Overview

overview

8

Static

static

1

Zenith_1.0...US.msi

windows10-1703-x64

8

Zenith_1.0...US.msi

windows10-2004-x64

8

Analysis

  • max time kernel
    1041s
  • max time network
    565s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 02:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zenith_1.0.0_x64_en-US.msi
  • Size 4.9MB
  • Sample240608-ckfk6afe4x
  • SHA256 fc7951a89153fe45d256c1c232fc564d6811fc69201f60f0ae5c57ab39593844
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryexecutionpersistencestealer

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 20 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 25 IoCs
  • Registers COM server for autorun 1 TTPs 49 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Zenith_1.0.0_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4480
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 03ACF79B7E725A6BC7C85881D1C1DD6D C
      2⤵
      • Loads dropped DLL
      PID:3180
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2420
          • C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            4⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1660
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:552
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3028
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:556
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:2352
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY5QjNENUQtODFCQS00RTIwLUFEOTEtMkU3M0RCOUFEQTI4fSIgdXNlcmlkPSJ7QTlFNUI1OTItRTU5Qy00QjlBLTgyRUUtQjJFNDQxQkI2MDM3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQTE4NTVBMS1CQUVELTQ5ODctOERENS1EMzRDOURGODExQjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xODcuNDEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NzE3MTk3NTQiIGluc3RhbGxfdGltZV9tcz0iNTAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
              5⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2468
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BF9B3D5D-81BA-4E20-AD91-2E73DB9ADA28}" /silent
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4280
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1252
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY5QjNENUQtODFCQS00RTIwLUFEOTEtMkU3M0RCOUFEQTI4fSIgdXNlcmlkPSJ7QTlFNUI1OTItRTU5Qy00QjlBLTgyRUUtQjJFNDQxQkI2MDM3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzgxODhDQUYtMTQ4OC00QkRFLTgzQjQtNkY2MTA2RTg4N0FGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTcxMjM1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2NDM3NjU3MzAzOTgwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk3ODU5NDg3NSIvPjwvYXBwPjwvcmVxdWVzdD4
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4064
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\MicrosoftEdge_X64_125.0.2535.92.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\EDGEMITMP_45E14.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\EDGEMITMP_45E14.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\MicrosoftEdge_X64_125.0.2535.92.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\EDGEMITMP_45E14.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\EDGEMITMP_45E14.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3DBE270F-4FAD-4AB2-85F1-0BB9D9BEB0A9}\EDGEMITMP_45E14.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7ba084b18,0x7ff7ba084b24,0x7ff7ba084b30
            4⤵
            • Executes dropped EXE
            PID:4348
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY5QjNENUQtODFCQS00RTIwLUFEOTEtMkU3M0RCOUFEQTI4fSIgdXNlcmlkPSJ7QTlFNUI1OTItRTU5Qy00QjlBLTgyRUUtQjJFNDQxQkI2MDM3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5QTYxRERDNy0zNTk0LTQ5OTEtQUQwMS05REE0MEE1OEQwNzB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS45MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk4OTUzMzA3NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5ODk2ODg3NjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjQ5ODM5NzE2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8xOTlkNmIyMi02ZjhlLTQ2MjAtODAyOS1mN2UzYTJhM2ZkZWE_UDE9MTcxODQxNzMzMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1IOFpPcFFTdEpYOGpsSm5EVTNJdXhtOWpCTjFSVkVlSkg1bHI5MHgyczMyc2xhME9QVFVBOFUxNk5IRkZCVFNWbHJiek9BdmZ0S0ZLYllVJTJiaTJNVDJRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczODEwNzUyIiB0b3RhbD0iMTczODEwNzUyIiBkb3dubG9hZF90aW1lX21zPSI1OTQwNiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NDk5OTU5NjciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjYzNDMzNzE3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MDg5OTk2NTA1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzEzIiBkb3dubG9hZF90aW1lX21zPSI2NjAxNSIgZG93bmxvYWRlZD0iMTczODEwNzUyIiB0b3RhbD0iMTczODEwNzUyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0MjY1NiIvPjwvYXBwPjwvcmVxdWVzdD4
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1656
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5048
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{12D8D666-93D9-4854-B4F7-FED5C914DF67}\BGAUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{12D8D666-93D9-4854-B4F7-FED5C914DF67}\BGAUpdate.exe" --edgeupdate-client --system-level
        2⤵
        • Adds Run key to start application
        • Executes dropped EXE
        PID:3492
