f5e0a6cc46e4f74c7ea1bffd0e75d5a6de3a2c70376c4025c01417ecbd2284e4

Resubmissions

22/07/2024, 17:44

240722-wa9k2azcrq 6

22/07/2024, 17:43

240722-wavrwaygmg 1

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

webOS.Dev.Manager_1.13.3_x64_en-US.msi
Size

12.6MB
MD5

70fb7e81ddd19dbcdd8e1e03bcff575b
SHA1

5783fd87764a4a4b86f7b74c9c9eee591ceea18c
SHA256

f5e0a6cc46e4f74c7ea1bffd0e75d5a6de3a2c70376c4025c01417ecbd2284e4
SHA512

dc341ecfe79e88b8e07542689db8c74219ada7f513feb2cf8c7f2cf574aee42f4afeb8ba59dd1164fb3bca71041b9651f4ffacbb241a386fdd59141ba8a4259b
SSDEEP

196608:KGvCh4ABp7gi3gLZRwT9qmNkxierM1Otkfmwgf3Y3SYwi22BvzVEIR:zvC2Aj7gHZsqOk8v+wcI3S8Zz

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_id.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_vi.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdate.exe	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_da.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_gu.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_or.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ne.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ja.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_zh-TW.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_pl.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_el.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_is.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_it.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_lt.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bg.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_sr.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ta.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_cy.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_sr-Latn-RS.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_es.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_te.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bn-IN.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files\webOS Dev Manager\Uninstall webOS Dev Manager.lnk	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_et.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fa.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_lo.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\NOTICE.TXT	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ca.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_zh-CN.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_sq.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_eu.dll	MSI2963.tmp
File created	C:\Program Files\webOS Dev Manager\webOS Dev Manager.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdateOnDemand.exe	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\psuser.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_en-GB.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fil.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_as.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdate.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\psuser_arm64.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_cs.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_hu.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_af.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdateBroker.exe	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_pt-BR.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_tt.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_sk.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ka.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fi.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fr.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fr-CA.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_kk.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_mt.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ug.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\psmachine.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_es-419.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_mr.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_nl.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_mk.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\psmachine_64.dll	MSI2963.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\EdgeUpdate.dat	MSI2963.tmp

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{BB9B508F-6C9C-4F28-9534-499BA22B632F}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\f78142f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1748.tmp	msiexec.exe
File created	C:\Windows\Installer\{BB9B508F-6C9C-4F28-9534-499BA22B632F}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f78142c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78142c.msi	msiexec.exe
File created	C:\Windows\Installer\f78142d.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2963.tmp	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
3020	MSI2963.tmp
1772	MicrosoftEdgeUpdate.exe
1616	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdateComRegisterShell64.exe
2328	MicrosoftEdgeUpdateComRegisterShell64.exe
908	MicrosoftEdgeUpdateComRegisterShell64.exe
2468	MicrosoftEdgeUpdate.exe
2192	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdate.exe
3036	MicrosoftEdgeUpdate.exe
2464	MicrosoftEdgeUpdate.exe

