Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
282s -
max time network
223s -
platform
windows7_x64 -
resource
win7-20240903-es -
resource tags
arch:x64arch:x86image:win7-20240903-eslocale:es-esos:windows7-x64systemwindows -
submitted
28/09/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
Eufonia-Client-windows-x86_64.msi
Resource
win7-20240903-es
Behavioral task
behavioral2
Sample
Eufonia-Client-windows-x86_64.msi
Resource
win10v2004-20240802-es
General
-
Target
Eufonia-Client-windows-x86_64.msi
-
Size
29.5MB
-
MD5
043c5c1502dc00487a1dfd99b62732b2
-
SHA1
67c284c5852bd2af91a55ec5d08f792de666e0bb
-
SHA256
bb55abbc7bb2f87fcf349d3483497c76f8c9fb2923fe54f9d8c662fdc57a8c5a
-
SHA512
8ae98e4bae3299095e9b3d668f5cea7155cc0eab471be6fbd278b15593fd79dda4de5ff45554ffeca5b5cfc0e8f4c6194acb55e12d18a2eeeb8596e4dbd8ed08
-
SSDEEP
786432:GVuXoaq7A/9YtfMYsdBV05XO7rNBGFwgNE9H6F1Ioy:GUXoaqmQzYKO7poFBk6Lc
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 MicrosoftEdgeUpdate.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\fa.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\nl.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_ur.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_sq.dll MSI40F8.tmp File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\msedgeupdate.dll MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\is.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Trust Protection Lists\Sigma\Advertising setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\dwritemin.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\eu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\hu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ca.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\ca-Es-VALENCIA.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\ug.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Trust Protection Lists\Mu\TransparentAdvertisers setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\MEIPreload\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\kk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Trust Protection Lists\Sigma\Advertising setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ar.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_ca-Es-VALENCIA.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_gd.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\pl.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\pa.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Extensions\external_extensions.json setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\EBWebView\x86\EmbeddedBrowserWebView.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ca-Es-VALENCIA.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Trust Protection Lists\Sigma\LICENSE setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\is.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\MicrosoftEdgeUpdateBroker.exe MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_da.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\BHO\ie_to_edge_stub.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\ms.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\ffmpeg.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\mip_protection_sdk.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\sr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ga.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\dual_engine_adapter_x64.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\identity_proxy\identity_helper.Sparse.Stable.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\es.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Trust Protection Lists\Mu\Entities setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\augloop_client.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\oneds.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\fil.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\nacl_irt_x86_64.nexe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\PdfPreview\PdfPreviewHandler.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\WidevineCdm\manifest.json setup.exe File created C:\Program Files\Eufonia Client\Uninstall Eufonia Client.lnk msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\EDGEMITMP_FAF48.tmp\SETUP.EX_ MicrosoftEdge_X64_109.0.1518.140.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\mr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Trust Protection Lists\Sigma\LICENSE setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\delegatedWebFeatures.sccd setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\mspdf.