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEIzQ0I0OUItMDE0RC00MjZGLTg2M0YtQ0E3MzY1RkVCRUU5fSIgdXNlcmlkPSJ7QTlFNUI1OTItRTU5Qy00QjlBLTgyRUUtQjJFNDQxQkI2MDM3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGRTRCNzFCMS1FQ0UzLTRBOUEtOTgxRC00NzI1QUI5NDBFNTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTcwMTUyODkyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzk3MDMwODUwMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTE0NjgzMzIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTg0MTc2MzAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RXBvdFNhemtCaWtydTJhakNKVzRJcWVYRGdZY0xheE0lMmZRUFVFcFVmcjlBNDR5djFNS25UbVklMmYlMmZUVW8zS1RwZGhBdlhHbXBFd1pzQ1N1UEV6WEJEU2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTE0NjgzMzIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxODQxNzYzMCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FcG90U2F6a0Jpa3J1MmFqQ0pXNElxZVhEZ1ljTGF4TSUyZlFQVUVwVWZyOUE0NHl2MU1LblRtWSUyZiUyZlRVbzNLVHBkaEF2WEdtcEV3WnNDU3VQRXpYQkRTZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIGRvd25sb2FkX3RpbWVfbXM9IjUwMDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODUxNDY4MzMyMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1MjA2MjEyMTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTIyNDk2MTU1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjUwIiBkb3dubG9hZF90aW1lX21zPSI1NDQwNiIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMTg3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        PID:2980
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\MicrosoftEdge_X64_125.0.2535.85.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\MicrosoftEdge_X64_125.0.2535.85.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\MicrosoftEdge_X64_125.0.2535.85.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          3⤵
          • Installs/modifies Browser Helper Object
          • Modifies Installed Components in the registry
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Registers COM server for autorun
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4488
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.85 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7f1ee4b18,0x7ff7f1ee4b24,0x7ff7f1ee4b30
            4⤵
            • Executes dropped EXE
            PID:4352
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{693983AE-E147-423F-874D-44E4894ACC67}\EDGEMITMP_581D9.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.85 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7f1ee4b18,0x7ff7f1ee4b24,0x7ff7f1ee4b30
              5⤵
              • Executes dropped EXE
              PID:2188
          • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.85\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.85\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.85\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.85\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.85\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.85 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff60b8f4b18,0x7ff60b8f4b24,0x7ff60b8f4b30
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:4144
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjQzQjA2RjUtRkY3Ny00ODU1LUE3NDMtNTczNzYyNkY1QzVCfSIgdXNlcmlkPSJ7QTlFNUI1OTItRTU5Qy00QjlBLTgyRUUtQjJFNDQxQkI2MDM3fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins2MTYxQjEzOS0xMDUyLTRFNkYtQTc0Mi0wQjBGRDQ5RjgyNjl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny40MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMzAiIGNvaG9ydD0icnJmQDAuNzMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMzEiIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0iezJGODkzMTRCLTA1RUUtNEI1QS04RjVFLTIwRjREMDIyQzAxRH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMjUuMC4yNTM1Ljg1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjMwIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTk2NDg3MTM0NTQxMjYwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NzYwOTMzNDg0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg3NjEyNDU5MTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk0NDQyMTQ3MjgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zYzc3NWU3NS1hZmY4LTRhZjEtYWVkZS03YTVjMDM0OWFhMGI_UDE9MTcxODQxNzcwOSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1OaW1oRkFwbVhpR0dZaXElMmJJbWp2Y1ElMmZjVER1b2hhVVU0MVliaEZ6SXBnNjBld1ROd3dGNGhtVFFhZWJCSkw1MW5KendCJTJiRzlNeW4lMmZWNFFuTmdZZ2ZnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTQ0NDIxNDcyOCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvM2M3NzVlNzUtYWZmOC00YWYxLWFlZGUtN2E1YzAzNDlhYTBiP1AxPTE3MTg0MTc3MDkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TmltaEZBcG1YaUdHWWlxJTJiSW1qdmNRJTJmY1REdW9oYVVVNDFZYmhGeklwZzYwZXdUTnd3RjRobVRRYWViQkpMNTFuSnp3QiUyYkc5TXluJTJmVjRRbk5nWWdmZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MzY3NTU3NiIgdG90YWw9IjE3MzY3NTU3NiIgZG93bmxvYWRfdGltZV9tcz0iNjY0ODQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTQ0NDM3MDg4NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NDU3NjUyODgyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODc4NDM0MTA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjk3IiBkb3dubG9hZF90aW1lX21zPSI2ODI2NiIgZG93bmxvYWRlZD0iMTczNjc1NTc2IiB0b3RhbD0iMTczNjc1NTc2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0MjA3OCIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMzEiIHI9IjMxIiBhZD0iNjMzNyIgcmQ9IjYzMzciIHBpbmdfZnJlc2huZXNzPSJ7NjdDRTBDNjEtNTA5MC00NjAzLUEwODMtMUU5QUZCREExRTIyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjUuMC4yNTM1LjkyIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzNjMiIGNvaG9ydD0icnJmQDAuNDQiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins2MTU4QkZCRC01QzI3LTQ1N0UtOTFDRC0zRkExMkM4NUU1NDd9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1780

