9ccb0bc19f24b694a4129cc387279457e57671f8109937550258ffc40173423b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftEdgeWebview2Setup.exe
Size

1.6MB
MD5

8b9812ba27e12c79319d859e97955ca4
SHA1

3cb35ac811c27e7b21b381dccab55517609190c3
SHA256

a63d59b2af0c7b2be6984280386042a230dab928e3b426d51a0afb2eff5f98e9
SHA512

8312081fcca20f1d8d393ea2588c2fd19830eb9b36700ec8bc541cd25c4c2046008f3eec07883056956adae5c56083d43ded74d3122d21555d1e43a9d1ab5618
SSDEEP

24576:o9ye32wIdWoAH+miAQoCZoWf4fh29ht/5iqSxulBbxAl/f1scgIDnzMwdF9fZ4T+:Qye32wIuAAQZKwEqbBe1scgID7fZcZJ

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_km.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_am.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_th.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_or.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_az.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\psuser_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe

Executes dropped EXE 10 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
4736	MicrosoftEdgeUpdate.exe
4960	MicrosoftEdgeUpdate.exe
3000	MicrosoftEdgeUpdate.exe
552	MicrosoftEdgeUpdateComRegisterShell64.exe
2016	MicrosoftEdgeUpdateComRegisterShell64.exe
3564	MicrosoftEdgeUpdateComRegisterShell64.exe
4928	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe
60	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe

Loads dropped DLL 15 IoCs

Processes:

pid	process
4736	MicrosoftEdgeUpdate.exe
4960	MicrosoftEdgeUpdate.exe
3000	MicrosoftEdgeUpdate.exe
552	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
2016	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
3564	MicrosoftEdgeUpdateComRegisterShell64.exe
3000	MicrosoftEdgeUpdate.exe
4928	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe
60	MicrosoftEdgeUpdate.exe
60	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid process

4928 MicrosoftEdgeUpdate.exe
1340 MicrosoftEdgeUpdate.exe

pid	process
4928	MicrosoftEdgeUpdate.exe
1340	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA4344C9-31F7-44C1-9802-7F90B352D5C5}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69E11C9D-4974-41A2-B067-9F26953CF52A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.185.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69E11C9D-4974-41A2-B067-9F26953CF52A}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{BA4344C9-31F7-44C1-9802-7F90B352D5C5}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MicrosoftEdgeUpdate.exe

pid process

4736 MicrosoftEdgeUpdate.exe
4736 MicrosoftEdgeUpdate.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description pid process

Token: SeDebugPrivilege 4736 MicrosoftEdgeUpdate.exe

description	pid	process
Token: SeDebugPrivilege	4736	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	pid	process	target process
PID 2964 wrote to memory of 4736	2964	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 2964 wrote to memory of 4736	2964	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 2964 wrote to memory of 4736	2964	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 4960	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 4960	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 4960	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 3000	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 3000	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 3000	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 3000 wrote to memory of 552	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3000 wrote to memory of 552	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3000 wrote to memory of 2016	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3000 wrote to memory of 2016	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3000 wrote to memory of 3564	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 3000 wrote to memory of 3564	3000	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 4736 wrote to memory of 4928	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 4928	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 4928	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 5008	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 5008	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4736 wrote to memory of 5008	4736	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 60 wrote to memory of 1340	60	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 60 wrote to memory of 1340	60	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 60 wrote to memory of 1340	60	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4960
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:552
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2016
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3564
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUZGNDc3REEtOEI5Qy00NDlELUIxMzQtN0Y5MTEzNEJBNUNGfSIgdXNlcmlkPSJ7MjFDMENBQUQtQUFGQi00N0M2LTlBNjAtRURFMTIxNEU5QzVCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezM2RDUwRTJCLTM0NzItNDRGOC05MEY4LTBBRTc0QUQ2OTU0Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjE1IiBuZXh0dmVyc2lvbj0iMS4zLjE4NS4yOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDc1NTkzNjg3MCIgaW5zdGFsbF90aW1lX21zPSI2NDEiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{EFF477DA-8B9C-449D-B134-7F91134BA5CF}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5008

