828d5c8ff19fb394f8444acfdb6dfd4030a0d3122cce2272452e34f5393f4972

Resubmissions

21-09-2024 16:57

240921-vgn28stckl 6

21-09-2024 12:04

240921-n8n3zs1dlg 6

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Meteorite_0.3.0_x64_en-US.msi
Size

5.6MB
MD5

196f000d6929e1ce6f79e581fec37e2c
SHA1

8e904fd9477ffa493acfe0631c249002944c0e88
SHA256

828d5c8ff19fb394f8444acfdb6dfd4030a0d3122cce2272452e34f5393f4972
SHA512

1b4b643a26f34e7cc48407f9fc9a07f1705e93d7c7f7a5a421f8861a8a3971c15931a7ee091e4aef37fb3a606b5656843d081b0e8fca8ae046d81f52abb5bd42
SSDEEP

98304:zllounibAOzWM+JczBnjAt2hxiS0gCMjiZJqrtqa4TAKlGyA08dysDdkSbTry:rodh1FnOSnOZJGtZ4kK6ZQidkSb

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\psmachine_arm64.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ar.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_nb.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateOnDemand.exe	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_id.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bn-IN.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_mi.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_mt.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_pa.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ug.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ro.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_pl.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateSetup.exe	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_el.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fil.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bg.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bn.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ml.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_te.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ga.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_mk.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ko.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_lv.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_sv.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ne.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\psmachine.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_it.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_nl.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_es.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_iw.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateBroker.exe	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_eu.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_zh-TW.dll	MSIDA1C.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fa.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hu.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ca.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_th.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_vi.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gl.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\EdgeUpdate.dat	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_is.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ms.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_sk.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_sr.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ka.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdate.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ja.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gd.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gu.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_pt-PT.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_lo.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fi.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hi.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_es-419.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hr.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\psuser_64.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\NOTICE.TXT	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_en.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_pt-BR.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_af.dll	MSIDA1C.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_nn.dll	MSIDA1C.tmp

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f78bdc4.ipi	msiexec.exe
File created	C:\Windows\Installer\{417C4DED-3A8C-421E-A307-43D885DFD562}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{417C4DED-3A8C-421E-A307-43D885DFD562}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\f78bdc6.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f78bdc3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f78bdc3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA1C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0EF.tmp	msiexec.exe

Executes dropped EXE 11 IoCs

pid	Process
1044	MSIDA1C.tmp
1764	MicrosoftEdgeUpdate.exe
2252	MicrosoftEdgeUpdate.exe
828	MicrosoftEdgeUpdate.exe
2212	MicrosoftEdgeUpdateComRegisterShell64.exe
2232	MicrosoftEdgeUpdateComRegisterShell64.exe
2752	MicrosoftEdgeUpdateComRegisterShell64.exe
2636	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
2164	MicrosoftEdgeUpdate.exe
2456	MicrosoftEdgeUpdate.exe