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57d14b.rbs
          • Path C:\Config.Msi\e57d14b.rbs
          • Size 10KB
          • SHA256 2a2f2ea6183ad6e94f60696e4a45c2a8bd9f7aca8884918c7cc5c3d053f776a4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.85\Installer\setup.exe
          • Size 6.9MB
          • SHA256 4454ee06716329235c9395b1bc3c5498565074bd43fffd70123935ed68096796
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.92\Installer\setup.exe
          • Size 6.9MB
          • SHA256 9595008f51be8ca7c82618c84d30f0a7fdac9fe7433b806af504da0d38aef10a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BGAUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
          • Size 17.2MB
          • SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 179KB
          • SHA256 ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeUpdate.exe
          • Size 201KB
          • SHA256 d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 212KB
          • SHA256 9c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 258KB
          • SHA256 2ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdate.dll
          • Size 2.1MB
          • SHA256 7d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_af.dll
          • Size 29KB
          • SHA256 5995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_as.dll
          • Size 29KB
          • SHA256 3dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 18d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_bs.dll
          • Size 29KB
          • SHA256 7c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 30KB
          • SHA256 ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 8bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 5410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_da.dll
          • Size 29KB
          • SHA256 157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_de.dll
          • Size 31KB
          • SHA256 84ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_el.dll
          • Size 31KB
          • SHA256 e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 39e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_es.dll
          • Size 29KB
          • SHA256 2d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 83a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_eu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_eu.dll
          • Size 29KB
          • SHA256 698dd9be2f9edce221977a6c076e894f72ffd1287c4a67423d1ea06ddfa90b21
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fa.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_fa.dll
          • Size 28KB
          • SHA256 a66e9dc8829de13dfaf3e727ddf5a1655e0dd8844ab95fe461b61f996287a802
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_fi.dll
          • Size 28KB
          • SHA256 c3800427be8e5550e6fa985f28bb4cf183f8b49d398533ad0eacea53a5a573d6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fil.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_fil.dll
          • Size 29KB
          • SHA256 e1f0c497bb4d9b2a9f4cb6cf6e382fb4fb8827979c5eb230737af3953db24bda
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fr-CA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_fr-CA.dll
          • Size 30KB
          • SHA256 40b00c38c1cb9b0ef6b916ffe1e52605f2523659592e29d06f3f08716033df69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_fr.dll
          • Size 30KB
          • SHA256 5f2461703e6da108b61709078bd19ddf18ff673e8059ec795d52ded554846fac
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ga.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ga.dll
          • Size 29KB
          • SHA256 5ac439af44574f3b1c5557edcf8bc416babdba89aaebd51bd5d13d9c023ba5fe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gd.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_gd.dll
          • Size 30KB
          • SHA256 e18b53fd3b34c85dad87f43b7833b518e61c712c3b48c6967408312ff9e43b35
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gl.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_gl.dll
          • Size 29KB
          • SHA256 0ea76700d2286185f0b65d24106b81258e1593e617a4e66a129004b659518bd7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_gu.dll
          • Size 29KB
          • SHA256 9208225c1d83b314ead913c9c5a4f7d5d353a048642f102cfd06bc94598a41a1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_hi.dll
          • Size 29KB
          • SHA256 c591dbd7563109d709a6fd6b897a3439fca8e14270c4905e6cfbba98590fb6be
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_hr.dll
          • Size 29KB
          • SHA256 771d490248327bbed8e0f666284b02f691252198034f5b4873c4f5863b60dbda
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_hu.dll
          • Size 29KB
          • SHA256 a96e5b1a84537708d5ed1e16e59f593cfc35599024e333f0ebaba631f4655ce0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_id.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_id.dll
          • Size 27KB
          • SHA256 f66d54d3e1ab099d8df66700a9dd04018d088d3d47422b59636bbe1868de495c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_is.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_is.dll
          • Size 28KB
          • SHA256 b5b48151003cdbf1368b2fc3431fcb5a9646504439b14a95248048706e0b89cd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_it.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_it.dll
          • Size 30KB
          • SHA256 45f3d6c9396208c5a92af53562db2924a6369004a1f6a06bafdc5c51bbf7c084
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_iw.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_iw.dll
          • Size 25KB
          • SHA256 34eca96f268259a6a67308cb4acd4ec00f33ca3b03c29d5e7cff47d83c137b4c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ja.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ja.dll
          • Size 24KB
          • SHA256 1708bf78de41b10f3fe8c3f56de08af88670f672390970de76878dfcb5cfb1a7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ka.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ka.dll
          • Size 29KB
          • SHA256 2a3830279c80da4ce28b02391703d5315e4b674cc81195bbd9cc18f1bcd6f67f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_kk.dll
          • Size 28KB
          • SHA256 3573e2e52e84b9ce87e535244376f8fb57c9bc565c5ef3a6defaeb7433a3a958
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_km.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_km.dll
          • Size 27KB
          • SHA256 ee917d39a77d9a66491da123f0a54242c444f3a0e72645121488f7cdc75c8889
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_kn.dll
          • Size 29KB
          • SHA256 84b3f954cb61c4a87c769c215ec570e8974141c6534517b128989931e881e7ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ko.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_ko.dll
          • Size 23KB
          • SHA256 bd4f94f7d9e3617d7b05fefe59925b7cbfe7dfbdcf051b6fb378291b7b7bfb25
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kok.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_kok.dll
          • Size 28KB
          • SHA256 9c9a0984b09ec8ace7e6879dabc5ca60cac45c00992972a91dd6425bf2bffe62
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lb.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_lb.dll
          • Size 30KB
          • SHA256 3a4342864e18ea9050f0c5c58a89c95fc5a1b868c835290a3be244965b08f314
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lo.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_lo.dll
          • Size 27KB
          • SHA256 b7285701b7a1ee1089568caa05a1e527825f578baf188eabf5d43179a934669f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lt.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_lt.dll
          • Size 28KB
          • SHA256 ace485702162345de29b705b3be37826db72f568a44410d7961732d1cd62e56c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lv.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_lv.dll
          • Size 29KB
          • SHA256 5a4fbb96bd165f7dc7a55d56f70ede22068819835b60ffc14d7a370c2c891804
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_mi.dll
          • Size 28KB
          • SHA256 49e02d60f70fcd0d7ab35cd0deea17ba1f8c687dcd0484ed34a31a529d63ac46
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUE280.tmp\msedgeupdateres_mk.dll
          • Size 29KB
          • SHA256 ef2578df3ec1bc94a9624f80af4bcf8e70392553ae28930063692dd7d1d4c46a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Program Files\MsEdgeCrashpad\settings.dat
          • Size 280B
          • SHA256 a69713dd94a966b4ce59c116a428dc655a7561c0e5e8d54f8f870315c16aaf34
          • MD5 SHA1 SHA512
          Submit Download