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\bs.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ka.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\sv.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\109.0.1518.140.manifest setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\pt-BR.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Trust Protection Lists\Sigma\Staging setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\109.0.1518.140\resources.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\bn-IN.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_mk.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\msedgeupdateres_pa.dll MSI40F8.tmp File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Locales\ne.pak setup.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\INF\volsnap.PNF DrvInst.exe File created C:\Windows\Installer\f773843.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI40F8.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f773840.msi msiexec.exe File opened for modification C:\Windows\Installer\{A0393CCF-BAE8-4D09-B7AC-F3BD958D09CA}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\f773841.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI392A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{A0393CCF-BAE8-4D09-B7AC-F3BD958D09CA}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\f773840.msi msiexec.exe File created C:\Windows\Installer\f773841.ipi msiexec.exe -
Executes dropped EXE 17 IoCs
pid Process 2212 MSI40F8.tmp 1688 MicrosoftEdgeUpdate.exe 2356 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 2668 MicrosoftEdgeUpdateComRegisterShell64.exe 1292 MicrosoftEdgeUpdateComRegisterShell64.exe 2556 MicrosoftEdgeUpdateComRegisterShell64.exe 2108 MicrosoftEdgeUpdate.exe 1180 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdate.exe 2812 MicrosoftEdgeUpdate.exe 780 MicrosoftEdge_X64_109.0.1518.140.exe 2416 setup.exe 1748 MicrosoftEdgeUpdate.exe 612 Eufonia Client.exe 1516 Eufonia Client.exe 952 Eufonia Client.exe -
Loads dropped DLL 47 IoCs
pid Process 2956 MsiExec.exe 1900 msiexec.exe 1900 msiexec.exe 1436 Process not Found 1436 Process not Found 1436 Process not Found 1436 Process not Found 2212 MSI40F8.tmp 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 2356 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 2668 MicrosoftEdgeUpdateComRegisterShell64.exe 1916 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 1292 MicrosoftEdgeUpdateComRegisterShell64.exe 1916 MicrosoftEdgeUpdate.exe 1916 MicrosoftEdgeUpdate.exe 2556 MicrosoftEdgeUpdateComRegisterShell64.exe 1916 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 2108 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1180 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdate.exe 1180 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdate.exe 2812 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdate.exe 780 MicrosoftEdge_X64_109.0.1518.140.exe 2416 setup.exe 2800 MicrosoftEdgeUpdate.exe 1748 MicrosoftEdgeUpdate.exe 1436 Process not Found 1436 Process not Found 2508 msiexec.exe 1436 Process not Found 1436 Process not Found 1436 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2508 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI40F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2812 MicrosoftEdgeUpdate.exe 1748 MicrosoftEdgeUpdate.exe 2108 MicrosoftEdgeUpdate.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\WpadNetworkName = "Red" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\WpadDecisionReason = "1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\WpadDecisionReason = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a\WpadDetectedUrl MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\WpadDecision = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a\WpadDecisionTime = c097ee8b9e11db01 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a\WpadDecisionReason = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a\WpadDecisionTime = 00dec7869e11db01 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\fe-49-2f-c0-cf-2a MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a\WpadDecisionTime = 806767dd9e11db01 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\63C768CF\LanguageList = 650073002d0045005300000065007300000065006e002d0055005300000065006e0000000000 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8319DA65-7341-4AE9-BEF4-D4D85D93C10B}\WpadDecisionTime = 6048a8819e11db01 MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-49-2f-c0-cf-2a MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31FB561A-CD57-4AF0-AE52-5652A86256B1}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\psmachine.dll" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\psmachine.dll" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCC3930A8EAB90D47BCA3FDB59D890AC\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCC3930A8EAB90D47BCA3FDB59D890AC\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{31FB561A-CD57-4AF0-AE52-5652A86256B1}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.19\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass" MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1900 msiexec.exe 1900 msiexec.