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUZGNDc3REEtOEI5Qy00NDlELUIxMzQtN0Y5MTEzNEJBNUNGfSIgdXNlcmlkPSJ7MjFDMENBQUQtQUFGQi00N0M2LTlBNjAtRURFMTIxNEU5QzVCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MUI0MEU4OEYtOTFFQi00REU4LUE3NDEtRkIyMjZGQTRGRkNEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjI2MDI2NjIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM2NzA3NTM1NTAwMDAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI0IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzYyNjU1Njk0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
e0a4142f6fd7098661dd27f41f6b51d3

SHA1
b92bed61c6b66f958878f498d4e7bb3d23e8975d

SHA256
52496289bd868f12474d9dca3f063853923f541803388b427487ef63f52c6e8a

SHA512
42d071c4990cd2d5aefe53ba91cf0880810a003236675d7f251588a507d2654db332b940962479f97811b7b83f5f686f5ff662df4ffa124552fdb0a1be8d1cb5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
24e62a7c8d7f60336e60c003af843a87

SHA1
9576d1924d37113c301cadfd36481586cdef870c

SHA256
43f7de9fae6b79a844d7da6056ac82beadf028a347e227c2bc33d503f7eb402c

SHA512
34f33015d3e7cabdea2ef39f7f149aaf39caa534b188a34021e577d68bbc48d1d99b7b13a1303d4ebaf5c29fda0bb573f3a6cb171aa2db67cc4b25292eac4a36

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
8200a55843c5c0da5ca8e01f77038bcc

SHA1
cdf2588a010fd6ac5536f9083076c480e05eb43d

SHA256
098eb4c373a48ee49681d83f9f03e3701f6dfd5361b6a071242ca23b3162ee96

SHA512
10780aa7a9d2021f7dfa2273a641f64ca37a941ec5ef08486becf2422e76382f424f9aca03925adb964e2423322b62ba4ff87b4ae8731e7d5743ac82e33b75f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
261KB

MD5
8f559de7fab651b2a31caed79ac2600d

SHA1
46c7ce06e6592c391dfb54634b5caf136f5f6d7f

SHA256
a1b818b507c87bab9e3b4643ff68e6e35f05872ebcd1e8075a68a4cc87650df6

SHA512
e975ab0175a363c56da03e43730abfd0dc90e14a486a0f04ecb40c4f2279eafd29254ff69748930d102fb8480bdcbc86611105fccb18028f60e7b3f451c6a69d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
c1c4e3a4d49561dd0f6bc85f8062530d

SHA1
5394c3a4a2601a6bf7b06b5ae9119a3f0c95c974

SHA256
e9f1d362867beb3a767233de9d5af3a6e2762bb0627f291c6cb8f9faffb922ea

SHA512
0e7f6d2a29c48d99fb417c630287d8d9e9f0365f1c1f2e415f0fc64e12e577c9d4e93bf6573a589e88c75a9dc6c5758fcfd970588c3d187621f8aff8e5ffc5b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
bd6f3d4a46abc156e47fe0d6c312a203

SHA1
dedb517b1d75993df4d7140cea0a84afebbfb22b

SHA256
5294a6e08b6f9818e89931eda4a0bd4ac3949c3f17ff036c1c5e2a6de8df458e

SHA512
bee57ee4c14d4c93a125f5219894d10f68982e3f03fac8acc90f2f9e159553ed82aee373107d0ab3b6d5aac2ea8cd58ecb0138de8f6ab28d5d963c28d0d84039

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
914899c76f15e4eb33455f50f60e9e25

SHA1
a66113325b547638824d5fa020e4b1eb0c3a4a96

SHA256
5c0b6bcb983b3ec422c1459802c993219b66318e8b69ffb09f07ccb28f607ffd

SHA512
ee2699489c6496d9db21484771a957acff27e39f2535d74f91dd352432b33ff15581ce4d9023a7ae273b7f2d8729103c5c06859e6cbcdef2c6ebda32ebfca3e8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
b06ae2aaa639338686ec4f4445173ae8

SHA1
842f67cab1334871e81e6428d23827505055a9bf

SHA256
7e0fbc3af82b58dfc244d17d18335fac1c7e72d87d9593a359a2390a241450a7

SHA512
4b8bb12b11074ce21314072577a7172dec62926a7a628d6526db46062354ad23c2e76b2dcc93e489c9ad17bf2a1b3782d155193f1ea24eb50c8fa551d40486bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
7310b6ae3b95e9a1ca5b60b3fbd619f9

