a0aff6fc1f0652edfa85588bcadb07f5cf680db0bc0ff296be38d4cbc8808858

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MuAwaY-Installer-v3.0.0.exe
Size

34.8MB
MD5

b84db19ca98435faee1fa53afdcd7674
SHA1

5822af253f7f20c4aa5025b183b439b20d21ce0f
SHA256

a0aff6fc1f0652edfa85588bcadb07f5cf680db0bc0ff296be38d4cbc8808858
SHA512

993110c6e658e2b2ab0ba2b465ac44c15f1eb32b4c7fc70b6ff53aff9c2c9b2623e2ae2fdae3a2cffdfb6f7d56578b0c1d9c07563f59416d02d44e4b596e4003
SSDEEP

786432:TR0XUsszCKkvvrcM6mK3uTULGXo27WYTu34hCyPRWTBE24Ff21s3:TR0rszCKkXAMRKmUL32du7kMlIiY

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	VC_redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2388	MuAwaY-Installer-v3.0.0.tmp
2384	microsoftedgewebview2setup.exe
2712	MicrosoftEdgeUpdate.exe
4252	MicrosoftEdgeUpdate.exe
1276	MicrosoftEdgeUpdate.exe
756	MicrosoftEdgeUpdateComRegisterShell64.exe
1192	MicrosoftEdgeUpdateComRegisterShell64.exe
404	MicrosoftEdgeUpdateComRegisterShell64.exe
1764	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
1940	MicrosoftEdgeUpdate.exe
2908	MicrosoftEdgeUpdate.exe
3188	MicrosoftEdge_X64_129.0.2792.79.exe
1036	setup.exe
4392	setup.exe
1748	MicrosoftEdgeUpdate.exe
4120	VC_redist.x86.exe
4836	VC_redist.x86.exe
4692	VC_redist.x86.exe
3848	VC_redist.x64.exe
2284	VC_redist.x64.exe
4788	VC_redist.x64.exe