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe 1688 MicrosoftEdgeUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeSecurityPrivilege 1900 msiexec.exe Token: SeCreateTokenPrivilege 2508 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2508 msiexec.exe Token: SeLockMemoryPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeMachineAccountPrivilege 2508 msiexec.exe Token: SeTcbPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 2508 msiexec.exe Token: SeTakeOwnershipPrivilege 2508 msiexec.exe Token: SeLoadDriverPrivilege 2508 msiexec.exe Token: SeSystemProfilePrivilege 2508 msiexec.exe Token: SeSystemtimePrivilege 2508 msiexec.exe Token: SeProfSingleProcessPrivilege 2508 msiexec.exe Token: SeIncBasePriorityPrivilege 2508 msiexec.exe Token: SeCreatePagefilePrivilege 2508 msiexec.exe Token: SeCreatePermanentPrivilege 2508 msiexec.exe Token: SeBackupPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 2508 msiexec.exe Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeDebugPrivilege 2508 msiexec.exe Token: SeAuditPrivilege 2508 msiexec.exe Token: SeSystemEnvironmentPrivilege 2508 msiexec.exe Token: SeChangeNotifyPrivilege 2508 msiexec.exe Token: SeRemoteShutdownPrivilege 2508 msiexec.exe Token: SeUndockPrivilege 2508 msiexec.exe Token: SeSyncAgentPrivilege 2508 msiexec.exe Token: SeEnableDelegationPrivilege 2508 msiexec.exe Token: SeManageVolumePrivilege 2508 msiexec.exe Token: SeImpersonatePrivilege 2508 msiexec.exe Token: SeCreateGlobalPrivilege 2508 msiexec.exe Token: SeCreateTokenPrivilege 2508 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2508 msiexec.exe Token: SeLockMemoryPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeMachineAccountPrivilege 2508 msiexec.exe Token: SeTcbPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 2508 msiexec.exe Token: SeTakeOwnershipPrivilege 2508 msiexec.exe Token: SeLoadDriverPrivilege 2508 msiexec.exe Token: SeSystemProfilePrivilege 2508 msiexec.exe Token: SeSystemtimePrivilege 2508 msiexec.exe Token: SeProfSingleProcessPrivilege 2508 msiexec.exe Token: SeIncBasePriorityPrivilege 2508 msiexec.exe Token: SeCreatePagefilePrivilege 2508 msiexec.exe Token: SeCreatePermanentPrivilege 2508 msiexec.exe Token: SeBackupPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 2508 msiexec.exe Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeDebugPrivilege 2508 msiexec.exe Token: SeAuditPrivilege 2508 msiexec.exe Token: SeSystemEnvironmentPrivilege 2508 msiexec.exe Token: SeChangeNotifyPrivilege 2508 msiexec.exe Token: SeRemoteShutdownPrivilege 2508 msiexec.exe Token: SeUndockPrivilege 2508 msiexec.exe Token: SeSyncAgentPrivilege 2508 msiexec.exe Token: SeEnableDelegationPrivilege 2508 msiexec.exe Token: SeManageVolumePrivilege 2508 msiexec.exe Token: SeImpersonatePrivilege 2508 msiexec.exe Token: SeCreateGlobalPrivilege 2508 msiexec.exe Token: SeCreateTokenPrivilege 2508 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2508 msiexec.exe 2508 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2956 1900 msiexec.exe 32 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 1900 wrote to memory of 2212 1900 msiexec.exe 37 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 2212 wrote to memory of 1688 2212 MSI40F8.tmp 38 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 2356 1688 MicrosoftEdgeUpdate.exe 39 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1688 wrote to memory of 1916 1688 MicrosoftEdgeUpdate.exe 40 PID 1916 wrote to memory of 2668 1916 MicrosoftEdgeUpdate.exe 41 PID 1916 wrote to memory of 2668 1916 MicrosoftEdgeUpdate.exe 41 PID 1916 wrote to memory of 2668 1916 MicrosoftEdgeUpdate.exe 41 PID 1916 wrote to memory of 2668 1916 MicrosoftEdgeUpdate.exe 41 PID 1916 wrote to memory of 1292 1916 MicrosoftEdgeUpdate.exe 42 PID 1916 wrote to memory of 1292 1916 MicrosoftEdgeUpdate.exe 42 PID 1916 wrote to memory of 1292 1916 MicrosoftEdgeUpdate.exe 42 PID 1916 wrote to memory