559c6ceb7664361f758f37749a7673ce9562c2c82b885dfd8ea0ceda6e62ba5f

Analysis

max time kernel
1799s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240802-de
resource tags

arch:x64arch:x86image:win10v2004-20240802-delocale:de-deos:windows10-2004-x64systemwindows
submitted
06/08/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/MicrosoftEdgeWebview2Setup.exe
Size

1.6MB
MD5

45e5ca74b9ae3c3fc6f6a63c609783b6
SHA1

f36715bea96d69bb18075fac30b90502c6d2464b
SHA256

b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9
SHA512

014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a
SSDEEP

49152:OiEa3J/lPA552bT8TCKpxVt2sl0TD5yncADYOS0jZ2/vgm9dV:OirIOoT9pnt9l45mcADRS0SRbV

Score

6^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.86\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 16 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdate.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\vcruntime140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\am.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\copilot_provider_msix\package_metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\psuser_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\hi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\kn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\th.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\psmachine_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\wns_push_client.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\ca.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5092_13367448222420214_5092.pma	setup.exe
File created	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\fil.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\delegatedWebFeatures.sccd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\msedge.dll.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\gl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\gd.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\EBWebView\x64\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\msedge.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\az.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\mi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ae3b41f6-fc2f-4dee-9ec2-5736b33be4d2.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.86\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Edge.dat	setup.exe

Executes dropped EXE 26 IoCs

pid	Process
4988	MicrosoftEdgeUpdate.exe
660	MicrosoftEdgeUpdate.exe
1372	MicrosoftEdgeUpdate.exe
3396	MicrosoftEdgeUpdateComRegisterShell64.exe
4828	MicrosoftEdgeUpdateComRegisterShell64.exe
880	MicrosoftEdgeUpdateComRegisterShell64.exe
2356	MicrosoftEdgeUpdate.exe
2552	MicrosoftEdgeUpdate.exe
448	MicrosoftEdgeUpdate.exe
4908	MicrosoftEdgeUpdate.exe
4396	MicrosoftEdge_X64_127.0.2651.86.exe
1804	setup.exe
4228	setup.exe
1580	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
4788	MicrosoftEdgeUpdate.exe
4912	MicrosoftEdge_X64_127.0.2651.86.exe
2248	setup.exe
4728	setup.exe
4824	setup.exe
4080	setup.exe
5092	setup.exe
3624	setup.exe
4564	setup.exe
732	setup.exe
4876	MicrosoftEdgeUpdate.exe