Loads dropped DLL 30 IoCs

pid	Process
2712	MsiExec.exe
2204	msiexec.exe
2204	msiexec.exe
1184	Process not Found
1184	Process not Found
1184	Process not Found
1184	Process not Found
1044	MSIDA1C.tmp
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
828	MicrosoftEdgeUpdate.exe
828	MicrosoftEdgeUpdate.exe
2212	MicrosoftEdgeUpdateComRegisterShell64.exe
828	MicrosoftEdgeUpdate.exe
828	MicrosoftEdgeUpdate.exe
2232	MicrosoftEdgeUpdateComRegisterShell64.exe
828	MicrosoftEdgeUpdate.exe
828	MicrosoftEdgeUpdate.exe
2752	MicrosoftEdgeUpdateComRegisterShell64.exe
828	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
2164	MicrosoftEdgeUpdate.exe
1860	MicrosoftEdgeUpdate.exe
2164	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1956	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIDA1C.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2636	MicrosoftEdgeUpdate.exe
2456	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{579454EC-2469-413F-A4BA-4A9F19D63ABB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{579454EC-2469-413F-A4BA-4A9F19D63ABB}\5e-fd-e8-c0-db-13	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{579454EC-2469-413F-A4BA-4A9F19D63ABB}\WpadDecisionTime = d0a39a89470cdb01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-fd-e8-c0-db-13\WpadDetectedUrl	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{579454EC-2469-413F-A4BA-4A9F19D63ABB}\WpadDecisionTime = 105c9c8f470cdb01	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID\ = "{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2204	msiexec.exe
2204	msiexec.exe
1764	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1956	msiexec.exe
Token: SeLockMemoryPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeMachineAccountPrivilege	1956	msiexec.exe
Token: SeTcbPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeLoadDriverPrivilege	1956	msiexec.exe
Token: SeSystemProfilePrivilege	1956	msiexec.exe
Token: SeSystemtimePrivilege	1956	msiexec.exe
Token: SeProfSingleProcessPrivilege	1956	msiexec.exe
Token: SeIncBasePriorityPrivilege	1956	msiexec.exe
Token: SeCreatePagefilePrivilege	1956	msiexec.exe
Token: SeCreatePermanentPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeDebugPrivilege	1956	msiexec.exe
Token: SeAuditPrivilege	1956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1956	msiexec.exe
Token: SeChangeNotifyPrivilege	1956	msiexec.exe
Token: SeRemoteShutdownPrivilege	1956	msiexec.exe
Token: SeUndockPrivilege	1956	msiexec.exe
Token: SeSyncAgentPrivilege	1956	msiexec.exe
Token: SeEnableDelegationPrivilege	1956	msiexec.exe
Token: SeManageVolumePrivilege	1956	msiexec.exe
Token: SeImpersonatePrivilege	1956	msiexec.exe
Token: SeCreateGlobalPrivilege	1956	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1956	msiexec.exe
Token: SeLockMemoryPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeMachineAccountPrivilege	1956	msiexec.exe
Token: SeTcbPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeLoadDriverPrivilege	1956	msiexec.exe
Token: SeSystemProfilePrivilege	1956	msiexec.exe
Token: SeSystemtimePrivilege	1956	msiexec.exe
Token: SeProfSingleProcessPrivilege	1956	msiexec.exe
Token: SeIncBasePriorityPrivilege	1956	msiexec.exe
Token: SeCreatePagefilePrivilege	1956	msiexec.exe
Token: SeCreatePermanentPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeDebugPrivilege	1956	msiexec.exe
Token: SeAuditPrivilege	1956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1956	msiexec.exe
Token: SeChangeNotifyPrivilege	1956	msiexec.exe
Token: SeRemoteShutdownPrivilege	1956	msiexec.exe
Token: SeUndockPrivilege	1956	msiexec.exe
Token: SeSyncAgentPrivilege	1956	msiexec.exe
Token: SeEnableDelegationPrivilege	1956	msiexec.exe
Token: SeManageVolumePrivilege	1956	msiexec.exe
Token: SeImpersonatePrivilege	1956	msiexec.exe
Token: SeCreateGlobalPrivilege	1956	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 2712	2204	msiexec.exe	30
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 2204 wrote to memory of 1044	2204	msiexec.exe	35
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1044 wrote to memory of 1764	1044	MSIDA1C.tmp	36
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 2252	1764	MicrosoftEdgeUpdate.exe	37
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 1764 wrote to memory of 828	1764	MicrosoftEdgeUpdate.exe	38
PID 828 wrote to memory of 2212	828	MicrosoftEdgeUpdate.exe	39
PID 828 wrote to memory of 2212	828	MicrosoftEdgeUpdate.exe	39
PID 828 wrote to memory of 2212	828	MicrosoftEdgeUpdate.exe	39
PID 828 wrote to memory of 2212	828	MicrosoftEdgeUpdate.exe	39
PID 828 wrote to memory of 2232	828	MicrosoftEdgeUpdate.exe	40
PID 828 wrote to memory of 2232	828	MicrosoftEdgeUpdate.exe	40
PID 828 wrote to memory of 2232	828	MicrosoftEdgeUpdate.exe	40
PID 828 wrote to memory of 2232	828	MicrosoftEdgeUpdate.exe	40
PID 828 wrote to memory of 2752	828	MicrosoftEdgeUpdate.exe	41
PID 828 wrote to memory of 2752	828	MicrosoftEdgeUpdate.exe	41
PID 828 wrote to memory of 2752	828	MicrosoftEdgeUpdate.exe	41
PID 828 wrote to memory of 2752	828	MicrosoftEdgeUpdate.exe	41
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 2636	1764	MicrosoftEdgeUpdate.exe	42
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 1764 wrote to memory of 1860	1764	MicrosoftEdgeUpdate.exe	43
PID 2164 wrote to memory of 2456	2164	MicrosoftEdgeUpdate.exe	45
PID 2164 wrote to memory of 2456	2164	MicrosoftEdgeUpdate.exe	45
PID 2164 wrote to memory of 2456	2164	MicrosoftEdgeUpdate.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Meteorite_0.3.0_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7131D433C9471CBBE9DDA85C5EFC57B6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\Installer\MSIDA1C.tmp
  "C:\Windows\Installer\MSIDA1C.tmp" /silent /install
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2252
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2232
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2752
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzdENDU3OEYtMjA3My00ODRBLTk2MTUtQzE0NkUyMTU1NkJCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEREVCMEYzOS02M0YzLTRDMjQtQkIyMi01MEM5RUU5RDM5QzV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMzgyMTI5NjAwMCIgaW5zdGFsbF90aW1lX21zPSIyNjA1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2636
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{37D4578F-2073-484A-9615-C146E21556BB}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2748