SHA1
03fd7d4d53fd38cc8b48d837d5a43788a6bd8ea1

SHA256
65dcfc983496529b89c575451c6a897b4491f886783228526e06417499b124f9

SHA512
d012d3a27bd7ac166c3ec3614423b89216ff7dcb165d99462f01ac204117fb5afc525d448f8c250638f0ee11929e2c5be61447f83089a4cee9cdd26459656687

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
af0364c9356845870577374bc5609ea1

SHA1
be464b53d5dc8a31a32bffec2413081a330f0170

SHA256
813220adb207a07ec609a757a10217bccf22bd3742e3ca658324add81849121c

SHA512
68fecac6bf4e00fcd5c6c201c1756da13a3d87e4cbfa64fd2d1ab986bf3124303724f5ab9576bf33542d8a0f64d70069becd61182e4c6ab46801fe49a2e5be93

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
e3d3b90ed17afc3312b22051de516aba

SHA1
6dfd177bda02980ddcb21459969c8d21b4a42df0

SHA256
ee36812f90b3a1b5f72c512d44d312dc0d72404d98222bca8ea27ccc8ef106ae

SHA512
dbbe7499f0218e2628c357b5195e1f19349e79c53309daa972e294b19582c86d91a23b642c3bace74b0b7d7c94920931db7548178e0b7324feb29b0bae156a70

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
690f6eaa05e17f94ef59f988f052a4b6

SHA1
a3703cd237aa460e2729657a339febcbf8b8a863

SHA256
5a6dd9d9fdf372b723e8043881d4c39fcaa4f70c838fefbfb192f9c11b18fdf4

SHA512
47aa48f8de124d928c0b5d7f635909b3bbb6e640da67a0f014e00c238e06b060540b98a99fa51c9ce1c37baf9ee149502e05a753a25608b00ec7da39526f88d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
93a91259d51cf1260bcea708c44319d8

SHA1
2d76d5f7afa1be815838e1aab109973006e3d0fb

SHA256
a1ab052c365976ae66b6b851a2282636c2c1f1b838a929e761f374472f0bcc55

SHA512
8c3d7bf11796adb998362343399a85ab5127f36f7ce64d575cf9918724e09a21ca8cae0cc0123290db5bcf6254a7b10d979ad0c2a7251c43529edebce85279e7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
c7fb8690962bd9a9051cfb04b87d3ec3

SHA1
d843498bbc3ae01fc0f0fce13160db723696767b

SHA256
12330d302841d37fd8bb5b74df7d454062524fac88e954041ce485ac818122c0

SHA512
ed074b0890e5cfc2beadab8dab624687f2838ecebafc3da760e248c315201d2230ac6197e016ce480e1798d34e6bd2329e5bda2ef2d329207f1ed7f9d00491aa

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
97dc17c19ea5196783b2a20ce423697a

SHA1
693744a6f679cb111fca1134dd5efddf90b4b13a

SHA256
05b78e67f9400c654ad368d3e63b988602cb2cb89ad486ea340bfe05acefa040

SHA512
cbd980f7a99244bc47bf631bf6e661adece2c5d3f998172cbcdef59aab9cedf8226f15222cc9d96c56153c08d2424de70967dd96b76ab629492e25ca8660c974

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
6212f397ffe20c6cef27ce0ff4fef439

SHA1
7910895fb0b9ff6f954ece32aa069507e6914a45

SHA256
e94189425823ef69f9bf1f3cc133c23e67ad46419cc455a21d4090bf73a11ea6

SHA512
5f04d8c9bd0269ba87bbf4b6a8af07ba426784c08b0a88af4fda3555e1c4e192b56db3c6f0214433fed23675ffde8b0590e5b39bd6b1011c2aad71599ec47ed5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
85f99091263667f3b5e10ef585c6e31f

SHA1
de83594f08a9cf2df74b4100827d2a68d0304961

SHA256
c73bdd7c4c4d89f9e0c6827f4f2feb78efd4cb047253aab3cf48412b9a78fb7a

SHA512
272d8d8e45c5c9d96af41431747b09814b11ae7b08955e598b07f639277cfee8cac11455db43530d78a85ecb095ad83a8735d3e80f0e745629b0091fb0b8a2ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
6ce4b22b621bf021bf79117a13118280