Loads dropped DLL 21 IoCs

pid	Process
4988	MicrosoftEdgeUpdate.exe
660	MicrosoftEdgeUpdate.exe
1372	MicrosoftEdgeUpdate.exe
3396	MicrosoftEdgeUpdateComRegisterShell64.exe
1372	MicrosoftEdgeUpdate.exe
4828	MicrosoftEdgeUpdateComRegisterShell64.exe
1372	MicrosoftEdgeUpdate.exe
880	MicrosoftEdgeUpdateComRegisterShell64.exe
1372	MicrosoftEdgeUpdate.exe
2356	MicrosoftEdgeUpdate.exe
2552	MicrosoftEdgeUpdate.exe
448	MicrosoftEdgeUpdate.exe
448	MicrosoftEdgeUpdate.exe
2552	MicrosoftEdgeUpdate.exe
4908	MicrosoftEdgeUpdate.exe
1580	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
4788	MicrosoftEdgeUpdate.exe
4788	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
4876	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2356	MicrosoftEdgeUpdate.exe
4908	MicrosoftEdgeUpdate.exe
1580	MicrosoftEdgeUpdate.exe
4876	MicrosoftEdgeUpdate.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.86\\BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\127.0.2651.86\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}\LocalService = "MicrosoftEdgeElevationService"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CLSID\ = "{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ = "Interface {C9C2B807-7731-4F34-81B7-44FF7779522B}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4988	MicrosoftEdgeUpdate.exe
4988	MicrosoftEdgeUpdate.exe
4988	MicrosoftEdgeUpdate.exe
4988	MicrosoftEdgeUpdate.exe
4988	MicrosoftEdgeUpdate.exe
4988	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
5096	MicrosoftEdgeUpdate.exe
5092	setup.exe
5092	setup.exe
4788	MicrosoftEdgeUpdate.exe
4788	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5096	MicrosoftEdgeUpdate.exe
Token: 33	2248	setup.exe
Token: SeIncBasePriorityPrivilege	2248	setup.exe
Token: SeDebugPrivilege	4788	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4988	5080	MicrosoftEdgeWebview2Setup.exe	86
PID 5080 wrote to memory of 4988	5080	MicrosoftEdgeWebview2Setup.exe	86
PID 5080 wrote to memory of 4988	5080	MicrosoftEdgeWebview2Setup.exe	86
PID 4988 wrote to memory of 660	4988	MicrosoftEdgeUpdate.exe	87
PID 4988 wrote to memory of 660	4988	MicrosoftEdgeUpdate.exe	87
PID 4988 wrote to memory of 660	4988	MicrosoftEdgeUpdate.exe	87
PID 4988 wrote to memory of 1372	4988	MicrosoftEdgeUpdate.exe	88
PID 4988 wrote to memory of 1372	4988	MicrosoftEdgeUpdate.exe	88
PID 4988 wrote to memory of 1372	4988	MicrosoftEdgeUpdate.exe	88
PID 1372 wrote to memory of 3396	1372	MicrosoftEdgeUpdate.exe	89
PID 1372 wrote to memory of 3396	1372	MicrosoftEdgeUpdate.exe	89
PID 1372 wrote to memory of 4828	1372	MicrosoftEdgeUpdate.exe	90
PID 1372 wrote to memory of 4828	1372	MicrosoftEdgeUpdate.exe	90
PID 1372 wrote to memory of 880	1372	MicrosoftEdgeUpdate.exe	91
PID 1372 wrote to memory of 880	1372	MicrosoftEdgeUpdate.exe	91
PID 4988 wrote to memory of 2356	4988	MicrosoftEdgeUpdate.exe	92
PID 4988 wrote to memory of 2356	4988	MicrosoftEdgeUpdate.exe	92
PID 4988 wrote to memory of 2356	4988	MicrosoftEdgeUpdate.exe	92
PID 4988 wrote to memory of 2552	4988	MicrosoftEdgeUpdate.exe	93
PID 4988 wrote to memory of 2552	4988	MicrosoftEdgeUpdate.exe	93
PID 4988 wrote to memory of 2552	4988	MicrosoftEdgeUpdate.exe	93
PID 448 wrote to memory of 4908	448	MicrosoftEdgeUpdate.exe	95
PID 448 wrote to memory of 4908	448	MicrosoftEdgeUpdate.exe	95
PID 448 wrote to memory of 4908	448	MicrosoftEdgeUpdate.exe	95
PID 448 wrote to memory of 4396	448	MicrosoftEdgeUpdate.exe	97
PID 448 wrote to memory of 4396	448	MicrosoftEdgeUpdate.exe	97
PID 4396 wrote to memory of 1804	4396	MicrosoftEdge_X64_127.0.2651.86.exe	98
PID 4396 wrote to memory of 1804	4396	MicrosoftEdge_X64_127.0.2651.86.exe	98
PID 1804 wrote to memory of 4228	1804	setup.exe	99
PID 1804 wrote to memory of 4228	1804	setup.exe	99
PID 448 wrote to memory of 1580	448	MicrosoftEdgeUpdate.exe	103
PID 448 wrote to memory of 1580	448	MicrosoftEdgeUpdate.exe	103
PID 448 wrote to memory of 1580	448	MicrosoftEdgeUpdate.exe	103
PID 4788 wrote to memory of 4912	4788	MicrosoftEdgeUpdate.exe	106
PID 4788 wrote to memory of 4912	4788	MicrosoftEdgeUpdate.exe	106
PID 4912 wrote to memory of 2248	4912	MicrosoftEdge_X64_127.0.2651.86.exe	107
PID 4912 wrote to memory of 2248	4912	MicrosoftEdge_X64_127.0.2651.86.exe	107
PID 2248 wrote to memory of 4728	2248	setup.exe	108
PID 2248 wrote to memory of 4728	2248	setup.exe	108
PID 2248 wrote to memory of 4824	2248	setup.exe	109
PID 2248 wrote to memory of 4824	2248	setup.exe	109
PID 4824 wrote to memory of 4080	4824	setup.exe	110
PID 4824 wrote to memory of 4080	4824	setup.exe	110
PID 2248 wrote to memory of 5092	2248	setup.exe	111
PID 2248 wrote to memory of 5092	2248	setup.exe	111
PID 2248 wrote to memory of 3624	2248	setup.exe	112
PID 2248 wrote to memory of 3624	2248	setup.exe	112
PID 5092 wrote to memory of 4564	5092	setup.exe	113
PID 5092 wrote to memory of 4564	5092	setup.exe	113
PID 3624 wrote to memory of 732	3624	setup.exe	114
PID 3624 wrote to memory of 732	3624	setup.exe	114
PID 4788 wrote to memory of 4876	4788	MicrosoftEdgeUpdate.exe	117
PID 4788 wrote to memory of 4876	4788	MicrosoftEdgeUpdate.exe	117
PID 4788 wrote to memory of 4876	4788	MicrosoftEdgeUpdate.exe	117