Loads dropped DLL 20 IoCs

pid	Process
2712	MicrosoftEdgeUpdate.exe
4252	MicrosoftEdgeUpdate.exe
1276	MicrosoftEdgeUpdate.exe
756	MicrosoftEdgeUpdateComRegisterShell64.exe
1276	MicrosoftEdgeUpdate.exe
1192	MicrosoftEdgeUpdateComRegisterShell64.exe
1276	MicrosoftEdgeUpdate.exe
404	MicrosoftEdgeUpdateComRegisterShell64.exe
1276	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
1940	MicrosoftEdgeUpdate.exe
1940	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
2908	MicrosoftEdgeUpdate.exe
1748	MicrosoftEdgeUpdate.exe
4836	VC_redist.x86.exe
4276	VC_redist.x86.exe
2284	VC_redist.x64.exe
4144	VC_redist.x64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{47109d57-d746-4f8b-9618-ed6a17cc922b} = "\"C:\\ProgramData\\Package Cache\\{47109d57-d746-4f8b-9618-ed6a17cc922b}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_mt.dll	microsoftedgewebview2setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\msvcp140_codecvt_ids.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\mr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\edge_feedback\camera_mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\identity_proxy\win10\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\fa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\edge_game_assist\EdgeGameAssist_1.0.2788.0_x64.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\cookie_exporter.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\webview2_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ka.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\nb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\mip_core.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\vcruntime140_1.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\mi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\msedge_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\mt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\lo.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_km.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\kk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\delegatedWebFeatures.sccd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe	MicrosoftEdge_X64_129.0.2792.79.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\msedge_pwa_launcher.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\msedge_elf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\msedge_pwa_launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\ca.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\fi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\da.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\Locales\en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\psuser.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\fr-CA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_zh-TW.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_az.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Trust Protection Lists\Sigma\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\sv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_hr.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_pl.dll	microsoftedgewebview2setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\fil.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\or.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\129.0.2792.79\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdateSetup.exe	microsoftedgewebview2setup.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59530a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6935.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e595333.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5645.tmp	msiexec.exe
File created	C:\Windows\Installer\e595309.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595320.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F71.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59530a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File created	C:\Windows\Installer\e595332.msi	msiexec.exe
File created	C:\Windows\Installer\e595333.msi	msiexec.exe
File created	C:\Windows\Installer\e595348.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI549E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A3E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5952f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5952f8.msi	msiexec.exe
File created	C:\Windows\Installer\e59531f.msi	msiexec.exe
File created	C:\Windows\Installer\e595320.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0C3457A0-3DCE-4A33-BEF0-9B528C557771}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D3D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuAwaY-Installer-v3.0.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuAwaY-Installer-v3.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgewebview2setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1748	MicrosoftEdgeUpdate.exe
1764	MicrosoftEdgeUpdate.exe
2908	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A7543C0ECD333A4EB0FB925C8557717\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\899C6AE5CA5D9DE4983CF9521BC7DCD3\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.45\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDAE441E-F0FD-4C2A-8BF7-1451FCDFAE16}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\899C6AE5CA5D9DE4983CF9521BC7DCD3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDAE441E-F0FD-4C2A-8BF7-1451FCDFAE16}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2388	MuAwaY-Installer-v3.0.0.tmp
2388	MuAwaY-Installer-v3.0.0.tmp
2712	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
2712	MicrosoftEdgeUpdate.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2712	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	5004	vssvc.exe
Token: SeRestorePrivilege	5004	vssvc.exe
Token: SeAuditPrivilege	5004	vssvc.exe
Token: SeShutdownPrivilege	4692	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4692	VC_redist.x86.exe
Token: SeSecurityPrivilege	668	msiexec.exe
Token: SeCreateTokenPrivilege	4692	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	4692	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	4692	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4692	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	4692	VC_redist.x86.exe
Token: SeTcbPrivilege	4692	VC_redist.x86.exe
Token: SeSecurityPrivilege	4692	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	4692	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	4692	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	4692	VC_redist.x86.exe
Token: SeSystemtimePrivilege	4692	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	4692	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	4692	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	4692	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	4692	VC_redist.x86.exe
Token: SeBackupPrivilege	4692	VC_redist.x86.exe
Token: SeRestorePrivilege	4692	VC_redist.x86.exe
Token: SeShutdownPrivilege	4692	VC_redist.x86.exe
Token: SeDebugPrivilege	4692	VC_redist.x86.exe
Token: SeAuditPrivilege	4692	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	4692	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	4692	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	4692	VC_redist.x86.exe
Token: SeUndockPrivilege	4692	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	4692	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	4692	VC_redist.x86.exe
Token: SeManageVolumePrivilege	4692	VC_redist.x86.exe
Token: SeImpersonatePrivilege	4692	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	4692	VC_redist.x86.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeBackupPrivilege	3916	srtasks.exe
Token: SeRestorePrivilege	3916	srtasks.exe
Token: SeSecurityPrivilege	3916	srtasks.exe
Token: SeTakeOwnershipPrivilege	3916	srtasks.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe
Token: SeTakeOwnershipPrivilege	668	msiexec.exe
Token: SeRestorePrivilege	668	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	MuAwaY-Installer-v3.0.0.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2388	3448	MuAwaY-Installer-v3.0.0.exe	86
PID 3448 wrote to memory of 2388	3448	MuAwaY-Installer-v3.0.0.exe	86
PID 3448 wrote to memory of 2388	3448	MuAwaY-Installer-v3.0.0.exe	86
PID 2388 wrote to memory of 2384	2388	MuAwaY-Installer-v3.0.0.tmp	89
PID 2388 wrote to memory of 2384	2388	MuAwaY-Installer-v3.0.0.tmp	89
PID 2388 wrote to memory of 2384	2388	MuAwaY-Installer-v3.0.0.tmp	89
PID 2384 wrote to memory of 2712	2384	microsoftedgewebview2setup.exe	91
PID 2384 wrote to memory of 2712	2384	microsoftedgewebview2setup.exe	91
PID 2384 wrote to memory of 2712	2384	microsoftedgewebview2setup.exe	91
PID 2712 wrote to memory of 4252	2712	MicrosoftEdgeUpdate.exe	92
PID 2712 wrote to memory of 4252	2712	MicrosoftEdgeUpdate.exe	92
PID 2712 wrote to memory of 4252	2712	MicrosoftEdgeUpdate.exe	92
PID 2712 wrote to memory of 1276	2712	MicrosoftEdgeUpdate.exe	93
PID 2712 wrote to memory of 1276	2712	MicrosoftEdgeUpdate.exe	93
PID 2712 wrote to memory of 1276	2712	MicrosoftEdgeUpdate.exe	93
PID 1276 wrote to memory of 756	1276	MicrosoftEdgeUpdate.exe	94
PID 1276 wrote to memory of 756	1276	MicrosoftEdgeUpdate.exe	94
PID 1276 wrote to memory of 1192	1276	MicrosoftEdgeUpdate.exe	95
PID 1276 wrote to memory of 1192	1276	MicrosoftEdgeUpdate.exe	95
PID 1276 wrote to memory of 404	1276	MicrosoftEdgeUpdate.exe	96
PID 1276 wrote to memory of 404	1276	MicrosoftEdgeUpdate.exe	96
PID 2712 wrote to memory of 1764	2712	MicrosoftEdgeUpdate.exe	97
PID 2712 wrote to memory of 1764	2712	MicrosoftEdgeUpdate.exe	97
PID 2712 wrote to memory of 1764	2712	MicrosoftEdgeUpdate.exe	97
PID 2712 wrote to memory of 4424	2712	MicrosoftEdgeUpdate.exe	98
PID 2712 wrote to memory of 4424	2712	MicrosoftEdgeUpdate.exe	98
PID 2712 wrote to memory of 4424	2712	MicrosoftEdgeUpdate.exe	98
PID 1940 wrote to memory of 2908	1940	MicrosoftEdgeUpdate.exe	101
PID 1940 wrote to memory of 2908	1940	MicrosoftEdgeUpdate.exe	101
PID 1940 wrote to memory of 2908	1940	MicrosoftEdgeUpdate.exe	101
PID 1940 wrote to memory of 3188	1940	MicrosoftEdgeUpdate.exe	112
PID 1940 wrote to memory of 3188	1940	MicrosoftEdgeUpdate.exe	112
PID 3188 wrote to memory of 1036	3188	MicrosoftEdge_X64_129.0.2792.79.exe	113
PID 3188 wrote to memory of 1036	3188	MicrosoftEdge_X64_129.0.2792.79.exe	113
PID 1036 wrote to memory of 4392	1036	setup.exe	114
PID 1036 wrote to memory of 4392	1036	setup.exe	114
PID 1940 wrote to memory of 1748	1940	MicrosoftEdgeUpdate.exe	115
PID 1940 wrote to memory of 1748	1940	MicrosoftEdgeUpdate.exe	115
PID 1940 wrote to memory of 1748	1940	MicrosoftEdgeUpdate.exe	115
PID 2388 wrote to memory of 4120	2388	MuAwaY-Installer-v3.0.0.tmp	116
PID 2388 wrote to memory of 4120	2388	MuAwaY-Installer-v3.0.0.tmp	116
PID 2388 wrote to memory of 4120	2388	MuAwaY-Installer-v3.0.0.tmp	116
PID 4120 wrote to memory of 4836	4120	VC_redist.x86.exe	118
PID 4120 wrote to memory of 4836	4120	VC_redist.x86.exe	118
PID 4120 wrote to memory of 4836	4120	VC_redist.x86.exe	118
PID 4836 wrote to memory of 4692	4836	VC_redist.x86.exe	119
PID 4836 wrote to memory of 4692	4836	VC_redist.x86.exe	119
PID 4836 wrote to memory of 4692	4836	VC_redist.x86.exe	119
PID 4692 wrote to memory of 3812	4692	VC_redist.x86.exe	131
PID 4692 wrote to memory of 3812	4692	VC_redist.x86.exe	131
PID 4692 wrote to memory of 3812	4692	VC_redist.x86.exe	131
PID 3812 wrote to memory of 4276	3812	VC_redist.x86.exe	132
PID 3812 wrote to memory of 4276	3812	VC_redist.x86.exe	132
PID 3812 wrote to memory of 4276	3812	VC_redist.x86.exe	132
PID 4276 wrote to memory of 1928	4276	VC_redist.x86.exe	133
PID 4276 wrote to memory of 1928	4276	VC_redist.x86.exe	133
PID 4276 wrote to memory of 1928	4276	VC_redist.x86.exe	133
PID 2388 wrote to memory of 3848	2388	MuAwaY-Installer-v3.0.0.tmp	134
PID 2388 wrote to memory of 3848	2388	MuAwaY-Installer-v3.0.0.tmp	134
PID 2388 wrote to memory of 3848	2388	MuAwaY-Installer-v3.0.0.tmp	134
PID 3848 wrote to memory of 2284	3848	VC_redist.x64.exe	135
PID 3848 wrote to memory of 2284	3848	VC_redist.x64.exe	135
PID 3848 wrote to memory of 2284	3848	VC_redist.x64.exe	135
PID 2284 wrote to memory of 4788	2284	VC_redist.x64.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MuAwaY-Installer-v3.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\MuAwaY-Installer-v3.0.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\is-34VGC.tmp\MuAwaY-Installer-v3.0.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-34VGC.tmp\MuAwaY-Installer-v3.0.0.tmp" /SL5="$80052,35385421,1146880,C:\Users\Admin\AppData\Local\Temp\MuAwaY-Installer-v3.0.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\MuAwaY\microsoftedgewebview2setup.exe
    "C:\MuAwaY\microsoftedgewebview2setup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:756
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1192
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:404
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjMxODYwNzQtMzZCNy00QzY1LUEwNTAtOUFCN0RFQjFFRDhCfSIgdXNlcmlkPSJ7RDY2RDhBQjAtQTAyQS00NUQzLUIwOEQtOUU2NjlFREU1Rjg2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezA1RkQ5M0RGLUE3NzItNDYzNC04OTEyLUM1RUU4NzhGNEJEMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzMuNDUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5ODAxNjM2NDMiIGluc3RhbGxfdGltZV9tcz0iNTYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1764
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{B3186074-36B7-4C65-A050-9AB7DEB1ED8B}"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4424
- - C:\MuAwaY\VC_redist.x86.exe
    "C:\MuAwaY\VC_redist.x86.exe" /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\Temp\{3E6226DD-5861-4926-813B-56CA3F572F5E}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{3E6226DD-5861-4926-813B-56CA3F572F5E}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\MuAwaY\VC_redist.x86.exe" -burn.filehandle.attached=552 -burn.filehandle.self=656 /install /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\Temp\{1F7F9511-ABA2-44EE-BC03-DD7B14A0FC4C}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{1F7F9511-ABA2-44EE-BC03-DD7B14A0FC4C}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1C83286A-6559-4340-B80F-56705B4D41DB} {7A2B1775-F51C-4BC1-A80A-2453EA43D413} 4836
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=896 -burn.embedded BurnPipe.{BAFCDDE5-D0E3-4E2D-9355-7E0D7FD14C30} {A8BD9FB9-3048-49C6-A358-CE085656720F} 4692
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=896 -burn.embedded BurnPipe.{BAFCDDE5-D0E3-4E2D-9355-7E0D7FD14C30} {A8BD9FB9-3048-49C6-A358-CE085656720F} 4692
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{57354BB6-55C2-4C19-A12B-03507F6BF36F} {982E6202-4C5A-4B32-8FE0-4FF407C510FE} 4276
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1928
- - C:\MuAwaY\VC_redist.x64.exe
    "C:\MuAwaY\VC_redist.x64.exe" /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\Temp\{7725A7EE-FF65-493B-998A-9154A27D483C}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{7725A7EE-FF65-493B-998A-9154A27D483C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\MuAwaY\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4D2A5794-887B-4F0C-B22C-52AB914BCB4A} {177E2D01-4999-4A16-82D0-5BC23E7BEDDA} 2284
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4788
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{C5F172C1-F058-4ECD-9F3F-E017931309F4} {EB6B1A75-DBAE-4156-8F6F-064907941DC0} 4788
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{C5F172C1-F058-4ECD-9F3F-E017931309F4} {EB6B1A75-DBAE-4156-8F6F-064907941DC0} 4788
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7EB01908-61FD-48EB-B1E6-28C31058B3AD} {F8369A5D-322C-4998-8F5B-5A4606B621E5} 4144
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3132