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000564" "00000000000003DC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2624

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzdENDU3OEYtMjA3My00ODRBLTk2MTUtQzE0NkUyMTU1NkJCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNzQ4REY1RC1DMTRELTQyMTgtQTY3My01Q0ZFRUIyMzU0QkZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjM4MjU2NjQwMDAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Drops file in System32 directory
  - Checks system information in the registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
172KB

MD5
b462ad181104b32ec56a6a1e1aa25622

SHA1
c26dbc70359be470fb63d50e12528e473749d9f7

SHA256
5b95e7e42a2df4c8cb8a1dfc9e71f81831ffc128408ad1a37f83ab76dcdf1afb

SHA512
5f6b37f4e88b617ca68762706423e38da4eccb820e82635eda3ed269efeb92ae3285e0b1285978f35dd8df004c801ebbca2f7c061ae055070bdbcba88c474e70

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
205KB

MD5
fccf8ebd72efacc9566b7849d59512aa

SHA1
2d0cc03e7912578d1c0a01e1d338290a0d1c157e

SHA256
a6a3b7b77ec3fcbdd07b516457fcc7368282ed84e04792316d2ceeeb3b6c84fb

SHA512
6e0b2e27ae19c3100b789b8b22eb307072a902878d92cea426ac02c07c8338934b49c57012a858e01816617ec6c41ef39b7a390e63c8975e56c4504faa8b6b3a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
250KB

MD5
524a95f05f4c0def70fa61a5f0717e9c

SHA1
6ee3b87e60e865d21bc1b5e434fea12fe262c315

SHA256
e17a7d9e0dcb1a3d6a21009f8d9b41fe1986312d79ffc6728c6c3f500dd6434f

SHA512
cc5e21ce182489416c906fb3f16e808554b739908916682cef6afe11a748b02382bfb93d1359cdc0794c2fb4b6f3cb9d9c677215a904be79d4b1df573de99089

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
5f4cdf4268be23a984ee0b2feaad3dd3

SHA1
cc5aabfc567971d7d2b7a0a206925a59de79dad5

SHA256
bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92

SHA512
41803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
c7872f08802f693ed9fc16ea960789f6

SHA1
b0b8e4dfbe1dc76e4903216948374e1356d33e53

SHA256
de5d1223ffd38be89cd576b0de036760f8a84c231eb97f1d7f74dfcf4b41fb19

SHA512
339520bea363a1ea34e75755c70f4b1f6a189e7084ca9d5c6189d769965ae1fd0b093b948dffe3d256dd82591bdb2b3627ed20e747a2505377babc34eb94a0e6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
6dee4281b2d0dc43c8eac5afde5dc5b2

SHA1
35584539f94fa4a91229b8d810f1d5c0207d9ef8

SHA256
b0fc60e07fa8fcfa0a174f1f5fc3a303d5498669eba846d51731494e9f86e46e

SHA512
de6a54e08c1a7c2a77a26f9de11a8e25b30f3d275fd4b72fb068ec3a5c0fd2072cc02a33b4581ba0dd565963bb834c5da831013d9ffb4386d0fc59935c184079

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
c5e0d596829abbf221a7e2fcc3f37059

SHA1
2a55fc6e9110d0bc5d735bd98e56241e416dd5eb

SHA256
9e3a04823e12f15954f1082ec019e29e1821d03db69fbaf9c906be28c8cf4fcf

SHA512
518a004482c590d87e104be80dcb12455379ac855a53bdfb94023041fac16e4806e4c78f28716f179031d62b21912cdf4be8b43b2a13747acc8e9a745dd6333b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
f344ea79294c175a3233be3c7bd4f7ab

SHA1
42f4d616f0b48828b629ffb384249edc76fea3a9

SHA256
36551c9271d084f31facbd342a0a0b5e530a2070e7de34c42ef2987633134b99

SHA512
dac1c65916fbca857dc8b5a0a3ef9c6abd5090e2c99ada98809d6cf04d09d4b9d63256e4a57754960476896ea46027cfb06bbb3ae68df573b207ca267d4efe94

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
34c97ccc6da86fa0fc6aca8102115683

SHA1
23c30d6f41bbfccb40d5209d70999384f3d59893

SHA256
205be42f8590a17ce1a0da594c818f84ef8cc19f8f54cd74acd16ddf7df11684

SHA512
7100e92fd948b75f7d134e813a836ce9691e6994f989b6d53255b17e3fca5be55cf69c50ef01e625a8f85a764bfafcf49bc5f82d229bf44168bf89b953c1642c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
83976f605267f63c512741c90085ef37