Loads dropped DLL 42 IoCs

pid	Process
2900	MsiExec.exe
2720	msiexec.exe
2720	msiexec.exe
1236	Process not Found
1236	Process not Found
1236	Process not Found
1236	Process not Found
1236	Process not Found
3020	MSI2963.tmp
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1616	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
2748	MicrosoftEdgeUpdateComRegisterShell64.exe
2704	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
2328	MicrosoftEdgeUpdateComRegisterShell64.exe
2704	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdateComRegisterShell64.exe
2704	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
2468	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
2192	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdate.exe
2192	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdate.exe
3036	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdate.exe
2464	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0007000000018fac-18.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2112	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{906A208E-7332-410C-B6EC-9D548723C920}\WpadNetworkName = "Network 3"	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{906A208E-7332-410C-B6EC-9D548723C920}\WpadDecisionTime = 80f51f165fdcda01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{906A208E-7332-410C-B6EC-9D548723C920}\WpadDecisionTime = 601a29f95edcda01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-79-42-19-16-d8\WpadDecisionTime = 202bc8f25edcda01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-79-42-19-16-d8\WpadDecision = "0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{906A208E-7332-410C-B6EC-9D548723C920}\9a-79-42-19-16-d8	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-79-42-19-16-d8\WpadDecisionTime = 80f51f165fdcda01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-79-42-19-16-d8\WpadDecisionTime = e054ed105fdcda01	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F805B9BBC9C682F4594394B92AB236F2\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBA46DC7-84D0-4C3B-BE4A-308C78349304}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{C54F392B-CBA7-4F57-AE2E-DDCE3A1A801F}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.27\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.27\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2720	msiexec.exe
2720	msiexec.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe
1772	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeRestorePrivilege	2720	msiexec.exe
Token: SeTakeOwnershipPrivilege	2720	msiexec.exe
Token: SeSecurityPrivilege	2720	msiexec.exe
Token: SeCreateTokenPrivilege	2112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2112	msiexec.exe
Token: SeLockMemoryPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeMachineAccountPrivilege	2112	msiexec.exe
Token: SeTcbPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2112	msiexec.exe
Token: SeTakeOwnershipPrivilege	2112	msiexec.exe
Token: SeLoadDriverPrivilege	2112	msiexec.exe
Token: SeSystemProfilePrivilege	2112	msiexec.exe
Token: SeSystemtimePrivilege	2112	msiexec.exe
Token: SeProfSingleProcessPrivilege	2112	msiexec.exe
Token: SeIncBasePriorityPrivilege	2112	msiexec.exe
Token: SeCreatePagefilePrivilege	2112	msiexec.exe
Token: SeCreatePermanentPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	2112	msiexec.exe
Token: SeRestorePrivilege	2112	msiexec.exe
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeDebugPrivilege	2112	msiexec.exe
Token: SeAuditPrivilege	2112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2112	msiexec.exe
Token: SeChangeNotifyPrivilege	2112	msiexec.exe
Token: SeRemoteShutdownPrivilege	2112	msiexec.exe
Token: SeUndockPrivilege	2112	msiexec.exe
Token: SeSyncAgentPrivilege	2112	msiexec.exe
Token: SeEnableDelegationPrivilege	2112	msiexec.exe
Token: SeManageVolumePrivilege	2112	msiexec.exe
Token: SeImpersonatePrivilege	2112	msiexec.exe
Token: SeCreateGlobalPrivilege	2112	msiexec.exe
Token: SeCreateTokenPrivilege	2112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2112	msiexec.exe
Token: SeLockMemoryPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeMachineAccountPrivilege	2112	msiexec.exe
Token: SeTcbPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2112	msiexec.exe
Token: SeTakeOwnershipPrivilege	2112	msiexec.exe
Token: SeLoadDriverPrivilege	2112	msiexec.exe
Token: SeSystemProfilePrivilege	2112	msiexec.exe
Token: SeSystemtimePrivilege	2112	msiexec.exe
Token: SeProfSingleProcessPrivilege	2112	msiexec.exe
Token: SeIncBasePriorityPrivilege	2112	msiexec.exe
Token: SeCreatePagefilePrivilege	2112	msiexec.exe
Token: SeCreatePermanentPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	2112	msiexec.exe
Token: SeRestorePrivilege	2112	msiexec.exe
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeDebugPrivilege	2112	msiexec.exe
Token: SeAuditPrivilege	2112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2112	msiexec.exe
Token: SeChangeNotifyPrivilege	2112	msiexec.exe
Token: SeRemoteShutdownPrivilege	2112	msiexec.exe
Token: SeUndockPrivilege	2112	msiexec.exe
Token: SeSyncAgentPrivilege	2112	msiexec.exe
Token: SeEnableDelegationPrivilege	2112	msiexec.exe
Token: SeManageVolumePrivilege	2112	msiexec.exe
Token: SeImpersonatePrivilege	2112	msiexec.exe
Token: SeCreateGlobalPrivilege	2112	msiexec.exe
Token: SeCreateTokenPrivilege	2112	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 2900	2720	msiexec.exe	31
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 2720 wrote to memory of 3020	2720	msiexec.exe	36
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 3020 wrote to memory of 1772	3020	MSI2963.tmp	37
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 1616	1772	MicrosoftEdgeUpdate.exe	38
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 1772 wrote to memory of 2704	1772	MicrosoftEdgeUpdate.exe	39
PID 2704 wrote to memory of 2748	2704	MicrosoftEdgeUpdate.exe	40
PID 2704 wrote to memory of 2748	2704	MicrosoftEdgeUpdate.exe	40
PID 2704 wrote to memory of 2748	2704	MicrosoftEdgeUpdate.exe	40
PID 2704 wrote to memory of 2748	2704	MicrosoftEdgeUpdate.exe	40
PID 2704 wrote to memory of 2328	2704	MicrosoftEdgeUpdate.exe	41
PID 2704 wrote to memory of 2328	2704	MicrosoftEdgeUpdate.exe	41
PID 2704 wrote to memory of 2328	2704	MicrosoftEdgeUpdate.exe	41
PID 2704 wrote to memory of 2328	2704	MicrosoftEdgeUpdate.exe	41
PID 2704 wrote to memory of 908	2704	MicrosoftEdgeUpdate.exe	42
PID 2704 wrote to memory of 908	2704	MicrosoftEdgeUpdate.exe	42
PID 2704 wrote to memory of 908	2704	MicrosoftEdgeUpdate.exe	42
PID 2704 wrote to memory of 908	2704	MicrosoftEdgeUpdate.exe	42
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2468	1772	MicrosoftEdgeUpdate.exe	43
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1772 wrote to memory of 2192	1772	MicrosoftEdgeUpdate.exe	44
PID 1472 wrote to memory of 3036	1472	MicrosoftEdgeUpdate.exe	46
PID 1472 wrote to memory of 3036	1472	MicrosoftEdgeUpdate.exe	46
PID 1472 wrote to memory of 3036	1472	MicrosoftEdgeUpdate.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\webOS.Dev.Manager_1.13.3_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96475D272203436EA452C146718186C7 C
  2⤵
  - Loads dropped DLL
  PID:2900
- C:\Windows\Installer\MSI2963.tmp
  "C:\Windows\Installer\MSI2963.tmp" /install
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1616
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2328
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:908
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODdDNDY3QUMtN0NGOS00RDcwLTlCNTMtOTVCOUMxMzlCNTAxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswODlFN0QzRi05ODI2LTQ3NkEtQjA5MC03RkM5QUJCNDFFRUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE4NS4yNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzUwNTg5MDAwMCIgaW5zdGFsbF90aW1lX21zPSIxNTYwMCIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      PID:2468
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{87C467AC-7CF9-4D70-9B53-95B9C139B501}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2192
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "2192" "464"
        5⤵
        