          Zenith.exe
          • Path C:\Program Files\Zenith\Zenith.exe
          • Size 9.4MB
          • SHA256 59370e8af8a400aa7ebd448d4b709b93bc46df13521690f8fa7588fad69027d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 105KB
          • SHA256 e7e9c3d0ec8af378852934e748c52b13717871dff254cd48ff513c4b6ef2bc9e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Zenith.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zenith\Zenith.lnk
          • Size 1KB
          • SHA256 3bc8dcd18247c02cc5bb36617b85d068058ef6f7d92768ccef8bd06969c943ac
          • MD5 SHA1 SHA512
          Submit Download

          Zenith.lnk~RFe57d2f0.TMP
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zenith\Zenith.lnk~RFe57d2f0.TMP
          • Size 1KB
          • SHA256 e9a77660f6b31c090447735211b972a5fa839c8f50e4894c6d453d5e76710272
          • MD5 SHA1 SHA512
          Submit Download

          MSI99BF.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI99BF.tmp
          • Size 113KB
          • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeWebview2Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
          • Size 1.6MB
          • SHA256 c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          __PSScriptPolicyTest_xbpuiixh.ro4.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbpuiixh.ro4.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          e57d14a.msi
          • Path C:\Windows\Installer\e57d14a.msi
          • Size 4.9MB
          • SHA256 fc7951a89153fe45d256c1c232fc564d6811fc69201f60f0ae5c57ab39593844
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2372-248-0x00000000748D0000-0x0000000074AEF000-memory.dmp
          Download

          memory/2372-316-0x00000000001D0000-0x0000000000205000-memory.dmp
          Download

          memory/2372-260-0x00000000748D0000-0x0000000074AEF000-memory.dmp
          Download

          memory/2372-247-0x00000000001D0000-0x0000000000205000-memory.dmp
          Download

          memory/4084-43-0x00000158BB170000-0x00000158BB192000-memory.dmp
          Download