SHA1
e1907443ecf114b1b2d4b5fb622ca6fcba0d6b2c

SHA256
8e7bc240557c0f4058fb3380d01584eb5b9ad69ac5fd2f7a56bf2293dafd6069

SHA512
d5713af38add972fc04c1b1b7aca033532c50c31e8d1e3c0e889d69c94ff2d2ecdec95edabf4717a4bc649f2d68a5b1a77dac0355bf493eefe2cf86b7b53ba84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
055acbbed4580bb0c2b15ad8407f34c5

SHA1
cf7c3539d97090b33ea5cb7d4880dd1b28c259f3

SHA256
edb350193ce5ee7984cd11d446ee5848879e6447b08a6e9353a8310a1574bce7

SHA512
11e9e78b28e868781b355de473c157f4fbf1b8f30e3cae6f19aa895a456e7876827ff859ee4bc65215b73ed27eac67c139a1cfc887adee0f7fa1c2c446962311

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
89d1459c67621ae933ea973c36c86830

SHA1
7793109fad9c7d6e267046be6f188262d6655736

SHA256
faa59f14007729085711f504f3580b5d1f289d9d6b8a57ecaa6b7980d9b3b9e8

SHA512
95e333c1d28ba10df6e95e7bcf80fd1cd3fb7e32aa72b1749a4983c762fa227915d49547c5be114a471072d21a5f9c87c24bd6f45e8a711cbecc1074a3cefd7b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
a2ae01f60764eb9717c2e843bdd40c43

SHA1
f611b0f880d1dc52a5ff996b5106c8c0bdd7cf68

SHA256
9542302df51fad8c1095f6068378608b8edc89a633b30d26cae0e0fcb4515da3

SHA512
e12d3634bd8738865ea210775d78e53c5a30e74dca39655882c2464d1f9a1ac4a96a7608e57a92ff3b7b6a77750ab24ff12df59e5006b18c1f83cc270760bad5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
97fe80b8bc29698d3dd3912878d8a785

SHA1
580f290f32bf083f9485e06165fcc751ae181be0

SHA256
c382b8fe1abc83ebe97e66a3d4737ab66a7210a59fc0d18f9fc8b6735771b247

SHA512
08f56d8759721b0241d60a532e9634bc98aebcb7e7c251630adc1c93d28d40158a6f3bafc32f19cf9aa27ad5ba6e42f58bc2c8361e1ff97aa2ddf05c0147d248

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
2293c9a1af6be53ef61f8fc168e181d7

SHA1
f37155a592bcb1cbaeb67509b36797087d228b8b

SHA256
0b00898937e1f40415a42a8aa4dcf4ea396c40083abfe04fd141edcdd1d35600

SHA512
ac4c27db8296283292d06e0d152434f18a227c4d68294ef52ca473736458724df374f20ce88d214486d7027696d081203e92fb98c682e531071b9ae6d9703d22

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
b09754ee0b3048dc68584bfe0f631ea1

SHA1
87a2426414fdd52fc39679f6958379482ca3dde4

SHA256
9dcf2f8fba4c3bf4b194e3b27e5ef572e573a638d5c71e3ae4a154ddb62a91a7

SHA512
5d0d9b653184a41cff580683c16b4f67514bfa04987ee650c1d9ade4b12f5eb125fe44aa6e1a5e689423f62e755c460fc4886eac08c0e72fbd64fd9573212d4c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
7df1f9bf10766cba6f2b6d48e4dae8e3

SHA1
0008dbaa46d83ffe8d4a9d536a61a5109d74ca8d

SHA256
18827570bad9f879f6853438bcd0e379518531bafbfac2bb626dc1cc13711596

SHA512
bd8ee85d664c1480240e89c05d3639b5650aecb056263b75d7d37168bf6b6dada04145f42075e5ef0841efa9417880e8f9697e4ca71f20eaecfebd98e6b61f1c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
0973e0fe9cdbb5133b27568795b7bf6b

SHA1
eaf2af3b576cffe390ef11c38a594a0a5880aa1c

SHA256
5772740a636254ee2967ca17a83d4b1b13934a4c2db7725115f8754a762cc734

SHA512
1a2346c569266085abef030a235ca83bc1e3249bd090823757495c71332546c6fc3692233415df9168b609820a0bca2ee22d8064e49c9c2aaf7b707e4f52c285

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
eadeb006461520d14aa2578af902773a

SHA1
f0a23049c073b8bb189dc38dc3d38c4603862754

SHA256
fe1573ff17ffd86d793aa1dd9fd36109961850bea883d2d3e6d8d3baa3a2e468

SHA512
608cd2b73f0b95a7b57f1e23e9da70c663fef20412c6612b58af953061b8c42c25b24d234b380cc86a5dfc166f3018a48aac2f5659434bd038d8a74a252bdf15

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
1a4700d41421d915d26ea36073467527