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjMxODYwNzQtMzZCNy00QzY1LUEwNTAtOUFCN0RFQjFFRDhCfSIgdXNlcmlkPSJ7RDY2RDhBQjAtQTAyQS00NUQzLUIwOEQtOUU2NjlFREU1Rjg2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0ZERkU1ODY4LTBBRDYtNDAxNC1CQkZELTQwRjgzOEFFMjI1Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5ODUxNjM4MDUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2908
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\MicrosoftEdge_X64_129.0.2792.79.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\MicrosoftEdge_X64_129.0.2792.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=129.0.6668.90 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D8BA8220-C7BE-4DA7-893C-ABE181331162}\EDGEMITMP_8CD8A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=129.0.2792.79 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7ee0c76f0,0x7ff7ee0c76fc,0x7ff7ee0c7708
      4⤵
      Executes dropped EXE
      PID:4392
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjMxODYwNzQtMzZCNy00QzY1LUEwNTAtOUFCN0RFQjFFRDhCfSIgdXNlcmlkPSJ7RDY2RDhBQjAtQTAyQS00NUQzLUIwOEQtOUU2NjlFREU1Rjg2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezk4M0VBRTJELTUzRTYtNEI1NC1CNEU5LUI4RTI4NjIyOTVCOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjkuMC4yNzkyLjc5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTk0Njk0OTYzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk5NDY5NDk2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTU2MzIzNTEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzMzZjMwNjU4LTY0NjMtNDE1NS04ODY5LWM4Zjk2YmIyMTQ3NT9QMT0xNzI5MTMxNjgyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUtJdU5SaVFTUm5IM1VmUXVHNUNvQUNHaURibkJ3RkpuUlZsJTJmUW1SZ2tBcHJaSndOVXVBaUg2JTJiblgxWjJwT0JIaHY2cDF3TjBZd0ZOWmdyZHBFM2ZyQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Mzk1NTY2NCIgdG90YWw9IjE3Mzk1NTY2NCIgZG93bmxvYWRfdGltZV9tcz0iMTM0NTQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTk1NjMyMzUxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIxMDE2Mzc4OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTgxNjA3NDE2NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM5MSIgZG93bmxvYWRfdGltZV9tcz0iMjAwNzkiIGRvd25sb2FkZWQ9IjE3Mzk1NTY2NCIgdG90YWw9IjE3Mzk1NTY2NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjA1NzYiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5952fd.rbs