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\$TEMP\MicrosoftEdgeWebview2Setup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\MicrosoftEdgeWebview2Setup.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:660
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3396
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4828
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:880
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjA4QkEzMDAtNDEzMS00RkEwLUIwMzEtQzFGQkZGQzZFNkNCfSIgdXNlcmlkPSJ7MTAxQzU3NEEtOUI4Ny00RUQ5LTgxMkItOTJFMUNDNTAzQTUzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0RFMENDODFELUVDREEtNEIzOC05QkNCLTI5RDE4ODcwREE4NH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQ3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY4OTgwODQ5NiIgaW5zdGFsbF90aW1lX21zPSI2NTYiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{B08BA300-4131-4FA0-B031-C1FBFFC6E6CB}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjA4QkEzMDAtNDEzMS00RkEwLUIwMzEtQzFGQkZGQzZFNkNCfSIgdXNlcmlkPSJ7MTAxQzU3NEEtOUI4Ny00RUQ5LTgxMkItOTJFMUNDNTAzQTUzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDFFNTk4Q0ItMzlEMi00MDQxLTlBOTItQjkwNDNFQTQzMTA0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2hWZkRqTWRGRzZGZ0tzME56NmVtcllDU2c2VFF2RFBvbW9sUmF5UVhCSzQ9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjI2MDI3NjMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM2NzA3NTI3MzI1MzE4MTAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Njk2NTI3MjY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4908
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\EDGEMITMP_68011.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\EDGEMITMP_68011.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\EDGEMITMP_68011.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\EDGEMITMP_68011.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CB03CDC2-D8D0-40BC-8FDB-EDEE1FBB557E}\EDGEMITMP_68011.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x22c,0x230,0x234,0x11c,0x238,0x7ff65f0cb7d0,0x7ff65f0cb7dc,0x7ff65f0cb7e8
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:4228
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjA4QkEzMDAtNDEzMS00RkEwLUIwMzEtQzFGQkZGQzZFNkNCfSIgdXNlcmlkPSJ7MTAxQzU3NEEtOUI4Ny00RUQ5LTgxMkItOTJFMUNDNTAzQTUzfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezUyQUJCNTI4LTNGQ0YtNDg0Ni1CMDhGLUQ5QkJDNjZDOTkwM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC4yNjUxLjg2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzEwNTkwMjcyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDcxMDc0NjExNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MTkxODM0MjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2IyMzVmYzNhLTg2YmYtNDIwZi1iMWJjLTZjNjdhM2E5NTg4OT9QMT0xNzIzNTc5MTEyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUl4SUVMbFdsWlRaVmpNeTRUejd1cGlUJTJiVnlJTFclMmJna201T2QxODAlMmJ1JTJiTlRCc1QxYlhWNHFCWFBTSWlOd2JjdnFHa05iSlJVQ0ZoMmxVSE1PSiUyZjdrZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgZG93bmxvYWRfdGltZV9tcz0iMTQ1NzgiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTE5MTgzNDI1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDkzMjYyMTE4NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM2OTgwODg2MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijg3NSIgZG93bmxvYWRfdGltZV9tcz0iMjA4MjgiIGRvd25sb2FkZWQ9IjE3MjU2NzEwNCIgdG90YWw9IjE3MjU2NzEwNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDM3MTkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1580