of 1292 1916 MicrosoftEdgeUpdate.exe 42 PID 1916 wrote to memory of 2556 1916 MicrosoftEdgeUpdate.exe 43 PID 1916 wrote to memory of 2556 1916 MicrosoftEdgeUpdate.exe 43 PID 1916 wrote to memory of 2556 1916 MicrosoftEdgeUpdate.exe 43 PID 1916 wrote to memory of 2556 1916 MicrosoftEdgeUpdate.exe 43 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 2108 1688 MicrosoftEdgeUpdate.exe 44 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 1688 wrote to memory of 1180 1688 MicrosoftEdgeUpdate.exe 45 PID 2800 wrote to memory of 2812 2800 MicrosoftEdgeUpdate.exe 47 PID 2800 wrote to memory of 2812 2800 MicrosoftEdgeUpdate.exe 47 PID 2800 wrote to memory of 2812 2800 MicrosoftEdgeUpdate.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Eufonia-Client-windows-x86_64.msi1⤵
- Enumerates connected drives
- Loads dropped DLL
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2508 -
C:\Program Files\Eufonia Client\Eufonia Client.exe"C:\Program Files\Eufonia Client\Eufonia Client.exe"2⤵
- Executes dropped EXE
PID:612
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71A505C2B1C0491615851CB2D999C434 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Windows\Installer\MSI40F8.tmp"C:\Windows\Installer\MSI40F8.tmp" /silent /install2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU4116.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2356
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2668
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1292
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2556
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUU3M0Q2QTItQkI4NS00ODJDLTg1MDktNTI4Qzc3QzZCNjBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2RDRBODU0My1FQzgzLTQzQzItQkQyOS0yREY0RUJENDgxMDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjc2NTA2NDAwMCIgaW5zdGFsbF90aW1lX21zPSIyMzcxIi8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2108
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AE73D6A2-BB85-482C-8509-528C77C6B60E}" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2856
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000039C" "00000000000005D0"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2624
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUU3M0Q2QTItQkI4NS00ODJDLTg1MDktNTI4Qzc3QzZCNjBFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MkVGNDk2RjctNkY2My00MjAzLThDOTktODc0QzVFNEFERjY5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjIiIGRpc2tfdHlwZT0iMCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNSIgaW5zdGFsbGRhdGV0aW1lPSIxNzI1MzQwOTYwIiBvb2JlX2luc3RhbGxfdGltZT0iMTI4OTIwMjEyOTQ2Njk2NzY4Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTcxNzMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI3NjgwMjgwMDAiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:2812
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\MicrosoftEdge_X64_109.0.1518.140.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\EDGEMITMP_FAF48.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\EDGEMITMP_FAF48.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F070AD33-723B-4038-9F60-D201BB72F20C}\MicrosoftEdge_X64_109.0.1518.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:2416
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUU3M0Q2QTItQkI4NS00ODJDLTg1MDktNTI4Qzc3QzZCNjBFfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBM0QwQ0JGNi1ERjE5LTQ0MDAtQjY4QS01Q0I4MENDM0FFNTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMiIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuMTUxOC4xNDAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjMxMjEzNjgwMDAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIzMTIxMzY4MDAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDE0NDg4NDAwMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMGM0MDg0ZjMtMWJlZC00MjQ2LWI4ZWQtMjA2Y2NiZTYwZTNjP1AxPTE3MjgxMjk4NzQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TU1VSmE3UTJkNXpLM2RnRGd6VkclMmZDb1V0SkJGYjM5JTJiZmolMmZzdGZTNjNMVzNZQ2RTcG8lMmY0Q21GZWVqT1M4azRoSjhQNUtyUiUyYnlCTjhVencwNmhDTEdRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTQwNjk2MDA4IiB0b3RhbD0iMTQwNjk2MDA4IiBkb3dubG9hZF90aW1lX21zPSIxMDA3OTEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0MTQ1MDQwMDAwIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDE1OTIzNjAwMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDI0MzMyMDAwMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjYzMTgiIGRvd25sb2FkX3RpbWVfbXM9IjEwMjM1MSIgZG93bmxvYWRlZD0iMTQwNjk2MDA4IiB0b3RhbD0iMTQwNjk2MDA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI4NDA4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