Filesize
16KB

MD5
b03188bab5b0941d2adaa68d77d5ca2a

SHA1
8c49e979b79283b7a8c394dd03080575a56a2709

SHA256
a18374b67674bd6ee3e5601ae119c9644b59b3520e031686b18f61b3e4c1c0c0

SHA512
a82c0e974d59fddd0457b0da69b75814aa2e7bd0f5e580323af2318719e15e36c783930dab3d3b3977bfba550093d04efc384e297a0c6815d69b48889eff68e6

Download Submit
C:\Config.Msi\e595302.rbs

Filesize
18KB

MD5
8fc7d1d516f0bf3434eca479b471eaef

SHA1
2741c09f68ffff2ef37446437db9e6c39da44c9e

SHA256
5706efe8c1ca116b3ff92704b8c190cd21de9afb95dc39cd0ebcaf3a4ac9331e

SHA512
1c6cf9b5db778f668192deb82b56a54d45fe6482782c233c3683b6e3970c727ad565559df39cf8ac1e392525bbbb57af812e4abaf758d5e7ebf844976d73bf04

Download Submit
C:\Config.Msi\e59530f.rbs

Filesize
20KB

MD5
814963494a8ef984cea0445cb5d0e4e0

SHA1
d58d7b830c893a9f2dda5d1a080d8f99521052ce

SHA256
810b375a0e3e32f1f27ab30b42806d429bae67e4a14ec01acf6b08ebf19e3bbe

SHA512
8c87ed1d0a4582089be2667e9dde11c1f9b312ce540b231fdf4860909de5886269b96f71bb7f7f3efeb6826c31571871b85f69f2765b753cb7c4ddc1fe5b640e

Download Submit
C:\Config.Msi\e59531e.rbs

Filesize
19KB

MD5
4c3462fbdf4a15474d5ab89b53956b3e

SHA1
b0df397b000b7030134fad7bff60df4076b0310d

SHA256
3676a7cd9eb18fb8cc43971b0b636ceb9443b3cf2da03f7668fc6770bc54f3b0

SHA512
2e9f340278d5b68660cbea2fbaa326e1863e2c3f0753f0725009ce0a34329302d2d54c400a31e7166bc539c7528cf5365321d012e1e27bd19cf73d898112af61