SHA1
3c657523c891dbff19676f1d3b471bc7beaa59f5

SHA256
0a6f96613229ffc6beb1b36c73cb52be4d68346fd08adbb89e95814ffdc78c6d

SHA512
d62cdcfcdb721bb72892a09763f6c97edd0a0b37123a8605d846b8ef8d09938d8c99c49f574e29f590d6528738ac92b8ba8c31cf337408434caf14716e790d57

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
162af0ee7f6257765264df1ae5cedf19

SHA1
b25132643b3153c764ee9a9443cf2ae2fb476029

SHA256
982e2f99ab53b7325a3be510c50dfb01ffeed1bf2e291253c8ad9de6497b6c89

SHA512
8c615ab0942da4265238f16f0e71a5e095f07af654377d170370e885516b049a4505ec9e44f73f1ee70eca278da0d9affd4c4c3c660676134b634a995b4490c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
ca88ea1e6a8ee2379ea2c8459c2b99e5

SHA1
dcf468473aa7ece0f106ab34bd7ae633097153d4

SHA256
1e61386dff70de6dabc71ec5d13f8d77ae7e1ac7350f6cc7977603415f29c46a

SHA512
d51e59ceb1e99f771ae7f45c986f77f9471e120b27f777056fb12e3b6add87e2540b838cf86ff5fcb76794f4eb5d922c72410204baa5ca3635f4f6157efc20b0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
d5f0c3f6a7f33abb613146888add7e1d

SHA1
01864e305dd70fbbd5aabaf5b9fb71dd235591f6

SHA256
d25b66f475c67394eed4c51c498f9e20dee225c3aaa9427281a2148cc760f46d

SHA512
ee4ad7416408b6fa5d07ed6b964101002de68d2a6e5206bbf5044c5d1323f8f3950e0d229f41b7b4c5389ff68deb890e5db1c2fbdd04c56dd247efe0648bb514

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
a86027b5da426647253679150fe41c6d

SHA1
c5e06bdfc88a39b95e65ba9552c7204da5268564

SHA256
ab508539ad80b32dfeb2cbeb57ef31467f0a79ff095d2ff892c17e80356a60f9

SHA512
45217ac7e913175416a5a6e446c4081af401e361663e1e99409779a6f08040a4fe08b116056ab7d112f6d1a71f97a6d5e53f22f9d986754f98d177f79d72b773

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
ab288e21516f5001b120a6129e8c6b6e

SHA1
00e93428692465d5874ca879bae9fe4a61debbe6

SHA256
a3a74bc891e686c5350bb763b75717f00d34f9281f98081e49611419c999acf7

SHA512
9e89a37d34ae04678be70ef4b0e83886698e067fa578b4acfa13643557b31c718172defac1053ced3c2acff3def2bcaa9ed40fba65ccdd96f37e46098d975fdc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
16c9a02f38925a4ebed9c1d1ba95f61b

SHA1
41d4e6d32bdcda0fe7f3c58253f2c5032cac346c

SHA256
da28ac726626540f08c4c881af38844108e2f878890316f588f62239f88bdc68

SHA512
84b544954553e198a1328968ac2bc86a9757d14dd4c304a1b4a55825d1d5dc42952fbd44df6c1c5951d95d430bfde78e60f750902c985877c6a6640c1aa3ab34

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
532b88ef925118e43b4ed556c5fdfc3c

SHA1
5c4990ace3c1abd89802a4f5a06e4dd3aa1afa92

SHA256
a8fc095c422a0c0dbde18fcd8292402eff23371f79b4092fed0b7d3f2d4a382f

SHA512
f547a65a154b9ab942b185f3c9e4b55dd5771b6cc4442bdbb66487e47f1c631a987bfbb327b71a822b362ae5df5720549c1164e2e49825f4823ca7f3d5d6771b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
70d809ac0e74e6ae8ba2bfef150d6e30

SHA1
6d799af22f709cf7e1c0028fe994d27a17269130

SHA256
f2e9ce01e00117fabb74dafae001059b3c032263cbad7f9076f009da4a8abc1b

SHA512
927d7abdb298088953029fba117b095f26fccfd6c543201687e3a69b9c97ea90a657ee43d4f412fc633ff36ed80f4ac7b374763c7e61a222c76fd92e5cc66b72

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
3cc0c1a7cece41adc97fff2f3366877d

SHA1
897a222da884641f32e374494b7348dd55627167

SHA256
565c9e8b60039a24e5bec0810917e64f32da727954b723dfc0be1983a0340957

SHA512
2d6f495cd9cf6d0ecafa41c37480e60f1e2ae1507e152b235a0e274f9db940810482224768490b3fa1193a926268fcab08c2602ae3167476b03ac4600fca96ff

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
85c1fd04d1b0bc0fa1e00559aeedd14f