        PID:2872
  - - C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "1772" "332"
      4⤵
      PID:1700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2288

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000494" "0000000000000490"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2588

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODdDNDY3QUMtN0NGOS00RDcwLTlCNTMtOTVCOUMxMzlCNTAxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTQyMjRCMUQtOTRBNS00NzhELUJGOUEtQjQwN0QyOTUyNjU5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjIiIGRpc2tfdHlwZT0iMCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOCIgaW5zdGFsbGRhdGV0aW1lPSIxNzIwMTEyMDM0IiBvb2JlX2luc3RhbGxfdGltZT0iMTI4OTIwMjEyOTQ2Njk2NzY4Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTcxNzIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjM1MTIxMzAwMDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Drops file in System32 directory
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:3036
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODdDNDY3QUMtN0NGOS00RDcwLTlCNTMtOTVCOUMxMzlCNTAxfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFQUQ3Nzc1Ny02QzY1LTQ5NjQtOEEzOS1BQzk1QUZFMjAwRkF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuMTUxOC4xNDAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjM4OTc2MDYwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIzODk3NjA2MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjQiIGVycm9yY29kZT0iLTIxNDcyMTk0NDAiIGV4dHJhY29kZTE9IjI2ODQzNTQ2MyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDAyODMzNDAwMCIgaXNfYnVuZGxlZD0iMCIgc3RhdGVfY2FuY2VsbGVkPSI3IiB0aW1lX3NpbmNlX3VwZGF0ZV9hdmFpbGFibGVfbXM9IjEzMDczIiB0aW1lX3NpbmNlX2Rvd25sb2FkX3N0YXJ0X21zPSIxMzA1NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MjE5NDQwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0MDI4NDkwMDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wYzQwODRmMy0xYmVkLTQyNDYtYjhlZC0yMDZjY2JlNjBlM2M_UDE9MTcyMjI3NTE2OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1Jc1dFdjhodUVZNDdzT1BjUzdFNGlzS1glMmJxRmFMclMlMmJpbmVFbiUyZjZ0NENKYU1lUG83N2VkTEZzVE5aY3RrM0h3ZlZRJTJmSW5TNTdpTnBJVkVmOTU0UTlnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iOTQxOTAzOCIgdG90YWw9IjE0MDY5NjAwOCIgZG93bmxvYWRfdGltZV9tcz0iMTI1NzQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Drops file in System32 directory
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
4c97df7d7a1307e2efd68ea7f3cc38a7

SHA1
1cc466df9cf1167623bf0bae971df747e758e7bf

SHA256
976d5dffb2a8ffad46e20606a50b7f7243b7e4f209c2bda93e73acacd7f2a9aa

SHA512
eae5052d10fd306e3660314e132aed59f52b1b1bda0b9af7f3530a30c1dd544f1b58dfb7d546ad8f92765e1f9eb826ebc4696fb3dddcdb904d9e68e789b10a00

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
216KB

MD5
b83de3475be3ab3aacfa50090b818095

SHA1
4c10cc32075213af475e981c856e00a41b7eb824

SHA256
ef1c2d7dbb252b07beeaadd71cb8703105b5778bd69f5103f680bb81fcf8304d

SHA512
f765327820059636932ea57be741432a42f4bd9054906737352aefdeb0ef22e5fc04299b092288474a79c925cf7fad958f2f9c0d7b28f99ba1699cdce18babd9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
261KB

MD5
c1fda26d5eab9b84cccd9e18f7c08639

SHA1
7dd5c136f9c350448741d3d6f821ae8b52207b44

SHA256
b913fb893ba42c781862191ea416d8bf1bba9ada900df07d59e654cd218977e1

SHA512
b23dbb8e5c33d8a36753a10b4f9d2530e5e70c106b4bcc34de40ef86f236a50f79ebdf34462bfb7622fcf461acc9e5417ce00063981879cc47aa80b71cccc207

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
438a9e1a79e3984acc61f1729bd1dd13

SHA1
45bf48846184d3ddc2c796451b64cb816ca12daf

SHA256
4353c26bf5f3ba1e8f25051eed6e9b71816ec076f2989d6f9a1c59a3530ff4f4

SHA512
59148ac47f984d5da24aecaf1c13deb672a19661b5426810c2bc87641fefb685e85bc5f1540a9b84ac5928a9427e9ae7201f04ee79e59a82b172a33acd13d486

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
d7f9590aaa054bf5f05772faf6002d8e

SHA1
a1f2cd710af647b66bacd5c8a5a4b48e56a55729

SHA256
b8a805047f7e3d1695a856fde2ee4c58d6de3facfb72c708e86ca40040513f6c

SHA512
c25e70908260ff7128f499444b05a4be4da026c77d5490f673253a58fe6ff3579d0547c785011659432df8169007d8d6169c48a51e86699cf287dad19d66c920

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
b4c43c95ea80273ab76c87b407ec77dd