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\MicrosoftEdge_X64_127.0.2651.86.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\MicrosoftEdge_X64_127.0.2651.86.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Installs/modifies Browser Helper Object
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff65b33b7d0,0x7ff65b33b7dc,0x7ff65b33b7e8
      4⤵
      Executes dropped EXE
      PID:4728
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff65b33b7d0,0x7ff65b33b7dc,0x7ff65b33b7e8
        5⤵
        Executes dropped EXE
        
        PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7e1a4b7d0,0x7ff7e1a4b7dc,0x7ff7e1a4b7e8
        5⤵
        Executes dropped EXE
        
        PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7e1a4b7d0,0x7ff7e1a4b7dc,0x7ff7e1a4b7e8
        5⤵
        Executes dropped EXE
        
        PID:732
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTYzQzhDNEMtQzhDMy00MTJELTg3QTEtOTQ3QUE3OTNCODU0fSIgdXNlcmlkPSJ7MTAxQzU3NEEtOUI4Ny00RUQ5LTgxMkItOTJFMUNDNTAzQTUzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins1RkZCRjk4MC04QjYyLTQ3MUMtOEZFMy05RkQ2RTlDQkY5RDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4xNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjIlNUQiIGluc3RhbGxhZ2U9IjAiIGNvaG9ydD0icnJmQDAuNjkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY0MjMiIHBpbmdfZnJlc2huZXNzPSJ7MTVEQzQ2MjItMkQ4QS00NTMwLUJBQ0EtMDU5Mjg3RTFGRDAwfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEyNy4wLjI2NTEuODYiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzY3MDgxMzcxNjU5MTAwMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzc1MTM3MTI2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzUxNTI3MjQwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3NzY4Mzk2NjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzc5MDI3NzM0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iODEzOTE4Mzc3OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM5MSIgZG93bmxvYWRlZD0iMTcyNTY3MTA0IiB0b3RhbD0iMTcyNTY3MTA0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSIzNDg3NSIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9IjQiIGFkPSItMSIgcmQ9IjY0MjMiIHBpbmdfZnJlc2huZXNzPSJ7RjQ1MUI3NkUtOTNCNy00N0U5LUFBQTItOEU4OTM0QkQ1RDZBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjcuMC4yNjUxLjg2IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjY0MjYiIGNvaG9ydD0icnJmQDAuMDgiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins0MTJDRThFNi1FODNCLTQ2Q0QtODg1MS0yN0VEQUU4RkJFOUF9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setup.exe

Filesize
6.6MB

MD5
71bf4a76d1762959b49eda173f57656e

SHA1
2ead7f36b7ef2790d83d10d96b20959bf73d061d

SHA256
0121c1dde7daaacfd974fc8545a029e970ad7769af84646feff41b7c8c2de33e

SHA512
05ea34097e98e4df5358a2968e4af9c7157c1946b15787d5c3cb1c841d47db6cacda4135a0fc662c2dae0b8ad03bdcfa1015db745c39bb16068df0108bda717e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4CC544DE-2E32-4546-A3F3-2BEBCAFA817D}\EDGEMITMP_4967D.tmp\SETUP.EX_

Filesize
2.6MB

MD5
773e45f33cae3d7e514589b04930d7ba

SHA1
ca73da33a39de5309b596eaeb055f3175864c0ae

SHA256
16ee960dbf5a6b3c3d465ba2d77c049af4c15e5aea5c6f8b2e44ee7e5a623ed8

SHA512
d707474b38e991b8b015a0cc1bddc5dec29622c9f48b43e4b37d4e4d2a74dca70fd71eb792ee8d38c53af43da4e500afa018b27df3dfc9b652b5c1c0a76fff4f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
b69894fc1c3f26c77b1826ef8b5a9fc5

SHA1
cff7b4299253beda53fb015408dd840db59901a1

SHA256
b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

SHA512
8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
136e8226d68856da40a4f60e70581b72

SHA1
6c1a09e12e3e07740feef7b209f673b06542ab62

SHA256
b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

SHA512
9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
205590d4fb4b1914d2853ab7a9839ccf