Download Submit
C:\Config.Msi\e595325.rbs

Filesize
19KB

MD5
a4b5b6c59705fc82cb1fd71443bf12e8

SHA1
77734885b787db24f8cee4e305a0abfd26992730

SHA256
c2038ba04a7294b34c951a833d9752cc8c93ebdc77acb341dc0453af7aa90f77

SHA512
fde9b600c9d452beac1ea0aff1dc2ea60402bbca9e0219eef8541b932a5165ebf2b2dea862802a32b91cbfa286bfc26fdc3e5637111daf9533024501b75081f6

Download Submit
C:\Config.Msi\e595331.rbs

Filesize
19KB

MD5
2631ae1f6cd9ad7f5e73c38aa391b993

SHA1
98e2dd1f2d32e22924210a0a5c83d9b9db1ba508

SHA256
19ab5ec1ad3a24f4277334d6c549e0035010ae1380954c7c9d5dffc0f9480f11

SHA512
0f15d15033423b8d2d71b11dfd1485fc4240dcce3180ead0ae3607de402b0ef022e77b6bb3c719b3fdd27dbf7cecb981a1052f17a975671c427607400f4afd7d

Download Submit
C:\Config.Msi\e595338.rbs

Filesize
21KB

MD5
3256d077a077ea2217546e56654449fc

SHA1
c5435d589478faaead895fcc262c22d8363e4219

SHA256
358e1978f80e98ac5ea8b734236e461c6b45b24a2dc3417f56afe75fa0ec28fa

SHA512
1540675012b49c03f165b6d724a2de530a9c7c210fa3109ed6b37fa2c5578fb5f7599cbfc015f84deb0756f251ff004058efc48527846fe0ed27c7036db8c3bc

Download Submit
C:\Config.Msi\e595347.rbs

Filesize
21KB

MD5
d05c2e6a3a2e0885e9cd944d2ee1fe07

SHA1
ea487eb85e08750f2b81ac9b14e8d6c020c321c4

SHA256
cc7fb39e2aa37eee81f9a38d96e324692d3f0dcc553e00549a7a9bd13c59b171

SHA512
4857b2bf9d40c53ccb0a2f0010055995a86701974c2d6799d2af5ae069c5e8977b87ff1cf411450e3dd8a2e4fd4f7d2a7535c66b82703e1eb81b5d4c9d3d826e

Download Submit
C:\MuAwaY\launcher.exe

Filesize
6.6MB

MD5
bc88863732220749ae3682fd7f64196d

SHA1
1f279e1f064db83c9d9d2e72b3fd5169649beec3

SHA256
8af5ffd0357eca54e0bad7b7d88d65f9900394a5cf855b2a814ca7b57ec8dcff

SHA512
dc6528d47ece302c43f7a3382d5f4f82d172aa2c0c1114dbe85fdd7938b4affcaf406017919d6237338ae743eea55f430b63e199a15422dee2f763a2382db26d

Download Submit
C:\MuAwaY\microsoftedgewebview2setup.exe

Filesize
1.5MB

MD5
b32d72daeee036e2b8f1c57e4a40e87a

SHA1
564caa330d077a3d26691338b3e38ee4879a929d

SHA256
65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289

SHA512
b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\129.0.2792.79\Installer\setup.exe

Filesize
6.6MB

MD5
5366d353cfe8a8f4ff9b4b8fc5ce1e3c

SHA1
4262b83fbfd1c4a4647fbd3a0af85eca81f3d338

SHA256
dae41fa913389c700bd64b071bff7cb827c666cd95cbf106ae47daea2438a3c7

SHA512
60a16a0866e0574aea9640927c2be205c8b32894cb4e3e76738cd3169a45af97aa00ff31b66a90813c04c43f4e71282319af2a5bb25c4cb602f14a884dbd6eea

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
179KB

MD5
66fcafc9f2f49c19563d76f5337788f1

SHA1
9544b0b23129dccaa43eaa5da4b5b4aa5eedf88d

SHA256
06cfede5f76e1f17f971fa265e318e22fa6d743f0ee5879dfa9b09f5f471f207

SHA512
ae1b4435e866ea4795e370940a8524a1b0bf04941612017831363b735d97184f1a125af9f7aef1e755b1b242419adbe4e5db7473ff090ca87d6669c25b76f14d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
ae0bd70d0d7e467457b9e39b29f78410