PID:1748
-
-
C:\Program Files\Eufonia Client\Eufonia Client.exe"C:\Program Files\Eufonia Client\Eufonia Client.exe"1⤵
- Executes dropped EXE
PID:1516
-
C:\Program Files\Eufonia Client\Eufonia Client.exe"C:\Program Files\Eufonia Client\Eufonia Client.exe"1⤵
- Executes dropped EXE
PID:952
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Privilege Escalation
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD51b31afe033284cfde4994e9a340e3a70
SHA1a1da41fa9a7ac98c69e647c0066b57b3e4532594
SHA256632638a402309be97ed510a7d1854a212b3887e757ae58da3e752467085e0990
SHA512c80405d6d988a6162257f48b7c13b85d9f8ef2efeaf865108c1c72cf955b6e0c01840346965871fdd2587d1e00c9514bae10ef3563cafbcbce17f6f79d4680dc
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Installer\msedge_7z.data
Filesize3KB
MD5bd70ed26e6e6f3193043ac09c58c6a1c
SHA1d733a65e17f2851d5116598dd80533efc1656468
SHA2567a474217d20b9a6fe3c3a46c0d6d5b2d2040fa790663f6da9202ee7cb07bb448
SHA5123e2ecade6d687b0736d5eafd7527b24095b9c51f0c8ba99398b23da2d8843c49fc8c1fa37190d385b504d8224c8c517d78d44ae32e10e45d54b19477a6970756
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2416_1087781500\109.0.1518.140\Installer\setup.exe
Filesize3.8MB
MD53a92a61a6e01c80ecc7d9499abb901b7
SHA1d89d05802d937f9c71ced14282b8a19623fca7c8
SHA256b70b2ed82c7afde8003983992b74f8182f55080b43da3d96dd29e8c0c7e8b47e
SHA5123867efbd984ddd1eec084c70a42104cbc0057c3bed222af8963051779b612b46bf4cea3311452f6564513d7558d49a1e66a9473ad53f1b2fb4c43a9d7d0fb47d
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
182KB
MD53a6b04122205ec351f8fbef3e20f65c4
SHA1ba2e989a1f1963652405b632f5020e972da76a8c
SHA2567ba65317643fbc0d03195bdeeba318732823a91ef27f62483d5fc0ed3fea4912
SHA5122a0dbc91e79c42bf934ce7ab41ff6ed900322706bb71ffa1f3ade4ad85e0e1de2fa31540e1f1e0e979ad749c84343563ebe341585965f2f3a62debd6b4ab0cb0
-
Filesize
215KB
MD51d35f02c24d817cd9ae2b9bd75a4c135
SHA18e9a8fe8ca927f2b40f751f2f2b1e206f1d0905f
SHA2560abf4f0fe0033a56ebdaff875b63cc083fd9c8628d2fb2ab5826d3c0c687b262
SHA51217d8582c96b22372a6e1a925ccc75531f9bab75ebe651a513774a02021801d38e8f49b4e9679a9dfc53ccc29193fed18ab2e2935b9b7423605e63501028240e9
-
Filesize
262KB
MD5e468fe744cbaebc00b08578f6c71fbc0
SHA12ae65aadb9ab82d190bdcb080e00ff9414e3c933
SHA2567c75c35f4222e83088de98ba25595eb76013450fc959d7feefcab592d1c9839f
SHA512184a6f2378463c3ccc0f491f4a12d6cac38b10a916c8525a27acd91f681eb8fb0be956fc4bdb99e5a6c7b76f871069f939c996e93a68ff0a6c305195a6049276
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.1MB
MD5b0da0a3975239134c6454035e5c3ed79
SHA1fbea5c89ef828564f3d3640d38b8a9662c5260e6
SHA256c590d1af571d75d85cfe6cb3d1aa0808c702bcefd1b74b93ea423676859fb8ba
SHA5125fbfa431a855d634bcbef4c54e5cc62b6435629305efee11559f66473c427ad0775c09364d37aaa7a4a8a963800886f6547a52ae680a1ff2c4dcc52c87d994bb
-
Filesize
29KB
MD5c54dfe1257b6b4e1c6b65dabf464c9fa
SHA1aef273340160af0470321e36e9c89e1a858e9d39
SHA2560c426d4d48efff328a0da5497af24e83892a2ed1d6397a6dc42f9548a24dbff5
SHA51258ae24dfc6045ce1f8ed782a03cb3d02c10b99a2992b9326711fb8700c8e7d05cfbca21e9b47cb4b1f4f806a9bb7667672026c715aad2f175febb6ba2b5f95db
-
Filesize
24KB
MD5ccdf8ae84e25f2df4df2c9dd61b94461
SHA164cd90b95a17d9ecf2a44afc0d83730b263ba5fe
SHA256816c64b37e4c42cd418d05bc34a64e9c4acb4ce08b2a18ac5484374ca7b76e76
SHA512242a8a93326d3a5ea1fd367ef6cc2b343f08f4ff68d88d91044d0ad7fce490f47524a6e57940991ff0893a590459e96c588944f2b115cee703413ca594046f7f
-
Filesize
26KB
MD53374d9bc4467dbdeaf50bbd5a26edcfa
SHA16d7bd73ad27148bad7488959d7ebea22b6805436
SHA2565c8a8755cc0b1213fb0d5b57e10a53702f2091479d3c058d0c756134e548c685
SHA512c0c02e54d7e0060b6ffa5bedf8d79cf4b40f77711680d2161b5186c5a8a10e521169dfa7ab6b8e4816c98e4aefd136f209a40c78104cb618c21105e095537719
-
Filesize
29KB
MD587e596d8f0ac9fbe2d3176665eeb68f3
SHA11c9364d55b4844cd250504abe30dcff9792ee576
SHA256c39669e004facfb0c500788747a4427fe26dcdb50ae695562e6e417f4eb190cd
SHA512ef3708632e19332ddf460e081f8444ff8b4ec483c6b3e57f386df66d5f62d222b1d3f9f3728928701a6e48720133133c43619858853585a7d70b7bd5d8cf847e
-
Filesize
29KB
MD5ace0925ded0a4507d82e6d32a77c50df
SHA1c760ff52c71de3080631120c6992dcd0ac4e37bd
SHA2568e3c517bfc5986310c35f30b9681d9c919a7d62e299014410132ddc2b41f00b3
SHA5128adec80e179f205d0571625c1a63a0188e6533adefd48691f2fc287a546c12249c2126e6958d1732fa8847492a8287723a0196fbc0f2b9af3c54e1ab418cc3e6
-
Filesize
29KB
MD5aeb3a05ce4eecdef3d23dbc0094fe21f
SHA1e2a5c49b4d0fddcad28649bd09d0cc7af4c0b2c8
SHA2566c874a312ae57b8b0deac8457a200fcfc90aceaaa252628701c92aa8b9a823e8
SHA5124a7fe6cf8300b394d7471d9a2d759ebed59690ce925270d6ceaa4e14ee06f01b67f8219559e9ec917477f4c5aae03329ae2c6e231f3fd41c645d02d26b29f367