SHA1
d9bbf8941df5993f72ffcf46beefcfcd88694ebd

SHA256
5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

SHA512
bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
261KB

MD5
b07ab49ee8453853021c7dac2b2131db

SHA1
e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

SHA256
f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

SHA512
5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
5d89123f9b96098d8fad74108bdd5f7e

SHA1
6309551b9656527563d2b2f3c335fd6805da0501

SHA256
03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

SHA512
9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
4f860d5995ab77e6efa8f589a758c6d2

SHA1
07536839ccfd3c654ec5dc2161020f729973196d

SHA256
9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

SHA512
0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f624de37750fd191eb29d4de36818f8b

SHA1
b647dae9b9a3c673980afa651d73ce0a4985aae6

SHA256
e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

SHA512
d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
5de3f4dabb5f033f24e29033142e7349

SHA1
5c446985de443501b545d75f6886a143c748b033

SHA256
2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

SHA512
c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
1fb14c6c4fee7bfabe41badb7c5acff8

SHA1
953d94cd73951943db14c08cce37b2d3ac821b02

SHA256
cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

SHA512
a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
d3345579310f3bd080b406de47b2305f

SHA1
16aefb27ea6d81c684f041aa50ebb49fdd403d83

SHA256
b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

SHA512
65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
ecf3405e9e712d685ef1e8a5377296ea

SHA1
9872cdf450adf4257d77282a39b75822ce1c8375

SHA256
e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

SHA512
37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
051c429fa2beec9c2842c403a86c0e7b

SHA1
0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

SHA256
1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

SHA512
bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
82711e45d2b0764997abc1e0678a73bb

SHA1
47908e8885c86477a6f52eea5fddb005ec5b3fa3

SHA256
2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

SHA512
4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
a0a1f791984f1de2f03a36171232d18d

SHA1
71f69d8fe47640ba9705725d7d627a05519c8016

SHA256
d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

SHA512
a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
897712b508931dab76d39b209611740c

SHA1
9d80e07c2dc744e2efce3b67aa9876949fb9edfe

SHA256
ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

SHA512
3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
e90155442b28008992a7d899ca730222

SHA1
1d448e9709de0d301ded6d75caaeba4348a4793d

SHA256
6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

SHA512
a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
1de961b662a374c3af918c18225f4364

SHA1
e8f1c438e57b322f43b4b851698bf38c129eb6ae

SHA256
bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

SHA512
c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
29f027d2d5fd486bdc20386ace925603

SHA1
66b8605f23871b4a8302bef0aaccb36ee1e72755

SHA256
03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

SHA512
3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
b0ae9aa0d5c17ee7abfc57d21cdcbae6

SHA1
01019eb6ba9c123be528136e12192b0bb33df407

SHA256
d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

SHA512
4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
ad5b530eabff0540078c5d17f27b9610

SHA1
7e53dbbf64e70e561d37669e69f50eb0da8e37d1

SHA256
49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

SHA512
e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
a7e64339a5314e3576c0d170171fa52a

SHA1
6c12aab6c97c30aff3245b78f7a3afeea604215e

SHA256
4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

SHA512
a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
74d4cf3b8efb6cc3d0acc3eac38bd5b7

SHA1
9337803aadad9042c895b6f418b4c733b81221e0

SHA256
b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

SHA512
e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
19dc1f6d1f309eb7abf1e0c8257f41f8

SHA1
e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

SHA256
046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

SHA512
478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
8f7f515d78d2df371993fd70f863ab8d

SHA1
dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

SHA256
ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

SHA512
308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
6af05d448c842027f876e93f8ac58b65

SHA1
f34c988e3875a1d1b267b082476fcfb8d7505a73

SHA256
36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

SHA512
412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
ae9bdf6416c3630c4b0b5b119308a135

SHA1
d7218c677b098d2a93cc91ead39c83d3a2c653b6

SHA256
62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

SHA512
4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
fe73dbc305da6223d1e94e1cf548c000

SHA1
b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

SHA256
1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

SHA512
d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
367ea715e942c81dd3cb734274969a0b

SHA1
f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

SHA256
082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

SHA512
c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
5a30bc4216af48a493eeb0f3a9f02607

SHA1
2fdf65a4002d91818d56a23fb8bfd08ab715002f

SHA256
5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

SHA512
34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
84c4736cf301b93998028ed7678caec1