SHA1
a64c8dd32880727f7834fa1019ea75357621ac03

SHA256
4eef024dd3555b834b80d9fe1ee28cadf4d1121573e78d44ec4a1bc0c121b261

SHA512
68d225271888c7fbcf586273217d46dbdb081af4e21520d2b1e370ae1e6f71eac0ccbbff8d2979fc58d584eb79fcb055d6e10d2c5fb1e20bc2d7b0e133766808

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
0957b24fb7f5f2b8aeb86024eaaf114f

SHA1
4f7c93fcb455bc5c05b104e92e65fc03bd8e4a7f

SHA256
0a97ce2a85da3debbd2588ac9d73b164fbc771dc9ee2977425a7e08fccac68a8

SHA512
9b204fdebb3352c14830818f2b65cbc1d75054de350f8c2d3085c5110af7b2a434b9a996354a6d06fdb94827acf7ddf681a47781f6603799c4c1a9257fc606ca

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
ee10353b0e3831e07e9f79397003f4cd

SHA1
55f48f4bd348169e5ced75ce4ab8917c21c52095

SHA256
a4bf93b35ca550593e4ff61fb6281216a8f3ad52cf9d106fac8116f870b2fe0a

SHA512
9f8997f654bc717303732ae4e71f6745ee7582cb2b994b4cb20ac16156d6a900440e8d7a9cd4fc877c93abf637fc0bbe84fa87c4371a232893f9decd01a6d3fc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
378d329969802b2a6c10e351b5719ec3

SHA1
cdfe9445dee808454aeb1ef16da570711bf153ab

SHA256
ece64084d274aafee51aa68109a25c713abadc98a1e244ea01bba4963c4dd74a

SHA512
8fec23def18e5b53b23ac61832be40f741074464767d29bac76db334e6c79f5d87ddb8dc52e01f7392c0f4f4c5fe0ddbb6122bc2ac0e1d354e372c1861c81e64

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
88b8ed48da3cbb16419458c262045fe5

SHA1
bb160b545ad19a28e7462a52a8f1522efc34d469

SHA256
809934fd4381ec225b515fbc66d2d88bc1653a82cf440473cdac54b140fbb7b7

SHA512
92dda6d887130f7958c7a5ae641d69fb8509a58705a6a22bf7735eb0f0b448642f04e056faa974d5fa8924989cd9e253b288ea6437c1aac11f4db62ae3bfdf23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
c61e762e0f0d8fdabb6b9c9a7f2243a5

SHA1
419b883574b7fbc4d12a1357df50fab364427680

SHA256
84f1844b27a3e9fc46f7d043482eb29e57d2946b3b06c3b61156ee8df184e0b5

SHA512
dd6bc869900ca031b7d1a7c6d01e6e2e0c1a39d749d5eded16afd4571b49f0c08104b5fbe9b60d2253b9ee152fc9574308fd428e71fc17a1473e12e4890c61af

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
460fb053b205c0bef8cbd498772ec102

SHA1
4a9529ed2a92fa100e0ffd5a7945dcc18b1dcb3d

SHA256
9f7b4460b7c4c332be7e4d7fa105a484b5590ee7ab73e0d78aacb182b46db577

SHA512
cf76eac2a4d125f52847945016e207e2e517ab76b92681512227714ba86aad2f9ba665dff3e259f17b36b5a00967749362a98aacef0e028186644b35fddb5e73

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
c9c347fb075fd11fc58edd9e4d603463

SHA1
f310f60914f29553197232c7d9887b6f3d509548

SHA256
c6e7fd2483362a2af6056b6c71e52ce7cf4f41a5c82959e15d8d0cf790348ae2

SHA512
72c2301281e828fc932715496ec20570e58f193413c5e0346cbf807cfa235fbd436da30d9a8cbf204b2d0a42c03ce89b01c95d6c82d1b3eff8866c16dad4b045

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
de0fc687b076125d2dff212bd95ca287

SHA1
3af06c7d1041a07a551cf03caddffd2b55dd8e98

SHA256
6a4d3963a9a90e4cf0e84b336aab8ad89f63d81401bfba7090272c8a17502642

SHA512
6aed4251244d3a5935c56c6fdf3510d3d95b51195f5c1f7616db7b4de837da75334e4692c6a165d328e67a8be085e82198152d40a1cd10d7acda73e791c30cf7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
bfeb934b1cafff36d7552c74a584232f

SHA1
0cca32a3f80d55e47747802986b752d869b10463

SHA256
3b2905f03bcd49ba91df0748c11a706ef3019b6f93497fc344f5f560338b93f6

SHA512
142d82e547c23262e905465aff804f93d7cfe0f339f2fee7b85b2ab5682f4d947f4f385c12b6c42a03ae6ab39877113a852066dd4ab85d9d55f2814909f6d4c7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
60f909fc6927ff3920f4cfbafd953a7b

SHA1
17155d8f7133436885d1ac01845323c699f9f54c

SHA256
fa33552be30673afee65f3bbfdc808f5aef11430caf3af477656f6ce5a68a431

SHA512
622a84e56e3b1b20e579c9a908ba053371f1dd9bf062df5c636a6f61c301825d41bb0d64ddae79b51f65680b33fbbeec89d71e892b355f89435bad0cc049b53e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
17f643110a4e631d876794729e568216