SHA1
21b8a901a08a748f5c6483ab364c13a9a9ee6d79

SHA256
e7f16fc0c9060aa39521d2bb7c5f74e634c71a0f95ce62c89e018d8d1578b977

SHA512
824bb0be9c46e5074467f091b5cdb6968d3aa989b598d294932b10f254b5f0b4230da2ed86c9723068fb997b39d06f0ac3c67f98c0969227cb602e57603e9bff

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
1f446af97cc5b43c506505e07b0abe61

SHA1
3ed4be38abb4953d288d082578465b5ce92854c1

SHA256
10f6fe80963da0b757bde9781073df370be9b97301524838eac167787621118d

SHA512
d3215d7b15f2994a01b339053d976c8ad561b5324a9dbb269a5ac4668af917ae45dfe1c110855555c7855cf1c74ca38ec989beed91bb1d465c4304d888d6acf9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
daa37ea0971c528fa497be4deb9e9e5c

SHA1
ea3678e1939b1d78271061937da64e7f91d690ce

SHA256
4e8dc4059e333ace71741fdd601e7420744e2f81bdf0dfccb7f8590d23622e3d

SHA512
7b9df2d7d0f607312e1a035cfb7848839ecd025f8fcb6b1e0b57c89c6e4f47c692db4b5669d384db15ef39e7726015cd5d7c608f16ca1f0d70461744c9492c3a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
f976b60c6877ac880bf2bad3f3d20774

SHA1
d02ce01289cd2bac6becd1835e55bc6e60327e0b

SHA256
4859b9cad6e9b4e95adb96158bd4837192aba0fb8535696a23f942ddd1d93e35

SHA512
fb9054e0328211deb69d4c4fb3d03f075d03c2e198c51bb4d09006c87747c1dfc81a39072d2a5e8ba7e47e7e19be866d95b2444e0ff693c01f8afcbf0fdd1bca

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
199c4123ef874bd42b54d0c49d0b08aa

SHA1
e16a3d629ce1fca181c35f5c2e16497bf54941ae

SHA256
a2c22b7f9b1901407068df3ddb049a58b70218559d4cdd944328b9c23d8e5500

SHA512
662c91ea89c9f8fe05458301040136ff6e22c345bd25833cf7bb3b61ffa97c37c19bf5dac7fe68c4b0527ff718e05cc0476438e55a44ce0ed3a78358aea967bd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
c0184213a10033245208238df3485522

SHA1
95690861b76477aefcdaf6026d9dd12332ccbfed

SHA256
cbdc3c2243fc61e0dd2f786330b9f3763d77bccb94ff69fe6a0b59c76efb0444

SHA512
b87c0894d6295147938b1f9d652427c8af77a345947038bc279ada7fe0ef7387e0d5af4c0eb1f0691a9e626d9562aec13aa1fab1568fd4bc6c9df3ce65857a61

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
92d4baaea4fb47acdda860eb6de1615e

SHA1
2ba501fa16637c299cc6666bb68d15f387cdc46e

SHA256
9d531c52ffe8c9655485c2d568cb81dafc2d0c7d9f8d0f05033a08263f123672

SHA512
a9a94782164f979ab946597f7cba8b2903466614b9645c97b54e19162256bc3bb0e2dc4deb4d42d954b474f66a3fcdaadf4339da8676453bdc379f28d6c1901e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
5cf8a74ce96a804ca12d121995ac1e28

SHA1
c37692154696e8bc3ca14c642b9517c39d9a23d6

SHA256
f894bbb95e81620ea6a298f26af27da6ee7ff4a69d9eccd09eb2094cc2948000

SHA512
d8770d30ce21df62013d94c705a7c9955c88508c8131a97d040e44bde1a6f02ae1d337c7f0633eaf2503ae879a5eda95bb5b7f161130ea88300c8765f816e55c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
8603e5be200d6c9412884423bf4bda49

SHA1
edb55f5dea1086e470bd279ad9221d981090551a

SHA256
f167b026326b379acbcd431992eb7fe4b1e260fdc3206194089b76f32d1a8c1b

SHA512
dec24a547d3ae77117a516db501ecd229b2caae1756338eaa48f5ba332a5d69df15db9c0cf2637974717afd6f0d0f974fc9e237737822a3d8b9ebf2f92a6d6f8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
e890fe81fbf16560a7cf5111f61dcd62

SHA1
aeb0e16937e6c13ac91aa3a0871c999460fffe93

SHA256
76e23a56819dc89bb675c96842bf347f212316604601e8f9fa7b4130f2133b73

SHA512
2b0311f41ef8c40e1fa284d1ac959ab8698a99de87f56827a91a3c055c58d242607cf597895ca01e8fb498d4356c676705dd3414f1757080d9929c667390d5df

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
291a4a3a7944bbe6b7effa7569df71fe