-
Filesize
29KB
MD5afa21b2feee2831c5478e113ed814b76
SHA19e883c990a31b8cd0ed2f80f732f404386cc55d9
SHA256183bcae9e143b78d04c2ed83ab6cac8cbd82f1d2bcf7bbb2506886a3925ac556
SHA512294838c67f6d87fc3b4975c73d24e1c38173c8ad4a14c215945e9910ddc306e9deb0168f38661c85b5c77929fcbf56093f632a35c1b39181203fbd662d71f7f8
-
Filesize
29KB
MD58e0ff856270ca13f8c07825e39ae3613
SHA1b351f8ae0cc13d97d201a268990b75fc9e6cd422
SHA25618cd8ed69df17e1bcb517285caa88c8a73e093984fecbea2587e7144a8812a73
SHA51225f3821c20aa222a28143951c9f370d3feceaf41e449f718640dce9af0e88e518bc40d2d02f5e64148d8909feedcfa6a8caf65a87ad12637a8bc13c848b1f178
-
Filesize
29KB
MD59f4c9469ef1930ec3ca02ea3b305e963
SHA1e588ffdf150b55bb4ba38e2aaf175aaf6e1826d0
SHA256fef14de38a4501cf538c89ca2d1ec389031124f69df9090df94fb4461e54ad58
SHA512c166189ad76cb395a2aeea724f2088f42dd4d361518856166fb92b3335b8fc670e99eb7b1c4c9ac2c872c8283826cc2c88009bd975e690efbcc3d99289557e96
-
Filesize
30KB
MD52e9132ee071ca5653baf90b9b1ea382e
SHA18a0c1e5a0df6432c50539d68caf697b8adaf1556
SHA256adf6e6542f1422c431ef92a209886224fbb53b5c67e68ac070d5c8a4c6ee569a
SHA5120b021758117109e4414c7ef37356106a96b68536ade8d3f1d1fb3dfce7c1132ab6fe02f7292ed225c09814a9c57124f731fd35069d220760678eab565f320976
-
Filesize
30KB
MD5917c18cfa84c8b8e83d8321f03be093b
SHA1c0a4a743f4059183724fc8c26e84b5a80bb2f7f0
SHA2566c56355b232c3bd35f397f99648c020733ea2d57db1cd4beafffcd962b896ae4
SHA51203359c6104e9f0cb2d66b6f1bf5598b2bb00d9e7a62fbd0c5475ca67b5194e96c2e6053a2a1c22323ba0002c614caab0477597fd34b57dd1f5acdb19f70c0854
-
Filesize
28KB
MD58b49a989a56d4a5aabd0a03f179ed92e
SHA1ca2f84217c867eb853830e95c7717ce35bd997f9
SHA256849e23c2f53d06462bd0f38e9d7c98e9389486f526a90c461c04c0aa1db7b7be
SHA512f4861ab9200db234550cd2e355ce200b7746c614e9c326287c0509d152f29d41d7a056e4fd27e3150cb433cd0234c4ae1cbc0c3a8b5892ecb3e8d4632a985aa7
-
Filesize
28KB
MD51146f59b139b9d810996a1bae978f214
SHA1cc9d54e6e3ce1efc4ef851eba35222547b996937
SHA2567b5ce6c7fa03e69a93694fa59c61be88b3eb8cd8951790f3bdd7cba2d99e6b83
SHA5120c94943646b0a08662eda2d236b7c88ecec0745faff5b9c6097f68e73a20059f8d2de47a9c00e58c6d2083331a34a0fa19b0964f3c62a6b8cfa02bc1e283e75a
-
Filesize
29KB
MD508fb61cf492ccd1236907af7a6b1bd4b
SHA19f6e0f7610d42f8a402d3adb7b66374f4d0f3cb5
SHA256d6261d4bd9ce4011caee1e0efefb5685a5bb5e29130ad8639e4578fc90027631
SHA512747982680ebc9e3c0993a69923c94382df6bfc113ebb76d31f65f9d824abef1a051a4e351f0f42296fd84e7663fc3bcc784da51dbce0554c3a880ac2258aa16c
-
Filesize
31KB
MD5970e46bfaca8f697e490e8c98a6f4174
SHA12bc396e8f49324dee9eb8cc49cdb61f5313130d9
SHA256eeff2c2487c6456e6a3ed43fe5fbb9d3b72e301d3e23867b5d64f5941eb36dcb
SHA512789f29ee2c34d86da5c69225bb8b2fd96273c20146126c28d3d36a880bbda5b16ace479ce59aafdf645328255105133f489278023e63e04e9fa1fb34cc1f3ae1
-
Filesize
31KB
MD53d22a75afd81e507e133fe2d97388f2e
SHA1f7f68cb6867d8c6386438d5a6e26539be493505b
SHA256823fe6edc1fb0ebdfb8ebbaa2d36f6dc0424c8f26b6594a390ae0eaafd319ab0
SHA51234a62ebe8d057a6f6e6f6b2672ebb95d4d7c49e739f4beee4bbfb5e917b7176aba4d70b0e84bd727c967d0885c08264dfb42371fe0d3fe4f8f12dbb1e26ca69a
-
Filesize
27KB
MD5fe685e8edec8a3b3c16e7954b787e118
SHA1ac71544158bf86d357d78d003f5ff2b4b5fd4ef3
SHA2564b60ce6e3c8f725ad8e88cd0d0a3f0155a7145915670a532fe1143fb2dfbf49e
SHA512e30d12a607d1c6fd2060ab38f443af680f8c8655900b0a21f3f0b488033f9300915667bdfa59ff4fd3488f58ac52c7f5598ff5078bf849bd177d1d8c10533f04
-
Filesize
27KB
MD5be845ba29484bdc95909f5253192c774
SHA170e17729024ab1e13328ac9821d495de1ac7d752
SHA25628414cd85efe921a07537f8c84c0a98a2a85fdbd5dfa3141e722ed7b433d0a96
SHA5122800ec29ece429151c4cd463c5042492ac24e82b4999a323607d142a6e1a08cb69258190a6722afbbcfb3c9cdc6eebdedf89ee6549e0f420f6fbae3aa0501fd4
-
Filesize
29KB
MD5dc8fcfbcd75867bae9dc28246afc9597
SHA18fd9361636303543044b2918811dbdab8c55866c
SHA2563deb382ffdfbd2d96ff344ec4339f13703074f533241f98f0ccd8d3f8c98f4bd
SHA512ac8fbf033677a6862f3d02cf93bf1838c24f006b40fd44336ae13ecc2287ae4c733cc3d601e39556586131e8a9e2d930814399ac68165a26458a6cbf51b11d32
-
Filesize
29KB
MD59c0ef804e605832ba0728540b73558a7
SHA1a305f6b43a3226120d3010ca8c77441f6a769131
SHA256626835e07c1fc4ab670127682f3e5225881a2d4ddea873c5271e9032668fa641
SHA512c27a4b24600bdd33a4f9430e8d4d8f7f3718efcaf2d1ec36023e34b996817af79b5a9baeea1506f97d2716c9b2b5509bbc1bf4d7cab779554eebadaa8c942dfe
-
Filesize
28KB
MD5111118683f6e8ed7ceb11166378aebb0
SHA1fd3e1cf198885ab5d9082d540d58f983d8a0f5ff
SHA2565cc4930c50716138e25987baacb9a9aed7d30ff5c0ac927e35f7fc006f5179c4
SHA512cc3480f05d8d59d3d705204e15ff6453a6d9c77bdb1011d069bb1f83b3d4e14204f19caa7e7ecbb6e3ed92d429ac46940791903440fbfeca2f7e7e12b9a47f6c
-
Filesize