SHA1
5348717e3008f0f57bf7ee7623ce5cc84fca3972

SHA256
c795648f511e8b311fda82748808bc52270f4a3ec548255ae4027a6472f646b9

SHA512
7ba361e779fa14e6833f013903e4cd34de8d87c4028f9268599e312a898929fe3bb66d37c0f6d238d33497293f49f6580cf8b3d162d5c500f602d1837debdf76

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
a2a25ebc5b16beeea78c2bbde4ac43f7

SHA1
03c68bfd1806f039a49b2eff4eea37e12b947878

SHA256
cdfaad242f66a141aab54034b86d92552368061c30a40e1ac964290812ae4a61

SHA512
5d4e6c958c91df09ea8605cf5956373861d677944019e82389c5467d2626bd62b7c3c223b601f07820abf00d98bc4fb4ac9b67b6ff57b9c8bcfc51d615d7d953

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
7656ec1537e736e77a7bd71d92f9359e

SHA1
25f91dfa2a68499207b1708ca6a49539f65c97de

SHA256
d44d4338086bdc08b3c7000e3190c963d3a7539ad5ad98054a845b0030ad04a5

SHA512
aa2f1e07a1bc3f3b922e7462e0d627bd47f1e240b3c628a7537e32152e62f82c668bc4b8662d9a0745ff3f5ba26e93f74f49ecc6b066d3369301a98e22316067

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
fef913c80dca6cfb74713faa0886fa06

SHA1
6d5b7d858ac628c0cf7ecaaed4e757166b13c9cb

SHA256
f585bddea7338d6386ea298353441717b6f2d850c05bc178e469375fa3016a15

SHA512
3864010faf8a78c6b2d75ea6c82461fb962f5c415b0a1be07e0ea6c1c9614db2543e485da01eefbd03acbf154f06156e77bab52c99e97af18e7d2c57811ba98f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
6546f6a2416057a8cd08062cadbdcdac

SHA1
6e49ea333ef8190a49cf24c2d82609cd0b629278

SHA256
0620fe2d4f4db9f782bc17246b8174f1ff8adc3d22e13eb8ed9eb5aa6caf86fa

SHA512
02a5d7fd96b7d88a5c414120e2697690eeeda9595a635c722515797368f939fb6e030332f73dcc87583cd3caaa6e95907c0bb93e9050cd2bc74ed17f943025c9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
023ff9098ab2479e7fc66f459c408411

SHA1
03ec37fbd4c580c479847e0828a6a50a9fadbb10

SHA256
a6dda7a3463e04f2422b8faa4129940fbf2490750ec24029eb23e35427c268da

SHA512
09c69d3b84e19a82b36a0073bbef31d8439b26df07374af9eb458fecdbd6c12686748cdc2beb8e1b0516bcc900e421c6628bfe52ab1a79ca77169eabc3fdf09c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
fdc516a3fb562b343e7cbb8783c13af4

SHA1
9950be8368d971d772af18d0326bce1fc421f47f

SHA256
d90f3b6e89b7f4a99ae9be7c27d259e590733a0ff3e2d8103a1f88c498253aef

SHA512
a697b231d72d5a0a4d9cf5ce79b746fb34084e5b4995478a9b6acaff9a07113084f993594d1d05b152a8c6e8a16db7ba649132a6cd7a50be4c552e88d349b059

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
fd37eab29884a711784ffe02beeef4aa

SHA1
7cb2be272832c47589613ea5bd00f7e0bf2bf71d

SHA256
ba968e815a8571129fa6d630debd63a0614d6027dd1da799f8d5d50b74168fbb

SHA512
856e46bf23746d4aa24eeccd4355220c70dbcf7dc5444673fc741b8da1983942a497738d0fd3c80488b9be6f53e78c766642bd96b33435b35f244357cee2ba84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
636082f4e1114f5b91d9adddfc8e9674

SHA1
f3470f79e484ae7cf2734f63da99467369a4c87f

SHA256
eb56c5a62f0a70cd09a566196daf619b200c2096a322bb59ef7af8e039452186

SHA512
4160b47bec4b1ec1a75ed7560fd5487e22426cebcd3aa1e3d4a97b0a234d7dc2a3dbb5fd15cdbf608407bdbe3264f2edb45292865d38f24e7dbe78638e5b89d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
845321c486c416b6ae7a626b9ea30ff6

SHA1
f3ab38ff46a0b8b97645962d618692c784c798c4

SHA256
7255d1fad7117f3af444588bf5353e3a8743fcefc6c7a118bdda1b60a770a2db

SHA512
128c7742ee71949d4f46dd358a3897097ac7f03ff1d57ec8cb4649eac4835cb04386408442389f4d3a44daa9d3601d073d5fb8b0a78859a074cc5c58619e13ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
4238ed287f999c39e30bcf3999c5641b

SHA1
546e0e4f4f1ca7edb58311c9e14fc090668238aa

SHA256
c454384e1bc16c63dc0d2744bc1fca758488feaea2c8ceac430567ca47fc90f9

SHA512
c3497569a6b2a8c6586c25ba8c95a60e0f5686ee2fe5e1a1908ef161bdf7cf946c13759c4ef16496f0282ee6d8cc1225b18d3ec60c2214d50b28ee5308bcc3a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
77f858262118f058c7eea5283a92d0cf