SHA1
3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

SHA256
3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

SHA512
5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
8993c0784111fc7cd6a90a82303e5f44

SHA1
8d1ff2fed98ebc608604c555ceb46ca628afb285

SHA256
3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

SHA512
124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
a640aa4ff33662e06a474765df0b2a8d

SHA1
c6265225532e389e48c6057bd717b69de2125b61

SHA256
078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

SHA512
59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
5bcc643a969559317d09a9c87f53d04e

SHA1
3602d51cde97de16d8c018225a39d505c803e0fc

SHA256
b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

SHA512
4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
aea23f526ef0c5bb3d2f8fdf192a49ea

SHA1
4d7695e33ed43c3efb95f304e29675ea885b2939

SHA256
3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

SHA512
412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
295cd30c00f43d9131621baf4859578f

SHA1
cab79a6263b7b0a799461f3e6df41f815029cded

SHA256
b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

SHA512
5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
c43c1ab37cd93e54068443bc330fb3d2

SHA1
ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

SHA256
0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

SHA512
ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
a5544f517f7c1bfd1ec6a2e355d5a84c

SHA1
34a2a4a576300ad55b6757171bcba0fab005daa5

SHA256
8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

SHA512
9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
c09876a180731c172fa2532f8be90a3d

SHA1
4359c7840ddb23142a40aff85129b9920360e954

SHA256
50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

SHA512
91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
ee19156c12d2d7cce9b12e515f9ac6c5

SHA1
19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

SHA256
c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

SHA512
631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
eacd4638369bf96ccc7c23af37e15b5d

SHA1
15c4878b78c06095981abcc589c4a6f265ef96a3

SHA256
a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

SHA512
19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
19d44de8f930e07f41f9343478ed5c1d

SHA1
83ee0c5a86997dd491bd8312d221dde2b2e7d44a

SHA256
69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

SHA512
4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
26cbb965c6976f59ac385ef9408bf81a

SHA1
16bb0530338e600fdfd13a7b03523a715e633bcb

SHA256
bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

SHA512
1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
98f79d77ab05304bba8d60e50914418f

SHA1
957590adc0f8a7274e765e2a804c1de7c76e3040

SHA256
3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

SHA512
9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
b89ba9ecc6d4c77abff61b1c75fff16c

SHA1
f381408f26be2c77c7b59681ad6280a701ccb472

SHA256
bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

SHA512
53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
d464fd223ba898e6fef4e485a3118394

SHA1
59c78983ce859485fea5458ba4e7803c38012b9d

SHA256
066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

SHA512
6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
1b1202fc3e46d7b46ce3cb46cdc5ab21

SHA1
e76d1065035d86eef011feb3cad3ac38eecd0b7d

SHA256
b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

SHA512
7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
126036b98853a9d31937f874484dcb83

SHA1
27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

SHA256
90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

SHA512
b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
e20f7a758cc9bab3d458d89d828521cc

SHA1
cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb

SHA256
92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb

SHA512
8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
f7dbd944a9126dbe568faf2489ecf053

SHA1
16ad534b4fa48d95224c74b8ca4d3d4533c76425

SHA256
b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703

SHA512
0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
c1557eba649fc78356ed198d6754416d

SHA1
1ab42e71a88b127c40f8dd6d1b0660f271442a11

SHA256
8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9

SHA512
e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
b61c9c9ea8340b6b3a873162a2710cfe

SHA1
5017b90dbd61add602681b76542b0bd3974639af

SHA256
f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737

SHA512
0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
6e6f49c35d2b74090529fc1d8d12eb2e

SHA1
5a0fc9397872d7d26803276292962cdb0a5e4739

SHA256
6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260

SHA512
d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
071ee832762aab532c59b858c7d3a46a

SHA1
0a976bd2c76d8db1f831a8912184d43e02ecf293

SHA256
a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2

SHA512
50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_lv.dll

Filesize
29KB

MD5
bf10592aafe1b8446c005ee9e5c305a8

SHA1
19b81a238e07c958f1757488440e42ba99b59b53

SHA256
5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f

SHA512
b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
d8b6019ab0fa35c6e64b08f1453204be