29KB
MD5c0da1ad8854f64b7988d70c9db199d5f
SHA1b184335283bf0026615f2a4a120fda87961c774b
SHA25673190820d59e5bfe769b82ada48b0c9ed353524bd5cab303f5175d7d9bbb74ee
SHA512424ef2d0ceaba76b64c3349ec1ff5088cb8aff9103fb38da238c80e6452a967f3dca09860b2b8fe9c01e20bebadc539960a5bc241a91bab98bfedf29c2f777ea
-
Filesize
28KB
MD5c4cb44ee190c5aa8dd7749659437e5cc
SHA1667f4aa01a4262fff2e01838f94330c0ebc285a2
SHA256dc184d54d00d51d2f8de623c0c4b07e9408f7b02e1f1085107edaf14dcbee136
SHA5120330d733e89811c4a89deb202ec517de3128ad266483f37bd8d91eb6e45336febf7297da4f3465c683ed1b6e08114d6a3f52ff74484276509b9816ae7dccbb10
-
Filesize
28KB
MD5a9b037f7bc8f5b382bf6c69b993dbeb1
SHA17beb733f3561ac3083a3dfca3b7644c5154e1330
SHA256b498d1b38a81199b62a98a0e36aa9e955e1c0143436908538314089c0e59d128
SHA512a63c1e1a4d8d2e5043e0cdc420d1c545b0adbcdaa1a65f09454d47cc9642c1ffcb16e76454e90c75fd88f29917024b11418a606acbd560a98b79cd8631186332
-
Filesize
29KB
MD56b2319c3634103272f39fc71d7f95426
SHA1a1d692a68c5cbb70d29a197ec32c9529c15a0473
SHA25628c610ba7f8332be050c30e296acaee423bc0a7a9cacc7b3d60618e284ff9cfa
SHA51251738dd14b410c689ed56530ac555824c773bcb163f4dbaddc86e684e04c1f06271001f0b2bef7d6231f17231b2e3e35f9aba2974c48eff6d1a8ab877e5a6031
-
Filesize
30KB
MD58e1793233c6e05eeaf4fe3b0f0a4f67c
SHA197697fe9ba6b3cb5cfe87bb94587c724ed879c3b
SHA256b9caaa668b71964316ee15e6e49f8ae81e5ed167fdb69fc31bc6df834ab4e7a5
SHA5123d2fbf5e05e7b9e21c85ad7f59db9556046e4c1755f0b138d6de38eeadd3480e772e35798f9339aa7daffbf92afbc385f9c0bb4e4f5c65292dff3b280f52bd6f
-
Filesize
30KB
MD55e63ac4b5abe6c84f305898a0f9ba0bb
SHA1e70baf6f175c297a9b491272ce8f131ba781553c
SHA256711b5968d2116d7e97aa5852ec864db35d3c186f341fb024cd1ef4525256131a
SHA512c383e4df4337bf9a66f684dabd2faa95cb49abb424c76d0603f91af7b7260be5b2877246da293d5df83fdb59d291d63a7d73303c34682a50ea84a8fcd7d6e874
-
Filesize
29KB
MD5f7b123f6dd6c8d8832a8bb8b7831e42c
SHA17e9524b79036568b2b4446ee00c76460fb791c6d
SHA256119b9e288832f2a4d47d63b693bb195a72f27e9c0aa014b2c3ccd5d185f7afc7
SHA5126bd457d1e3f943a4ca5a1d36907fe526a4f2965a8411280a2988ef1d264203af0797365c1306e7ce103cabec2ead17d194f20848b4c665e986705c3ed6e291c9
-
Filesize
30KB
MD56de337fa9f131077042f7ce421a9fa42
SHA125e21b64cdf60a1da2f940b3c873eefd680a5fc9
SHA256263e07308785bd7e510eda95499ab3d3d66942f0bfd0a5722258e2a87b5d0a90
SHA512e747fc105c4ede0d4f73492e3757975a9410499caf867bc149cd43bdbf1be03d3df82fe04c7cf99e3ad6ee06fb5011fc5b069bd502c2f3b3e578f587d0362e3d
-
Filesize
29KB
MD5be03945025cc2f68f8edd4e1ca3c32b7
SHA1d4b1c83f6b72796377bfd3b42c55733eed8fc5e4
SHA256aa95c108db3582a4be98fe83519aab3fed09c8cc9b326469edb89871d6562373
SHA512a03656acfc123f06a071f0e326ce15bf17e2efe080fa276acd50cb40e35000d74a3d0762da327c59a7564bb3f03532bf04c733ae850852f62ce71fd513e9080a
-
Filesize
29KB
MD5951dfd4709b3fdbe79a6e43828387592
SHA10c7bbf1852135456692970639869618fb616ba5e
SHA25621c72dc48cd33291520e3f432d8d59ec103496ab6508f41fa1b081b3bdf98bb8
SHA512b338c345db00135ceb3577a67bcbc36b37be742e39aa6a333bac93ba20ab1463df55a381be95c9e9effaed4daa0ce93203ff2994459f9a23813dc0afdff03e8d
-
Filesize
29KB
MD56b97796e1746317567ed7cffe9441d3b
SHA1dd269b22021eb37fe854ff181a09bf7f9568f7ac
SHA256a4ce75f6b1de6a2500bfd6b0ebc1c268cb3d7080dc9e7661bedd9361f7215d42
SHA512f1856ac881de7acb7f61f2d7c1d064458855c3621fcfa951f1d1207f3d85fd6f64b26547ea1391c4145bdeee23e6611acb2fe80b8c1258dd108085e371d34d73
-
Filesize
29KB
MD58bbd58f9644187747407b0a18c60aa0a
SHA182888f3f2ce1dd7b9b3f5ac26bed0a6da5601dff
SHA25635008c4ea7f22ac78d28e72311d4b3fa28d6af24072fa94558a9b3771a4b545e
SHA5121fa7d62692062c1d22e3fe0e5c15bfbb2def115be2991001a998fcc6bbb5983d9343b06172e8f38b245587b15762b655ef58ec508160b576779963e5889efca8
-
Filesize
29KB
MD5e56f98d6b32f82f391d5b087a135a7ec
SHA1c8de62b4b22a8153cb788e03f7e04c55a5ae5396
SHA256236252a34d2efdb4e801bd827a791935aadfe6c0a471f1b252d9bf2d291a6bae
SHA51245b9933478505759e7217a65e3a054885841c5ae9bc58983c6cb216ea2a15c53f45ecfb6b40fee07d54c289819ddc2161a651e5183e244e0f43946176f224c8a
-
Filesize
28KB
MD55b5366c7779dc9ce9f3a15b6f22289ac
SHA1d9995fee337b9696be970a2a48a845ed71bd7d2b
SHA256da6d5c982387286396f54c043bacf106f78fc76db4a33984c8b2cb88882fc9b3
SHA51235362a3719833449bd9e757194f9b0b28c3d68a0c62f52d224b1cd5eca5a2343e1db868668e2b30d927a1966b5db5cd0b2230d7f4576627e486eb3a86913b195
-
Filesize
28KB
MD5b675cc1f6f5f174c265c0887d9591915
SHA1abb182cfbe1d5723ecc380c5fa08b24c1f421af1
SHA256c012110ad65f8244494ef2aa70696128a949fbc5797e5139afa7d4195457df1f
SHA512be1b23a563a2b4f6b658df3f8075d48bf3921c5951a6fbe77c24a0949997e068403f5bcaa3f93030b01d7a69b1aa74ce06f37038c30145e03a9822f4854f7c0d
-
Filesize
30KB
MD5b8b03be1e73e1ccc0df159c48e875038