SHA1
1b35ca44973ac7bbdadc4d6f3d160ab15ceb47f7

SHA256
7aa813b3bb3fbbec5d56da83d5b1db923be9c365511b1b02588336213fede938

SHA512
f8deca730042198c2b4fe506b6ef1af62b0e1dd1983b9e92e8d4247027f30d07cec7ff097a8304226ff96cdd528208961754d33403f20463d0b6802ade2cfde0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
bf382a14c9546ca8a6311f6b5df66d75

SHA1
10b61ba1e20da2b1b01e760caaa179256aa844e8

SHA256
5e516cb414cd8adf278cdceb2ae537cfd7c49c277cb5d7718bcf97897350ce70

SHA512
0172c495cc6213b073056dab89979a05ae9eabb7a04d2cc7c16206628f7eb98396909a1914055575b0edde75e53479739c54eae1b9282eb96172930ee10935d0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
642225f16e2c841a23eb51dfc6e0e1f6

SHA1
bcb8ed686351cc56f8c5c326b1032eea7e07c4bc

SHA256
95643c34f8ba13738ad3d19a4eb6cd52eaf39f55cd46b21e148627866b4ea30f

SHA512
d9fe06e5a81dbdb457f93435966e4321c1b0020e68ca0c466d870e599206a9f1b245653259a051e885cd8b88117881456d248308d278af86e6b3f75f41918b1d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
2c1b44a6c27b8510335dfe8c22d01840

SHA1
e2c291fbf5a709a7a1e3c5ad507fcecf25e11554

SHA256
b15d11ec96c712d102125d2e1de19507889562f857910e6f76a400d412c4afe4

SHA512
adc4171a9335721c13d9d4c71ec0eaa3e873ec1729443b258eebe9ad723380bbf3eb912415f650ac3c8a13d31b658acbcc8cfbbb6fc6453eeb82b619a35e805d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
985d279b815e130a790eaecd697bb5ad

SHA1
bed21cdb6b3983a86fc7fd3d4e0bdf2a7690807a

SHA256
22a5f81e478dcc8d54e0a0ca10a66ff98117698883d9fbdee36a110d6554f14f

SHA512
018c9dd127a8b8900236c4c10c7770384db82946f6f1646878683960dee06b150558e52bf55a8003e7467eb9b1359d24f081539c644b7c11efa5e661e645ba4e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
f5f1ed2d55637a183674959e82cab3c2

SHA1
9472086a62950c6b40e1ecefc1fda4573e36ef3c

SHA256
cfbe36dac5d40f221f377aeaf2e983dc76ab3667f4672676a8fb37c7bd4f9fbd

SHA512
9c4635f791608f815e359ce49f7535bcaca404dd4932efb23f638bc9900cd77854b1d38b5ca60e5dbf3e252cf06bb179b4d9a77368b524233117f48bef345013

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
67ca727bdf1e5fd6686fe3e6c1b1d43d

SHA1
d3ee7ce26c3b1eb4e0fcd5af6f83bbf3c949e8df

SHA256
c54a461e2eeb79d7462a4f3810f720835a2827ca752282c01520b8fede5c65da

SHA512
68e93cae35433f27593f92d1741ba98a430c6a408394de4f10ce0219fe8213e7878df71747c597c7384660ed696e35dedc08a1d15d5175f9b781fa70d92a3dfe

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
4dce98d8ab8857371dc4f787c77b91b7

SHA1
9d8569edcb1af0e122e5293495f94b388a3c6f3d

SHA256
7b79d2f66bdfea60aed02eb60f3d28d396c23c147e1d42f3f10a82b5d3afeb47

SHA512
6f4ec5f3fc6f5dcc77d2e811b9fbc4dd00dd15385739888e81835624bbc5e5d32c11eb23bc5dc4e6e9c2b66c77c923efd7edb81f9d8b88b446ba244455881fb2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
28777e8a0de15e07d365f375b71796c3

SHA1
4f3231a68e7d4817c5f6ab20bcfbc208ba63b6ea

SHA256
571aa6917ccbfe221dbeeb485b9f9b358dc2b3ec72271854f880fbadeebc9665

SHA512
87a14421ba72f5255d568c1be6f8e108db587525909ae33cd84526714ff89a3ea2bf9c9a78c11718fc3f22c0139ec2bb4d9cde2327cfd4a8dbdd51e992d7381a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
7ee4925d3b4e4116b0b4d61a03ffdc96