SHA1
aea69732af642a0d13bc8feda2b25751196cc1c2

SHA256
0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2

SHA512
878dd4db34b1f501c37eacedac8eb0c87143189f7357fbd5bd97faac01ba98cebab56e2e3934af012de37d0f32fb91578b16504b12e34b5f448605a82cb8f054

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
f05d3aa1b51abeab311516368dddd8bc

SHA1
75ca6ae175a3ccc9f00d82afb4c6b673f396c6ac

SHA256
7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d

SHA512
4ff88ba89823ad0c0ca2782c87bbdbc7fe738a161d5d4f674d7b9c97d491eb5aefc0430f34d3dfa7c2737f3484040894d81ac38135fc4ad3bc6cc0eb24e479f7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ml.dll

Filesize
31KB

MD5
dc1bb5db270c494456f49913e26f94b7

SHA1
73dd3db577b7bd6bdaf047cd2012c75cc2213bd2

SHA256
155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf

SHA512
2cff374df4f8f41961c6e26ce369fc07ad8881c2edbe85173b6982d393402e32a79c73b8c17cc786d27a1f0ee79475e4ef9b3238f8770a099bdb9c422caa1287

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_mr.dll

Filesize
28KB

MD5
f94262bdadb5903e2e93a6cb6218fbe6

SHA1
c066be7fb4a1459cb62288e4799e268fcdb13ab8

SHA256
9e000d271d96f02bd0baecae07ef5b9a7f5f17d33733e2c9bb50f13e4c6e84b1

SHA512
11543d93e28e5616dd3aadd5e9b20b22b9160fb4117a0cc57971e5e46b52150c600bde161560410322b1db1c8a26e0c61cf9fdc761ca461a22f0c4eac16340b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_ms.dll

Filesize
28KB

MD5
47d8bedb506470955c8a1b973e34793b

SHA1
d322b0d0d0663bfb9fdd42d3955dede092a0c8ef

SHA256
d79365e02f80694a9a2d76becc6a203a758b4006fbb521453f943ace16d24c8c

SHA512
6b268a0c8c6b2e0f26657040799c8c1ec523882e4dfff3f8d1e2bdbbe47b800e390de0a6bbac7d6253ab84c60c4103b4687b3fbe84d6e289f25c19639d25bef8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU732C.tmp\msedgeupdateres_mt.dll

Filesize
29KB

MD5
11cfc0a8eeff082d17979d3968d5d110

SHA1
c963251af2d22fe7000d1eebe76ea44fb7da6496

SHA256
ce19cc60aceaecb34cf496857dd3698a2a5dfe88cb67bd4b7fd0a7ecc51c2ea8

SHA512
97c09f6a02e4469ee0a609d9d67e20111e2abf9c8672d0fcf8275d66d20fc92e61d8dcb88b3cc9a32d46391253ffff6157c5a7cff7fc9248af55ab3d3217a2ce

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
480a46f022de6a1a2415cafaaa683754

SHA1
2dc58084c02ec80459b6541d83237b3344417d54

SHA256
a733ef4f85e7b108e601f3910f409b415ae6ef561d8fa4bcb4718534a462b5b4

SHA512
e3b8d91d98a69d7dd36c4a6355c2f3fbf6816c6eb1045cd8de5f0597085306fee3f3affea04aaa66dc95839654e665a70f045019b2c35ee65f71550959cd4b58

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
60KB

MD5
2effc01e5cebfd573db8301ce15b300f

SHA1
cc1fa869447b98f419efe27d30905f2d24d1110f

SHA256
458e4477b00e91c2d765d662b7ba812a30346e204462f5159bb1e53f8bf6b660

SHA512
debaeedd2d0d4521d72b699bf9d22f5cd5cb6df8c61d926378a3f51c61f8c9f0829922d4bd7a8e34841edda3674eae341df8510169ccad07a825f870908503a7

Download Submit
memory/4988-245-0x0000000000440000-0x0000000000475000-memory.dmp

Filesize
212KB

Download
memory/4988-233-0x0000000074430000-0x0000000074655000-memory.dmp

Filesize
2.1MB

Download
memory/4988-193-0x0000000074430000-0x0000000074655000-memory.dmp

Filesize
2.1MB

Download
memory/4988-192-0x0000000000440000-0x0000000000475000-memory.dmp

Filesize
212KB

Download