SHA1
b4a549508cbc9f975a191434d4d20ad3c28d5028

SHA256
4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

SHA512
cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
212KB

MD5
a0a6fe642213826a1613a5208a008055

SHA1
e9059ce64a1ee047d299c88a9c64edf61cdc0504

SHA256
f87c42f298612bb4cdaba4d56cbc1fde4856648bb1b771651b985b5d0f163cba

SHA512
bfa27c53eda95fea35e2b732fae85760f4c260999a646d951a7c2c0ad34f1c7af0a8d90916f4f99ba1cb1951801dfee01d0f7f2775e4491519187fa8b9718d5b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
257KB

MD5
465c5a2eae01ad9cc32ed0c5348fc2dc

SHA1
aaccb9ae7aa82c8ed62a43571596c3a965b658b6

SHA256
ff9b8963958042a650acf2f13a3697e5bb1c5ff2cab55d06166f5527de626021

SHA512
605d9f9d12b981f218d0636912e048d4a76f01c960793ae9f6e1dd59f49c1fc2e615b51d919605d433467bb2fe9b9fa5fdb979432085a88f568b3b4cf876af44

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
6545c51ed0d062d63c7dd5a6f00a32c6

SHA1
b6b7e5f44cb3c11f76a46e18fa7d80be9f6fdbd3

SHA256
f9431d85c0869faf740220f88b2d8db61b53d9fb324da995d938412caaed0f3e

SHA512
c99b0333b4e598fd9cad556a2fd60c725ae4c4ae45d53a45a7e051d106e3e24c401fd8686eb707d8357f01d899734889271ea3fda28bb55b7d35dcd338db7fb2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
fa5578b2efc78389b459ab88b58c9abd

SHA1
980ed1ceab5063849eef96deb26825d66aaec16d

SHA256
79dca4ee4b15d9e599ccd7e12529a8b4d453d51c2b9ecd54d50bb280f0f5be7b

SHA512
a4146ef506737eba5a7c373a51059abe4569d41b7030f75a9fa1228c729fa8465e22f0c2739af2690e9408d76f43c343e4ccdb92e6110505d2655bed5844ab67

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
e59264b8cdedc5590fb6d3abb52569c9

SHA1
2fa3c37ac3c81bbce1d1e2c6b9861b36715eb14f

SHA256
5426cd930a651e304aed15fc8d693dd809f994cb195ca023608317efa7ef69f9

SHA512
3d16943726526929678d7b4d9ab30b291643bf28c93fc010371a68af24f3a169d5da8b3e75413dae8279681092a558eba36ccc6fad177bd9b39a13728d3f3737

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
bcfb450a64ce92040d69e4fb5930762c

SHA1
944a72d0072ea260e8927e6309de6ae4a4796ff6

SHA256
a09fe2478e1662bcab92b41c8ecbe73d6bdeff386f0789c59236588ae2f887b7

SHA512
210a39a25db954636e8da1ed6b1a9e3608f19ac3b154ec9f274694d3fb8617af69abf7516ea00d62a5b100b5121bd7de32ff5afec7632f697dece7d8a201e5ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
ff972d54852866ec3a43f11d7eeebd3e

SHA1
d3aaa7122de308be3fdfe27eaf7e22e0c0a02852

SHA256
b7862bb1d69e0e720db9fc1c498ed30f309dcaba73b304d239c1847441c5fd3d

SHA512
a4141404d4873bbef1a522e63644fdf37c6118a6314624541e367855e7d7bebf4bdf736295857a6e5c28db79ac6f51ff94123fb7119e05a48fbe3ac77505624a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
75188196b6f7149d5ee776b95ff56ee4

SHA1
ad80c3fbb83d67c96fc4c3276747678d78d71359

SHA256
fddd8aba9fee226a935ace41d0f6707f1fae84d88f703bfa50ae9a13cd22610b

SHA512
08ee04a6a95b5b7c2396dc60dad24f2dcd46259a6318a15596581cf86ca66a47cd7a6685c94a746e88ccacf3f5ae051894dd2eaf2d09f04fde94524fcf63d952

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
1820cfa69f244a787a0af9a4935e94a3

SHA1
65dbdda6e072b7f7b60e5740468be3374d5783a9

SHA256
9fbc74077908ad444da57cabe2f070dfb1c4f902b6917ce539cb2728612324b8

SHA512
c7f3d33c0b0a8b0a68ebf7a2e79936b07ba7fd43bacd67dacc549a5856f7fd0495dd8922d0c12e5bcb774d67267c5ee8bad63ca12012c95311cae42d878b42d0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
aba517fc0076e621244645abfdf2d60f