SHA1
7f6e1116374314527100ee854ef5befcb962ce77

SHA256
99fd8800699829fd0ad767eff54dafeb913a6261ccb5c31825fdef6835653ae9

SHA512
c6ef896870d427fc2ee783bc38b187fc5485dfa9c29f14f4b044b060f2385b445dd051c83a9412d3fde79f929755239061ddcefb012f8fc38ce257c87dd9a8b5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
f1e551e10354047b68ec1aa1b36327c4

SHA1
417b267661838c0626a74e1232154d8245c4bb0c

SHA256
171ef4f700c8bdfe146e9ac7306c72b7a41153796d23e526aa6852a150207463

SHA512
674ba129c8e1b2d9dc57e77595a994afd8e19f81cff86dbd749c855aff1ffec9c7e9920e1d45b193d83ec6f20ee4fe5966415006a0dff357b471d97b271fa067

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
73b893cd1d2d759f98944e8809db3ce4

SHA1
70fae4564f9eeb3c503a13eebbcbe725e9c2caae

SHA256
bc9ed2615e5e6c185c20bbbef898e5ba1543b6dedb15330080dc41e74a0a5df1

SHA512
255ef2552a35cba6fd41b53cebee1b9749485017a053668c1271aaf0056bd08107dba6c842a926c83d78472c92aa92f54fbd84678557dc911d20fc190ee242ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
06fc13625ead1257583224eae1afe1c3

SHA1
02f3de2d81c4c2868a73211d8096ae79c506d846

SHA256
ef3f30691b45838caff42db92a4d6cb8857c8c36ba4b3ed9bd600bae8dc0fcf6

SHA512
b2fb89890c6ebf54a325bb1023194f461b532f94113b3ddbe337aa556b0db38159643c57e41b121b3bb21c4e547bd3e89137462a3fa29608e0dbcba00aa9cae5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
30c5a417363b47f3a58d08e44198dd17

SHA1
1e979631e34cefee21b8a0e0aa22f4dd6e30dedd

SHA256
1e76475df6a8a5889f0757584787112745a3775c8dcb04257a4ec0a2cfa58b9a

SHA512
691e25436186bbda91b471b5451d06950943e6efe653362be50a3f0d21f341f4b8f751c617f39ab04571d92ef93c04b9db04192220173b66d879cbd5128f7287

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
46b4263a73c35d717d65eae93c781f81

SHA1
3f8678c63d174aa8289d20b7f821a326c33ec07d

SHA256
88661266d279b161264678af48fbfbdcaf28b1f8821336b3fb16e2126c5e5e11

SHA512
3453b80619277b9efe19f2302a2a2c94372ed2ccec2a01d07741fe037f64e93b281757669750db8e6cc2efdef96b0eb1e373211da51ab887d8f0eb748931cce6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
5381426201e98d1e6efd86d24e341f62

SHA1
2b2df88be65d0512e140931c2878563345c77dc0

SHA256
e3f7c7d612945fc79d2e47872898ae3831d4bcc73bed8d24513780612fbc0523

SHA512
9e6aed7dcc33f7c9e9a888da580c2d1e4732e3a61a04bc7e682c11aea53391c82d849e341a98edff7d4792b2d2f5f0e61730d12e19fc5b2a77a5a1087c2b9fab

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
6feb8258912fca8354160c02d70de767

SHA1
d04f918370da6a637f5a032c8bb616ab8d0d9b64

SHA256
6b13e8b6149be225e7f35fbccfd84cedeed9219f06b70630db6bf4be598fa25d

SHA512
f69ae204b6569b1cea77fbcaab30d556d325fd18989a347837cd08eb669dbc6bb7794820cb3028f864be7109af84c8532525242063fc2d1901f588fb458dc02a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
75c582abc6e13902afae51da71cdb3ec

SHA1
0f1813d9992209d9fe60bcafae8f8652658832eb

SHA256
587b4af55922cbf961852d0a9234c77eebf0ded6e561b18b09bdb2b2d8b2190e

SHA512
7afa52772caf93df7cba83fcffb8b427860dcd92fee4ac732f42b5db11c3c5ef086b212bda555cb095e23d89669e0e8a31c55ca59d9b00e564c5b7ddc43de4ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
80f4ee6f0158c5a2f50e90ab12051ef3

SHA1
4a0daef60adc57559bcc22a5b071a0609de82b75

SHA256
066e0e6f67fb92785002e0cfdc09777b330c55cf8d34f9597ad45aa5c2171849

SHA512
b6cf12625f54bf1855797100a4fa3a5fff0e4c6fa8448ea78afdadccc2639237b34a4b058592a783d5918bdcdafe562d8e8bb59fdec5bb90f3f356fb94e70432