SHA1
4fc3d458ef1909a18171e94be0989d9248f643ec

SHA256
db6a7e1d7779485647354a4ceb3cc969b12569c7fe1a681285e1b0e655343217

SHA512
96b31997129bfc27a16f58e971da81c8295b5d61dd3d8b33758127334e038a0b985c875850014931d81170d22c8b8f73d18307ee7cd2009ce558141c1f3c8565

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
7460b95cf48e93379ca9d9136b282488

SHA1
54437c2b4ce4bdf71851719f2e0014e82374b075

SHA256
2b97794e4bf8bcbce2ae01cea686bb55663a744c24f7d003857c08565662cdea

SHA512
477b3b3cba84e76ea22e0fb4aac7cccb6c60bad0ade445f30f8eec2aa6f332506dcfb25a2be3c2a4edf9e593b09f37574a5f173118e1a2bbacaaa63d589fe325

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
a8f5b91b02be5c4a329ea24df1811f26

SHA1
a5ea34d9424399fbc20e74f82e755dbdbe52b319

SHA256
28650df1d3f3629e6db093150fbc6dc310b8c6a36dc774e832fdd59210f1d57f

SHA512
235cf59516db66d18f680fc8b30f41a0a2773aab57373b2516ddb5697b78afca6259b230ab24758ddb3a2f30d7050e2666d066d585fde74ab18e218e67834a68

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
16322e91a99b63b6feb82b43b73efa02

SHA1
313a3998d1c1654ea4a218a8ea86bcccf99706ce

SHA256
6c51c6e4c6409b40cd4ffc202f45d1ba00e7dfd11059945d07deaa8aa0655b47

SHA512
d7a19a89685b629b77060c4a32d3598860c1d176a72d800512d253e5127c5089328280cb7864f8b64617f491e0dc9bd7c886d01704aaa563fbd69b90c3168aa4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
06ea22a039c39c94acc10f6f2237e11c

SHA1
9191c77d5e5836b1c628c0ee7aaf232670585e8a

SHA256
661c310090ef2b1dc54f585183929eda5c3106c645e491a8674c5975a19df410

SHA512
832b42770ed98a7cc5bfd33ccddf1ccaf38942fec9bed49c9de50242e1b4e277bfbfcb98832156b62b3a1d8512aded4fcc4a56aabe14e2962dbacbd275b8f29c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
81d1960e9b440f3f9f52bf41b5117ae3

SHA1
7d09aba15f1a9a49affe0461f24fa6a9e05bd885

SHA256
aacb9d317b7cb99177a0b79f8f0e7b866368c6c61d20bd6b1b0842efdb8e333b

SHA512
d5d211546a1c3698672382d28def2b39336d3f0f6a95af2919e4a6ae4fe6bb83b48e2b928281c9e74d812d4cf653d91326e7cd5dbba741dbaeca33560e2c092a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
e1ad026ea56faeb73d57848de553caa3

SHA1
f6c819a9ff692fb2da6e465702386e61d56be8b7

SHA256
38931ab01563e4c87ace23c05c2d580c49f2d17bb4b20d2e02773817164cc812

SHA512
749a9e28613edc84f9a61c8579de58c87b2fee2ed7695f6206f1e3c6a1a4d44319385d8693d4eff95280774fb7ebc6799d588bbdffaeaeb7adfcf844e039e732

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
0a08bf5c3ed4e2cb75910b99bbd92ee6

SHA1
ca5fecb458562eed2b08741877ece35440904375

SHA256
50fc1c9b17b1b67ecc0da2b3caa9225a45e375b5c23b01d32bc556cd21c33d23

SHA512
213072553e9ab2d439d59763701b1511c8f164566da1d4e573bf4456dc8dece14ba42bc60eba02c3cfda7ebca20a24301fd922b964dbcfe8da8cc59fa429a693

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
70ebbcb44c24a5c524d7c5095ad9fcb4

SHA1
d472751d592abb16bb4792dd8c984be79c51776f

SHA256
011af8d243817adee346e2e04fcf344b3007eb55dadba0bffe5811e9be57c797

SHA512
e08912915ec9542d14883e3baa42335ad6cb1009d2d88969126f4b2ac1a7d055cdf1b4bbc406307fd2db95f70955bd1a9aa2f274f3b404e674b2050b868a7b86

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
ca98c3ddbd3bce71e184f93fb9d178dc

SHA1
3b69d7dc0c93c5c19b6760107603e005a9ce004a

SHA256
b607cc587a72122082f791d1dcd87764e304e9469a62d574f33b993e5ec861ed

SHA512
30988b9472186a288d1192173c63e88f5b08a492b2925444d8dcd8c58a35d5dcb0aaa267eae818c5c2857af6dc9d0fcba545faa0ba03236b17d90f80cbdb263e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
25cb225c8460fc845689665cb24bb941

SHA1
09c90801ae08d5ec4f3ab6974e200a901264bb0f

SHA256
97f81671b773ade113e322a71e11017b8995f52fc8d2caa44a1f5808eccc7e3d

SHA512
6c5adf5d97625d96825eb78868602cbed0b0b908560aa60ad6082970bc75b1f26d17c70d0e26feb8f8e1ac367640b66bc6c5c2a99d4b92563571ce85054c8070