SHA1
9f0df015eaf5b3bc0187d8f93659391d1852c9aa

SHA256
67bf882ca9ba248b7d100786d216b88e620fcb084f9dcb47a1a85a89f68bd02c

SHA512
3081942d9a509047029892fa876e133381546760a47d1af873b47448d825312d035977dc5a530c567b77eaef15a6bbbef4bd294881cae974ff684e5beec49027

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
77945e4eaee1ca21874c0509d4624927

SHA1
5d2901d6c44ec892c2757dfc23f3e9087bf7fa94

SHA256
3a45c63213e38ae2cfaf3d82d7c03712d800df03b88d70428dfcfed63d4b3934

SHA512
4c38b84bc99dd2b6a6e3b0b5de1c4a0c09068f71f43ce55bb7117f8ec21da38bc6db28b00c7ad0f68e1b4de1b491676790aeffa43ebf8426ad0297240c8ebf51

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
6fa7d9c790f59c27f391233533527cdb

SHA1
f492be3c2b7926bbb7c6bbc9a5f8719092bc4a02

SHA256
5abfdfeb04cd338a4044ed3793d859c4a141ff10921f4237f7f6b20bd6348750

SHA512
ce5c495c1d335146da0dc03681116b61efa2cf55e5f12a017edb9580f612b20d664bd485d904f8c10221a24f7e2b8179882b42d6cb3f962102e64e0e6efd9155

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
b65763709b7a5de90af1b802a5a62cea

SHA1
edbabf86facd8d43f986b1ad06dca0dd96c1cb67

SHA256
82c5eab960fe46889bb06d43c93ee26cf0d35ccd94450f3adc5c649df370934a

SHA512
7d33218619c89aca98f88d8316f220a721679915899927811c954b8cadfc523a61abd355cb51664d15f9756a98a2b03812d7869dd14aa1fa085d415801aef532

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
62f816f0085895d3173eff90c3d8a14c

SHA1
09ef033da6ca507ece5b5bb6fd0d6b30822049b0

SHA256
6f26062440f96f8383cef676fbc6bb4408b6318a9db0e48da45aa72feb16b4b4

SHA512
207a1d72c334854ec27373cae88d003b402e4b3ae521adbaf197e7ee0840486b5bad19b5965b5c287a15e48b1fb963ad66d52c034f76f55a5e169bded0734c01

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
edaf793837d467ef353508878dd91096

SHA1
cf6c26f5f35bf53190342e9b63db4c643af52f66

SHA256
4975e122d6542883d7c789ab45c551b5f1fe20860dbe02115876386fe2c54690

SHA512
70146140452a0c3fa08e2aefc7d434c440646c999c2bb078c64eb4d0a9434f742b24ab62db9d20f4135e8e7d261fe242b4dadb9fd744b8f4b3a272d36a27a894

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
28c987583178962c2095745007e96930

SHA1
710d4940e450ebc7149e3a3b9939e2eec82a5a2d

SHA256
1480334117eaa344b31cd2ab57fe5ee024bb5f5217445f1f3e39d89a02135856

SHA512
b4ef9a572135ee1aa7f8cb5ef1d1a0c28f06623fe04decff5d0f9078cad19c2f3ede2a1316c9503409ff697307e0da6013d9c49cba6287d38a0b26e9fa8cb8ed

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
2e87aea208fc00d0b029b6b8ccba8a6f

SHA1
7ea15cc7fc3ad0f4b792dec9ba87ce1bcfffcbe3

SHA256
796e7de9da177c69c16c16c430a92209856dd3cfeaa3643a330ecd93a2a59334

SHA512
576da71b72aa680f1b5f3d1ba1c247415db8b7651a96831c970a258f9281c2019a73d5cb7a9d483a9e8c9c2ca0294398f615512b2a0939edda3f12540ea16990

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Meteorite\Meteorite.lnk

Filesize
2KB

MD5
593e13770234971cc73543c22dbb6002

SHA1
469bfa3dc1438d7c5761ae71cbc3ceecb3e47ff3

SHA256
9336216c2697abac351cea99bbbbc4cb38b9124d3ad44fd5dae8471915b682b5

SHA512
31260b7c0872e5c332eebb7d50d37c2fad28ce5d0081e7bbee0cd5623d92edffca13a7a7947edda0207b08da16674762f0ea5ccf96d360c710f9b2825ee32293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bb3093ca465d0d5a8d18853752ff9cc

SHA1
a5cf676a7dd96747b9b2d0a5d5f11ce47b27d107

SHA256
1964c1917b268d2f9ead1ab9c444aa49cee6994d7bc5b36817ca6d564892b2ce

SHA512
85bd57f413d412c4847d62e01bbfb88b5db701c142d5c929aebd19b69fb0b809791119b5f3c677bfc50287277a47c99480397bc89df11d9bc94d9f4449e67636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f05d648008b96f6d4c20c2d38aa40e06