SHA137d1b2216f1e90a69b1be65b2c4f0f5f35e78aef
SHA2564ee8f48af5136fb80f5d031395f92abb2b3571fdf7c4c98ae833c2ee74c49160
SHA512ef47c8c0f8aed7a4d912986e2a3fbc34b54fdea25b006bcb63d502a6cefc42bca717a93e16ff1c137892a91b894ea15d95a53dd3b52b850bf1a75ec9bd7b3013
-
Filesize
25KB
MD5dede65e2268976ded6f598ecea661025
SHA145c6fd614dac74eecf83709081b4f289c05271dd
SHA2569379736bb1b621367e42736d311288d33742a9e0ca3e056b4638491fc434a880
SHA51292a46ca5e3c40bf55fede64aecd7fd05f6419c645d38325546c46632775fe72cff4152e473ffbc15d478da62c76a088ebfb4db91b9a0691a9ce1c763ad3f9285
-
Filesize
24KB
MD5ffc1ff9f4cb8fcb529f8580d3b92a80c
SHA1d0ef21a7407c5eebe1fc21b6549c92c6222bf0cd
SHA256d508f613bbec62a237a5616959dbc292fe4a79adc8783fb91725f3f2c32658d2
SHA5126345362f03f3bc4409c1e5875b2e7cb58b5df9737c9c5502a19314046281e682a3ea7ac5adbbb933a130f52efad4da4eb9ad99ebfdd41bdba23d1fbea4180475
-
Filesize
29KB
MD5e802f3589731c88d166a8b0e3bae1dc7
SHA1b94e21b646c26053c19a0e6238f0e4fbde0a2fa6
SHA256173f78b786cd1a58a47ec9f7c662e403b191fa42cb7308aa7eb6b0f744bfae0b
SHA512ecf9eb33afb00c6839d6778e36685b904267e6f384a7d307230000a506e6ac6e95132c2f50a4cbe523d834dd6c7ecd1277d47b73188130e097a0b64c0ec64a51
-
Filesize
28KB
MD51c6f35c21ff0afb2f4aa9d4352fc86f2
SHA1d4bf67c14304add3e7d8218ff66a520a7b1e0a6e
SHA256779900e90b23d0443e0b93b4ac7c8fa24dd6a0ebddb36cd22bcd7a1a6fce2ecc
SHA512caf80f4adab14a81bb14e36683772539a6789448ddfcaba2a09e5c6c3e2dae105ce436ca7dd7b412c6c73dcc0768141822b13064d452a48a37721e1e9dd357f2
-
Filesize
15KB
MD5823201b3a73158f3be6d4b52bed4a43e
SHA1fa2dad8cdac55340c9761bf57df83d563fb07b15
SHA256c40ce6efdd8b37ba72ff204614c64e692ff9c2918ad169d764e6fa90ea23e17b
SHA5121d0067deeb642a4fc7bc15af02ab1f4132f46daf1fe8a5882c0cf26a324118c4b4ef95f73d895c3ad65723d089509a11fdd4f613ea1abea04b3561528a3326d3
-
Filesize
2KB
MD5c83255d709ad66dda2acd3802ec92d85
SHA1c000967ba8f3f01090eeb62b8bc8d8d37f9178e6
SHA2568d2920d30a601386c912ba03445c59bf9233eb58bd8c066cfba88e130bf30bee
SHA5122ca999cddd5c778375963d185f99d343fb33d594f58c747999c81b8072b1401bd5a7b116ba982be9d170ec762645a09b6c3601649a23cb802bbed07e0536dd3f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
132KB
MD5cfbb8568bd3711a97e6124c56fcfa8d9
SHA1d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA2567f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
SHA512860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.6MB
MD5d2ebd82a5d3fac11d44d90d8df253bb9
SHA1ba94b456e111ea9573fe150ad4090a66540c9938
SHA25604b65aa7b23d0c7ebbd6e022a600fbc43c0ee896ed280e48ac59e17fb0a2311d
SHA51249e9ef8066200cd6ec079943c1fbcda95cab2d3042f635ed57949e0c0701ecdf34ea8f16324994dc77bc3ec9fc67882ea88b4d543974e90bf4e8cf69b15e073c
-
Filesize
29.5MB
MD5043c5c1502dc00487a1dfd99b62732b2
SHA167c284c5852bd2af91a55ec5d08f792de666e0bb
SHA256bb55abbc7bb2f87fcf349d3483497c76f8c9fb2923fe54f9d8c662fdc57a8c5a
SHA5128ae98e4bae3299095e9b3d668f5cea7155cc0eab471be6fbd278b15593fd79dda4de5ff45554ffeca5b5cfc0e8f4c6194acb55e12d18a2eeeb8596e4dbd8ed08
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5213e7c04568fffa4fa366ba911017a05
SHA1270ca2df15edcb76586f9559ef0e43fd7d590353
SHA256b4f7e03cbdd05c37db3bc2104c1a4d4c04e647117d463bef9d5daac3c37e1d13
SHA512a515ab539f1ffcbbe67a56b9ff169687e7caa91635e2ac042ad7c677c8d97aff7249f36874b996a399bf19d7d76c7769b0094698b478e7a62739be3119abd7ed
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e95819a110d0fc7152d8172fc3eadf63
SHA19300c5e16519632fea54a2efe96f5ee02f6078eb
SHA256c50e57d5c33138ffae92ccfdd8196e7abd1708a6a6ccc6c02ffa33e304a6e91e
SHA512b3742ba41b425bcf1e7b3e43934d4b32e141228598050527aafcd38335bd2b183a1ac8a1440292047fbc8fd7f2504efcc59be4bbb326263d3587447d811613fa
-
C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF
Filesize5KB
MD55e961b1e105c3b3e61e882a553bf5355
SHA1a5410576b80da1982c64fd9bb81b85f6bc7cd12d
SHA2561b68210cf77bbf95273c182120e0e38bc6750b361a5c2725319afb753dcfc0d1
SHA512943d43bb77968c9d1df98076ec4a344c01596b2ae7771ce37dd10389ff96eadca91412106f404da5b54fb345d6e0e845259c8cec4537ff4d23c46a5a4e8d756a
-
Filesize
201KB
MD5b0d94ffd264b31a419e84a9b027d926b
SHA14c36217abe4aebe9844256bf6b0354bb2c1ba739
SHA256f471d9ff608fe58da68a49af83a7fd9a3d6bf5a5757d340f7b8224b6cd8bddf6
SHA512d68737f1d87b9aa410d13b494c1817d5391e8f098d1cdf7b672f57713b289268a2d1e532f2fc7fec44339444205affb996e32b23c3162e2a539984be05bb20c4
-
Filesize
19.6MB
MD5512eb5eecb735f0034af47fd30d781dc
SHA10bbc6d5af0d6a11ca8c8e5d0de5a6b281753e4e8
SHA25688dd70052263e4152c5415961efd5ecb114e5d6924b554778a33c0861da21d42
SHA512f564c313ec71d4885f705410718a3f66e722558e7cf8d5d7130d2acd8607e00a63e1d810bc17df9df3da717a63f658996e2a9bc4623bf6a3d9fa85bd7d443828