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
b65adf4da9017fa51d617ba97a4aa87d

SHA1
d5271cc6bd6467046e9cae0c8b176d4c558cee7f

SHA256
1f33735e764ee80b64484f05e26bfc641ed3a676f1d2a77a597bcee9ccfc88da

SHA512
63fcd992103307cf7d8cd48858a198030fc4ccb111381abac7e32b5ebfe62216a392cf86643ed223bb80b941d03c631c57b712edb4f3c735b91735d825b03e27

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
049284581467619517c2121295b5773a

SHA1
c1a27fb98776e833d86b6141e1239c297dfb8140

SHA256
6cb91b4bd6403fa791c9206a89618bb2e92b7b16a3916a31476eb802108aea56

SHA512
d78a5272d18f0df162da183a4a658fe90b2ac66ca433b2aa3ed207315866fc50cc4ab7e0048f385a5cc7616749ac4b0d4a73e65182677debfa5f90f5162bcfe2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
e262152f3073a8844a91b96d9e2d3654

SHA1
cbbc63c83d7e64decb0051003df2302bddef8d74

SHA256
0a6456fdd7a478601ddf5023a7cd1ac4cb60625cd923ec2cde0ebe27df5580e0

SHA512
eb97435cfc05dcf6dd4befc4f26a04afeb6c325b31bfbb28458dae93c364e4b9843acc6e3af4288b9b73b29c580c879cbfe2c2072a2b1a195209a3eee0107bff

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
efab4c3443667ad03b0691b64ca59c06

SHA1
cb3a8aeda638487457190aba6ea6b9f192a74b79

SHA256
f891f1582db23b15c41c73d275da18d7cc2e19f5b5c203296a3b600d515a112f

SHA512
c789511347695ba46dbd278318178f8a8bd0ded085be30d5af31159311f59ea4d5f50512bfe101811b9147e75266793c3c368252f03317543340688d2c2ed65b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
73ee1027ca9e65f183b6f57af002a1d5

SHA1
fa61e32fd684c80e6bb6bcc4f6673de859045294

SHA256
11922a03742dc6669397f637db7fe5d114ea02f869c0468325ed1e73d8b00eee

SHA512
9c1d9424bac323fe363d73b916a1a53e876add0e99ff9bc846e200514c1ca4bd50f12977eac9351da7f5131cb29a414ca8864f5dbcefb8d6ab8ede17afad88eb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
a08d23d8b93aa7b42472782ad0270bde

SHA1
c69da87d51a274889b0d0793a11d5efc225aa7fc

SHA256
a2a2c462ac972a1a51812c9afbec222e86c35ae7ff3f84d5ca5bcf1ba5b92afb

SHA512
6312e31d98fef0cbb15decf242c94f1fff437405dd88b3db0a558ca4fd7c05924a9f6984328d4685093cd7e6a5586cad1f6538d4fcc5c49ecc2ceaed1ae8a177

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
8d94e8e623d0c312746c87bc89e31884

SHA1
eb8aa84e019f33c2d9a5c8586cb30ba623080eca

SHA256
29e0e2518cdce459307d5cbc005661cbda90f50d2bd38a8bbc2a765ab66571e0

SHA512
1cf51112f791bfcf8237999e13ab02abbf0c1388f7fa72af9c875ff35ba1c43f06a5a6a700717c91a9429cd733717084b7c9c58ef1006637c8a93bf9ec28846f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
8bf548d0c7b7f2b3d3ae095dfc20f92e

SHA1
97a1bfb2cba2042fa30a8971435c353223c8e5fa

SHA256
9390c7badb2d78ef8332f26a8666c305de8b689d668825b6e46871429f04be92

SHA512
3c47fd94057e92b4676fbef481f7a69845f63a1ee037824d60d21deb8d9ee3c7f17d762ac772954f9c56271cea09a75055a4526d86bf4a2bed7b9501bfd2ca7f

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
15KB

MD5
0d7109b29bc5f995907314de41093126

SHA1
ab6d17883a260d7f90e5241a49319ab6e776225e

SHA256
01ec2428617b00b021b4efa3cf5f6b26edfc18cdb2c1316648b8bad1b2ed572b

SHA512
65421ade867c19f5f74f746385cd55b620b5f301227a9c4a3cd7b69ab41e612e1c4e47a217a69e8320f506eee857691dc8793fa4abc2be5c85844ad454d06a08

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\webOS Dev Manager\webOS Dev Manager.lnk

Filesize
2KB

MD5
890f32dee5ced5924dc832496ccee1fa

SHA1
34ac611735c2cd4e448034e2c07373cce2590cc4

SHA256
ef20d154790e27598bc250e47dd812aa4bd108f9939193130c5da0f6b6afa50c

SHA512
c18e507de2f680d6d48d756e7141ea80465f7462a92e0c7ce1703e7f45c9a9293529dc2b42b64f6068f6d370ecf32b24759791cc3b7290771e390b4c245788a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7561.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB55B.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI2963.tmp