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
2cdd815eca87eea8363d7789cbdd8595

SHA1
3dec86ff3c88b96da8ebdf340d149b775f84880c

SHA256
0150d75f78763060d4b5b00e1cdc87cdd6398fb42666da9a733c8b708f3f53f5

SHA512
3d66a2b955cc31885df66b9ace4f472136ffd94a00ad769414831f4df66e5f1b44b1d8787e781fdd2ef4300ab0e03b4ecd638f46e39958df7a12281ad6812fcc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
a2027e9099d943f12ca8a5b6f3f216d5

SHA1
b9060511354ac7204df9aa441fb084886f135034

SHA256
c74ed61b07e5120798795de86695b8b80255f3111b77836f89820df27dc09b87

SHA512
2ea7d141b568ac5df1ba6ccf2af3c4c4acef080763e68e3f3e2b3b3ffda9deda93fa1b9a4e19541afa1f4cf2039b576df23ff98c68d96213944d4f942266ca44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
23a61f4e352d09431c3e6ec05522fd84

SHA1
c663b459ce508255cc7b09615520142694526191

SHA256
65c0d3996fef2d9caf87e609fb16173c1b35a691a71d926ed3858955566be3fe

SHA512
4ec261b2b4b32219eb168da8c247152a1ea4139e577974c0ab571ce84301fde030cc5c3fd554ab4f8dbfba9059be51b6ffca4eef996d5782968cbdf94a474133

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
874409f9bd74f4238e02a15ef3a21d94

SHA1
5e0336c6717345d102c4b58032e43e2a316e92ca

SHA256
77fc8dd2400150d098583ce867fb98c5beec0f0ea72542418a8a99451af12fe7

SHA512
4bfda3c743f435ad88db71feaef1a8ed9706adb255d68dedf7704af618476191524e0d9fe19b2213542ac9413f05d4673eca1cc94b00f5d4191868b59e063d5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
07aa8bf27778ef275b4f7a5242eede66

SHA1
386a57f02a521d373466eef276d59c69409d6854

SHA256
60e6e4cdcb2147a4a516198746adba553bf9da839a2979222efb9c4220399ec6

SHA512
2e529fcbed1418bd2ac674e21d49636af0e7aaaee4f2a63bc17a13a19e43ed9c7c55335089f3d73b232ea911ba384639696a33b603e2b5bc0857875ae78c8217

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
22edd8cd3e92e093ab858277552a42fa

SHA1
cd5798edcb6ff59a1592bb7a0e044599b7bd8d9a

SHA256
620d1ddd4ea912b58589ca415dfd80c78f49c3bcfd6012512e309c4556ba932d

SHA512
54838f0c7443930cb3ec1335a7000344453b62d4103bb0ce805a5c5187d63bf9016c9b92ef8a2437e1a9abc5c4b1a632d4c95bf57c217adbeb33dcdf50b68dbf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
46cf423c6ef9301ae776b8f31a0163ba

SHA1
e45a34cd8e0e96111c4ec547fa22d176b185aa01

SHA256
b4e700f59f1362b0ff2a6987a5a4604225f6aa02c897bfaeafd0cd220dd02837

SHA512
c5e567d6d3aa19cc51ec258e596df2c9c742fa135ffa84b1a33b1a4a8b2c74f6e2e2ce0ee1dadeeac55456d2c2d949a440b4ecb9d0d8c69b57c292844266493e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
196a62a2a30088c4f8f0b637e972dfd4

SHA1
cd650889e43abce3a968778e7f47b9f7cd791f64

SHA256
fcff08b2b6eec5c1d4a833e3b837923c5fd3f3789a42f9d3683c62e7d8320940

SHA512
92861604f2f2077eb70df34fb1b6f91da02a144ded1afe84c7b3878bf068f740ebdef5402ad6832b4c87716d271548c5cc04acf472d3d1564a781a3c5dda5033

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
5cfb34e296eccfcd63a6b86fcf04369a

SHA1
35fc9121ed4901d2213b612194dc6865bb3f4bac

SHA256
6ba87a9a475468dad616e007f7953a5f193039714357361b4b5e64c7f4123d3d

SHA512
6ccdf706485a0e719ccc806deb4689c7682f269b93869aac746aaa6831c5ebbbdc8b3acc6bc5aed61aeecfe48a37f63357722e55e2c806bd91691098af486247