SHA1
071914cc45f0cc66da6e184cc9dc476668247e22

SHA256
f94614bee73a6263d6f9754148c6d4d50aae5cbca41c0a14b3dbe6f729aa23e8

SHA512
d2e90eaf5d86dc49a90589f36df63b7c964f13b7672eceda7948f3df3ceae4f54b30670e74177e47515fc09bb3ca0a7344069a89128204c66d6eabb5cd0e92a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa32ce6016ca4bda350d6b948c628714

SHA1
e665fd61ef73d55194549779c9550b8203b6b271

SHA256
f077bd77b4b444a0de5b423877cb67a27078316a075b0866f601027b442d6598

SHA512
4bbca373df8b5bc53151e2d747cd6d240e9863121e7d075a594706b1fe75cc7a8923b455072ddffd12c92caff96b3723615f99efa65ce6af72bd6a5a8645769a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b83badc7dd1f217afb3f47bfa43156

SHA1
c44412b9ec1641d6b97f01f58152d2218a7e3da2

SHA256
2b48b20309a58077f508840e91fb3989db4abaa77ab4de41b1cb6b0adf93c05e

SHA512
3dedd797b1dc8be544bb56aee62fef0963e55a368d59dd253f880c327cdc88faac64334be1b264077a700dc1acfa2d8c89b8df2a75a0a9b7ea63a61511c0296e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8cfea9a6043b2e523e5e3cdf15d900b

SHA1
59e2a02f8059344758ec5ee80d355431ac32358b

SHA256
1c6e7f116dc82f2ca64a6e81691b4d758207e9283f1d2664a59cbc65a675e881

SHA512
5870f40351b77b43351dd1071b2775d6244ff7968c6b4cbbe6c63cd0de050e27012403260a2389d8c3c25d5358d115d35733316c939c5fc11f958f481a29ba0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF430.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5947.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF78D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSIDA1C.tmp

Filesize
1.5MB

MD5
20010aa88ea2ec4925b716e3f4f4f55a

SHA1
312dca92522fa6103126c58f41168042eebb6569

SHA256
6a5f64295602431d3ec6bd03565fc658d65b72091302c67e10f5647b013fcb24

SHA512
2e786c6027bb6d44a9811f74747b72849fe005c1c811598dff383b3b7025a12db995598efc9e13410c90ac50087e7425eb35af6b11f1d13895d80616a58d989f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0b241b759ba9a6a5e16644d39890fb25

SHA1
48924f79ac7100b6392950d8495d4d61e58c8bc7

SHA256
f3547ccd0f27793ae172048c63efa1e687f5695f869504c4ff7a8bb1b1330375

SHA512
99e08f76627d52e7c806137ec108e3e7e8f68be9fe338c0193b00b2b13c33589d4c955bafe29681ec654200b3ffcf540be01702e3c386475bb3613b46676cb12

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
128d56607027af22f7e73c30e24e1e96

SHA1
9b2e491325a3b1740ae75d50729e0aa0e6e2a3e9

SHA256
51ab0768ef49d831036750d2870fe862bec499ad237b139e9b878aa4fae6fa92

SHA512
3d18c414370ec3517d2aecc73000f5aaa9a2a29fb299e83e44da49993e305837d49350478b0242f96f49465aa954d026aa99b9ff02699b41cf4245e3effc23d4

Download Submit
\Program Files (x86)\Microsoft\Temp\EUDCD8.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
7bcf03ae20f6b4aab6efda45f6a0fa01

SHA1
6f1a63a994568c7cac224c6f44d41d19fe24a2e4

SHA256
23387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6

SHA512
615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b

Download Submit
\Program Files\Meteorite\Meteorite.exe

Filesize
9.7MB

MD5
e8bf1943d7fd5cc42d0ce20974d614ba

SHA1
cd805651b49f3bc040f382dc07062a36389d9fca

SHA256
7003c638a65b80257d88cc67d354e3fef6d9859943038322999df4531b842bd5

SHA512
41dc93a55b72f08a4f70ef5c32967799f7eaba120a3321ae8c0602357c94333ef68734f24a17601e5408e521848d2c3def5abc6310820f1febab2c0a2187b7f6

Download Submit
memory/1764-1218-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/1764-594-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/1764-593-0x00000000012E0000-0x0000000001315000-memory.dmp

Filesize
212KB

Download
memory/1764-1210-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/1860-596-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/1860-1207-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/1860-1193-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1212-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1216-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1148-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1190-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1220-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1194-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1199-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1204-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-597-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2164-1208-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2456-598-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2456-1149-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2636-1186-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2636-1146-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download
memory/2636-595-0x00000000741E0000-0x00000000743E7000-memory.dmp

Filesize
2.0MB

Download