Filesize
1.5MB

MD5
5dea9c2817f371ab099207dfeb44de3f

SHA1
65c0c878e6788cd97421b7b0efed92eeff38fff3

SHA256
d652ace87dc6b2b4bcf85e17e099a6928414134a71e4f5e45e580148c759a685

SHA512
0e954612cbd90a04cc22579b2864e61f7be77f50b054482b53b0de7880d98ef1e80250f446a7be45fb5e9d3f2cbf409bb6b2f164c81dd86fb616142d420aeecf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b50b518f58bc01a64fb5cc6980a92273

SHA1
0f7216752c43d2b42abe2e0ae0035bf00b00ac4b

SHA256
89329fd6fd75567744fecf9bd849ad27ea616c842b34f908c07b9830d0e59535

SHA512
9e7395596c4c82a2c3e05b5dd9618d0254a9489868e54ab229fcff7940ed4c2f1cafb3c97e7518a8e29b2717e231cce08fb21bff67365b98b3c071f0aa4d8fac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19d99c7ce157f38777f1c2c87fda06c2

SHA1
1ac6a8642b99242d1215b3a4997cf4d4afdc6262

SHA256
255a08635361b873e70c9c462f45235ba9e374b5dcaf4d7fde086ff7d32e8823

SHA512
e42297e71aaae174db07f5f64c78d3043e2ff470922d87f98700a552b78bde132cea59b91467a4092bc7b6edbd6ebad1cdd3e777d703ac653948e11cfe6d58d5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa87872becd8303664f6aec632c05010

SHA1
1863562537e20987a8421267dd335dd0dbdd55fb

SHA256
5fdec4bce084016440777847a5baf94adc4b1a9594c5ac202ecf6d4a47a50140

SHA512
4213e8b5f14138fb5189b9bf71f12ece9e0545ae73078156d84f93e6526c68b3b1dc9acdc4e0b93f0fc41e49ab147aadfd2fbc3a0b1317d5757b2b6c46be0d2f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de3867d14beda07e4b4179f0302f497c

SHA1
41b70462d6429372de8d0860cd9751b798a55e26

SHA256
8307f4bd746bca1e0953c6b5b5e55997de775b0deb19f6ddac536210ad3e6544

SHA512
d33b9a0dc8c15d560d692807deb4c50db78418ec936c40b5d268762b39230dc81b1ef223dd8dc85fbf687de06ad18fc81fcf0f8137325b746c0cb114ccd0f9b7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85f41163b75a07ff87c77e22ce326eb

SHA1
fb96d35a28485a0dab12ad2f5389f827add0172e

SHA256
f3bf83fea9bda73a6c701ed1e7e52dc5a527ba9144ff4702beeaf5395c20a218

SHA512
4bd031d452e71d8ad7e9017cf170a61c09de4ac72bd4b489010a85db5b7ae4d95dad2e61c41cfda8d463a485a8d774e9feaeee8d315f067cbe9346f7c0ac58f4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d5197193b7eeb91f9096e7b2a261406

SHA1
b8be0919a07c898ccfb04900ee8d558b2c801afc

SHA256
ede2bda1b4d7ce649efbe1d681e09562d55b0be1d720472336063a10cbb1720e

SHA512
1b88090d84cd80a2a826b06bf1359469f31024f44abc9a8ec950fee7abef2f1500ecbf245cc678e69e1588308a981c4267233e5028a0de1c3d42ec5ce92ac602

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0121b0d1e23ade109be04f1b15c073c7

SHA1
a0c2fdcfd9b5a7ecb535224d3453374f444eed48

SHA256
7c410cd34188dfc755ef21322ef5471ac4fdae4280e2768478385ed2c9929f0b

SHA512
70631356c10e51630a2c21a4632322989c2746337e54c89d41048cd3754203b1d7b6f6bf8c938661979b098275541a239369a384a8ff8b1e4a29f94f8defc4e4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8252d1277626fd31dd07a15cc3202075

SHA1
4660f4cebff4dc2ab44e4c07d81f051d226846f8

SHA256
db33838f12bbb60658449b6a59a69b21005a6fe07e354de6d83e8d2fbd422e9c

SHA512
85895e512b6190bccc942f700ed56da01d0792a653758993c50355ca1d8531b2e6b0d835bdfdfd85396c2c7f05f9b998d9d5b4d8ada355a548af18d4f7eac989

Download Submit
\Program Files (x86)\Microsoft\Temp\EU29FD.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
733adfa5081059a471115660d7c11ebb

SHA1
3b98b65e4942bbcea39389ed9ab1cf63e57630fa

SHA256
f3c7bab6a7652e58719ce96edfeff483316668bd48d912694f1175fb397b86fd

SHA512
9776110b101536ab7406a068d6659ddf437a55d9915dbe0bff9d4677635461a8321d35ff30b1617eccea799448e61b9bdf98bae130c9c7e55d41fb3271f3f9f5

Download Submit
\Program Files\webOS Dev Manager\webOS Dev Manager.exe

Filesize
27.7MB

MD5
2c4d64be60aaf63c93a8fa611340bb94

SHA1
cc9a7071c49a03b318e06184d5a466ca635bd45c

SHA256
f767ecd6c366a0461e73b549bb3c43e9c841c3fc667f5eb099e918c4ea0d23e1

SHA512
083ba780913da012c8a82538bda6fbe7c959f3b423d13f06465d5508453d00a596878ccdcb6826f6c1677cc1ffd07fba063895427ef25f6d730df725e05bc84c

Download Submit