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
7baf1dd8638a4e15c791ea503de05aee

SHA1
389fe381c5a903bb3fc1614fe5960c1b16d491ed

SHA256
7bf3cb81f44fe8ab41b4f9b221a3c1f82de5388db0aa9b94fb60862748d2862e

SHA512
b24bec0201a6246e2ccb1587466c7dfa186b3dcec59eeef1fc8db098e702a8eda49211bbd87e6fb9c553b3e70c38c1669b32072d572d2e8139d015f0710a53fb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
8cf564d06f56f0ae3624731d54728df8

SHA1
deeef8265d72e6b7b94bf14ae55cc2b86f39965b

SHA256
e9da52655eb8c5ad50560fd31b82566fd1342a56c2a0fd0cc3790ede20a274cd

SHA512
8a9f057b6d861956e415c2c3709b750b9a4b3ecd50eacd7b1522599c0a053b218715e0ea3a0b8862b4ec66446b60aebc0a58ee024b52d26d4aed1a629b1dfb7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
c462816fc1331ff6113f4a3150c6e1a6

SHA1
1f7b88b8be5c3a44fbcb91182e6a7f22e6c96936

SHA256
1303b13454b14dd66e8b1cf457cd4433cfd80c073db16a792dc4208288f39f6c

SHA512
9ce9e599b652668b8d7c54b88662fc150227e91e8e78afe3daba725216a5853bba68e7502a99a118df03a524b065489297cc2b427a51608a6c71bdef815c490f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
2da92995e9d08cf7c00f7cbbc9a311ed

SHA1
dca7524f8678a87931a86b9c5c16a40dea7e343e

SHA256
6f8b8f4d016e36aeec4f1ee98b92abe3c3765e56fc636de5942c452a7eb58b50

SHA512
0e1f7de9e265dfeab5af90042a30855e3df704790c98dd52d1732b0cbaa178d660990ec91f6e4d6f18f5e978533eb332fc7c03821c3f2d95ffd6f6cd76c66f4d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
54911ee16c6eb782e8b99059b0375ef8

SHA1
6a29f919b989bde902062a67d161c95a8ea1f28b

SHA256
eda04490b96f2d84d5797abbb1d701c3a285c8e7c8080d52490403f00fe269a5

SHA512
0374744f14a9a7d002b6ecdef8b7b5337643bf1ead8d26fd601374e37f5e9c95b6670050403f4d33f319ba72b93bd5c32f578d305eb2265368f988bbea02a0a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
d56474ba5aeb783e7de9ab3b0f7e9f7f

SHA1
456d4ab0eeae04f10688fa713d0e3ba5cbd3dd8d

SHA256
f8f94e6911d5d53475b5fab4286e2574a230b47a344598fe346130d3a3659746

SHA512
efcbba3a011da9b97edfcc4e3ba7be78eb25e378b2ec7e0984b6781f72831c4a102c3e04e703e37e3f051ec9b2c1a00199dbe34818163f4731558f66e6787926

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
3c5b463a336bd40a68851b5f8e257be4

SHA1
43c8ac429deb842963ac6ff9bfcad45d1afd4c99

SHA256
b31cf5496370b607a747a04c984410dcc4c721cd6ff8182c1fd1ae37d802f963

SHA512
d56d964ee1d43beeb7d764c148e3d90e9a8af94ab987ce307145b2d07d70c14deaf9bcdc64688438dfae1ee0d9f323d1893b7c57bcfa3bd3d5203ae36df961af

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
aee2ea9d2d8fb9df06f9f46c95688bbf

SHA1
5319a6a0b85b0d46a77be1362c4e778c5d2b63ff

SHA256
17652385d4d73afadcc9c6ca0925b44dd4d20eabd67848a66a49d4302894952a

SHA512
4a5e75a0a4ffa97c6d31225e953e6deac30d71e7b292b4e9b04b143a212b10f62b5df59c552009a45633ac9f56f4d60a85bafeb5706be370ae1be86adfcd4420

