ed13f23
- MD5 607e62e258ade2afe1892b8da071d76c
- SHA1 bb4736aedc89eb4e76d537fd1936e8c897b86c8a
- SHA512 1f6c826fd3de6a27d6dea30bb363f8c26b617144bf1c23dec1b0fbae34e82a42948e9ff01423ac122d7021a49da0c4885fd28eba8cfdf2edf42068e9446de9a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\6c79fe69-308f-4549-b924-803d59a18460.tmp
- Size 6KB
- SHA256 2f0398689c15aa2338582a88302360b4aa78d0693a92ab745d1ee17172db118e
- MD5 d7cd59b2c52554fe7e62588bb0441804
- SHA1 166d9914eb7f7aca77dc905ce8e18d5687078ce6
- SHA512 9ca6e00920f7cd29baf160d297887de7f33bfcf6863c515a121da123eed6fb88ad9cdaf8042d0aa400f3704ed932d050f1ed1f836b0580ea2a583ce95100a02b
- SSDEEP 96:stfeGGg/b9I0EqGZ5hE86ZF/7/x+hHMSm+uecL9jaYxYK+gVHW28XM1C7K:stWGhgZg9/V++J9+YZL2G6K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 053d115284595df3298fffbae21c5bc19cddb8b0bd80b4c5d5dc41ee6683449f
- MD5 3d6b719383c0b70c30d2a16d6ce101d2
- SHA1 17c71825b981fc15b3d3efc596935348c94fe4ac
- SHA512 7960a9a0266c7970addb202796beb03455f2f9b0ca0aeaf7cf375a378efd32e10de7ffd60be983ff6f1aebb74f1adbe470bdfd147756af1ccfb87d53dc33307b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 5a6b5473bd6b7abc6cc62d51dd82bad1a07c4d66021df9bac1ff4a6b218614c6
- MD5 dbb27738d31500db77eb9e448fa0732c
- SHA1 f8eb1f9aacc48be49a94f13c90711b5e6fb39331
- SHA512 bbcf0eed1ec115a7eb881c3ecbcb02f20a11e011be4d99e077290a56f730be8575a8a3951c78cfc3accac828169f87049f7c79ec839379916bcc852525311a20
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\Extension Rules\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Local State
- Size 1KB
- SHA256 de54c6cd5fe9b95e6c7d20a29e4e06e2f77bff9b4ec8e5ba2e34fd050a2e32c6
- MD5 47cea24c6729e282ff51ab6380e1519f
- SHA1 e1a82c3bbdd5f229ff9b6e137386e2296030854b
- SHA512 b246012808adf1bf8f2515a38fc24415df0b06410bc28419a5638a11492eefef44f2cd883e7582dbfaca960f7e73d34a88cfef3414028f092b69eb2e7eb08b29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Local State
- Size 3KB
- SHA256 3d308e7a40c434ed58c1b49fb65a2aa573e286e62f8b6b021b545bbc7b376f41
- MD5 4221e336d654aed840ac8b0b7849c3eb
- SHA1 53aa324dcdf233537cc38790f836f08e8df5614a
- SHA512 f9bad8eccf26f3a1d822fc0d39ccf2ba053d1cf8895219b6a90ceac29b29226c00471a351746c0512f19c20ebd94415dc60d45d9ef2d33fc4f070d8606059def
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Local State
- Size 16KB
- SHA256 624830c8ffa62bba3652310fa612ae2617e417e792b199c19dd5d1661cd972d5
- MD5 7f263533d98ab5339729cdcacd59967b
- SHA1 5bed20b62f8656c227c24ae01e0269f55ad85c4c
- SHA512 f8dcb01e92f4ee67609f72087ab9ac666d31b41ca9b0bef025ce5e192d634acb001bfc38846732d8715972168ac0c5e29b0c14c9c0ff57407194782d5b00c4b5
- SSDEEP 384:zUv+Lm06H4njzTfy1TkAUNb8ZcQv1QC49+wnf1:AWa06YbfKOuJ4Nf1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Local State
- Size 4KB
- SHA256 d70f1ae2058d3caca46cc74c4952dc68592f06931c6ff4a7b1d86c1e79275c82
- MD5 6b45a61fc9cdd5dd27f9046794d9442e
- SHA1 387b8f2a0f7c690631a851833fd97e956da5cb8b
- SHA512 36578ad183bd820c4d846e780fd1f23ce05ce68795ce092964c74187a85110318d05cb015e3801719cd17bb705fcf026bfdbb578fe7b33796778aa3790b399b2
- SSDEEP 96:GNkCufZxO858kh/cInURoDotodtidBNP+7LZASATQCpwF+8mJ7fD2Ka:GNb2xOgooDUXDNaYQCpK+8+zs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.wadbot.zenith\EBWebView\Local State~RFe5924a5.TMP
- Size 1KB
- SHA256 29374cb43af7396b611494a5eae9b32479c66c893bc92d623ddce277bd7f2d7f
- MD5 e504abc386d5b937b62cd45e06b22fdf
- SHA1 f5495a6d0b0a440c634c03f0cfc087b8899f716f
- SHA512 46e14fb412c10ade7d4e02cb3b432ff0cbd0a88aed2a4e863f37c4d348724214a09104ad645de8a0d0bdaf3ac5d857f56e08eaac50da39eff0ab0233e7cd871f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\e57c60f.msi
- Size 4.9MB
- SHA256 fc7951a89153fe45d256c1c232fc564d6811fc69201f60f0ae5c57ab39593844
- MD5 9e98e26180fa72c4e6b817d46a670ead
- SHA1 db0e2d5ddbc579f7e606d1bffdcc515a5e92d3a8
- SHA512 91c6bee694d2f4aed4701bc574d09fa20e00fd3b0fe4f31793dde12a5c786209f658fc08919ed621c7809a27efbc49b583cf1c8b8fa5cf1271b66ef47de59b75
- SSDEEP 98304:3MnzBetL5W2tYd3RGIO7AfZ4NKrnTUQjDqOZjYG4ssycQDn2bsyD7YhaiZrRrzA:8wL5WNGIO7AxBrTUOxjYG7syHD2bsy/U
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Microsoft\Temp\EUD3F9.tmp\msedgeupdate.dll
- Size 2.1MB
- SHA256 7d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
- MD5 1125e435063e7c722c0079fdf0a5b751
- SHA1 9b1c36d2b7df507a027314ece2ef96f5b775c422
- SHA512 153f096af5c874c00a3c38602fab590eccf885f642040007b67799ef39d919d7cb261fba43a9ffbd68c8824eddea219505d49e05b3dcc70f00e6016a1fbd12b9
- SSDEEP 49152:1rZS9B51CBQM7FkyYl/ajn9q2BBLEywacEO+:BZSx4BQM+VD2BVERo
- MD5 SHA1 SHA512 SSDEEP