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_lv.dll

Filesize
28KB

MD5
61c33fe81c8cec70b9a1fe50188000cb

SHA1
ec9de07380cf21d47129f276bb91e06b3f59d239

SHA256
27dae16f95de324f1b9a9654d677ade6c1eac763683467b0c68470bf27decfc9

SHA512
bcefe56a2ffdfd5349e37e823227c0aa08f4cb17b36db84573a70d76a6163f03b25b64771cddccd1d378ee646b3c856a2adbace830173249195380ebf53d9dab

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
2c2ad5b58670ef3a612b90136d17b9c2

SHA1
9e58c45beaf3dd7e436985d42316887fa42e986d

SHA256
256ba7572be760392e61e82951bb6036bbed6c41d1fc2badd7122fb6672ca3a7

SHA512
2ad938b0c0345f7e65894dba9a5e5ec4db22245d9b80c480e87e59d03788d3c50d278e38286332284610a34cdbd7cfa1174e6cc83c35367a9b9b893f77bc920b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
d947ec9dee4f059a6c04d81cbfaa3ac9

SHA1
eeedcd3ca30ace958f48756d2078426e466cc843

SHA256
9181547d9e5409c404d8d844c55ace02b37718a03d7219c3021c2ee104aa9d6f

SHA512
99ae4afbada3b896184ee631ff34eef18bef9604e68b5d8f0150ee68941380c32497e2cd12572e67fe579070dd9581a8700d4c795629501c6f9ebae68391fdf3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ml.dll

Filesize
31KB

MD5
41c09622a9813a0a2506227fa5f8763b

SHA1
d9c4519be8f0707855372672b8c0b5bfd0361c76

SHA256
ceedd7d095e6275022ae4e3901de54907c6c19a0a4499cf685a5fc6265dcb8d9

SHA512
ef7da813252947e68d99cbd1b35c2421e3e67c585264972063eb13ea44dc9e2991a8af576f9da9eeebb57f2d02e31a39a71de555a1478d908b303dccc00619c4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_mr.dll

Filesize
28KB

MD5
29d733c6d02b7bb7b2609124072a263f

SHA1
0f49939825deb19b59d141cd38f074568dec7e6a

SHA256
36d39c98cb62c7363625c93db292c952b325c227241729e7a865a7ce92ced2ed

SHA512
9739bad4f8d74d1cc40d29bcd12e28373ce4c6a1b0d608cd557ed965a5a0d846710566d9b0fab49e23874efca901f005c72fd3f63edbe474a8ba9776a19689f6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_ms.dll

Filesize
28KB

MD5
2070ad0885cd904b9a592349b20276ea

SHA1
16299b0a2ae7f0aac45bcd5d304f71f0ee0575ef

SHA256
4c499e1b22ea0c89d8c1fe078d360a81428b7a8699c1bef79eddc4d5a3031962

SHA512
589dca2e93f7f13684bdc116bf81ffa1437d86ea5c68361cc6c6662c6181037b6c158a5fea61d91b64138f302adb94de4f6fc9552c0cf997f7d4612591070112

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU8916.tmp\msedgeupdateres_mt.dll

Filesize
29KB

MD5
ec654bc6db5a4ded8caf56b6b20e42f1

SHA1
e33859cf6ba326662c07fb0ca46f1240e1ecc740

SHA256
3e4e5e6e49c590d33de6729f76c068748d9e28016893b1f9bd1c87819e2aed61

SHA512
2f98100a91c2124859a8d5bdab3d0004ff16d8e94d271427d104954bc0888f4c8c33644d8015158800bfbbb75dbcae5c230870cf6cc12d479c0d88eb49a0c9f9

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
181KB

MD5
1fa88c8044f3171be6ab8548a6624034

SHA1
1dfd6089328ae6ff0a5767e211f71eba400a3e5b

SHA256
d29542fc2fc68f74aae5744cfcb38f472d20aaeeb9fb524aed0491fd1dfc0c29

SHA512
a8131f47c2ee9bec87fef03e6608a2f008d9c71d3f25b014a3a375d2915a0b74f5bd4de021a6be7b7de82b153b837c92ad8f25d65f6ae3decd9c3cf9889a2e51

Download Submit
memory/4736-192-0x0000000000100000-0x0000000000135000-memory.dmp

Filesize
212KB

Download
memory/4736-193-0x0000000074830000-0x0000000074A53000-memory.dmp

Filesize
2.1MB

Download
memory/4736-197-0x0000000074830000-0x0000000074A53000-memory.dmp

Filesize
2.1MB

Download