SHA1
3c1226b3fd9ae38967f8f3fc81d5c8014eab8ff3

SHA256
17e4f7edf396f0b4d8f64b46c5530260558ab0637cafba8c93c8e928c2b6de43

SHA512
5e3e48c8a97d10eac726b964716aa3524388474a7271c03657868fe8f1575ff0bde8911b91f6e874011e0c93581bd7a8d0d2920a140fdb47f37bb0d831befe45

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
933d66b54eaf05bc5aaab7c681da0b36

SHA1
a86effdbcc468df187d74f5b5e9d42d88e3197d1

SHA256
0e472bcc13ccfa83096e11217fefcb0e5aed3fa7ed8f1bfca7f2b7c151691b06

SHA512
628ca72071bd072bab9f81a10c6ba79a3b9d48c60dda1b58d4245d24841ca1288fb253e9212ff2cf721e366ea0aff0a068b08372a0cdf9279b298825ec8d2086

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
0961601651370bc0ad92ae34c745455e

SHA1
25b29bd74f6c5b5d16fb178cd6a53ea981309457

SHA256
5443ff8250092985e0ea1ab213eebff92bf0a40d908051915ead8d1ae0e97a5d

SHA512
d81053a2bb8ebdcbcc8d55671371a71af68c5d2cc309cb92d79dbd20203285846887da7c59453f38cb721fc164768a0b92bfaf62f78eb264acd37142df5f4e5e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
1a1ddb1f95ecca9d13139ad436c3fe48

SHA1
bee6baf32a15188f5d64df3df3bacc12dcc56845

SHA256
515a028bfc6dbd7d1aa1819f1ef70dc6382337318f907656f3768d1c66cdd53b

SHA512
6e1bcb85d15a43757e6f3f75fb78cfedc4a8dd099c334415996cac7ea29f7e1577b8152c709192820d2b78b48b6cab7bf4015f741d4f1a2d845c6ec2376e5c54

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
140f6d23813e344ab06afe865699c0c0

SHA1
527abdec73c8add2f9baf9d8de5c7d454512710d

SHA256
390c60bbf529ffe7174f6e1f7cde2af1455d618f5eb16f6bc3a48cf2bdf51d27

SHA512
b51988055a11eeff7a07b9b97a5055c0e0b8ce60f5a7aca94adcaa62472f63a9620d4f34eae75a772674eaa9e9461d716ba39989c1d6708e3846b92807f6c4f5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
90d8f09d6e68940399ebb1215c521511

SHA1
06d2a1a3a08cc2bf519ba83dbe08e4f240b60a4a

SHA256
2c27a8c3653aae163bebe05f010a5d73aa47f0b58aad14bd1811b2300fe564dc

SHA512
34cf592dbebf2055451b967d27cae5849896b26ef161bfc07aada6cf7757d39ac8b8fc9c003d3770f72aa046c132280be0646f9ae101e0ec36e3b6d95aa6a89d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
cd2d40775ef0773519afcaa17509324e

SHA1
0ccc30932a50991937af5a16bd7ef92787eeb57b

SHA256
a20e03e1c56dd2438c85b52e94f54839596e5352ba4b3a406b2daeab5fd24c0d

SHA512
5d8aab4054c17720f9ea9dc28754efd440c06bf22b31c00c9020418a1ddea7bc9f5db285b2916af2e659c33649549a363af281563dff296275c4c8e2a7faf8d3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
dd517584ac41b7c185c1258a13143062

SHA1
60da459099559e30908938b742d6f5c1d0f99a4b

SHA256
904481a7bc079a6734dbce692d756952e7ffecebecb2f743568defc19f9f9e1b

SHA512
f96a73ad75e8d9adc01841a3f7a552c3115ff643d1cba669511e17012f892cb352cd77963044029ff7a7243b941e9f29e53a4ec51ba52977d05af20ab6d44779

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
c4ec05491b1585b7a3aa50375f5e4368

SHA1
cb37296d111b4c6d0456e88b94b482de4582161a

SHA256
a1d616c002ae667321cb3d78958877dfa47bdaa83a43d374d8e3628ec6ae18d5

SHA512
6392f6b349804243965b2ab83e80ee9a80627f9acaf5803aade67ab49c78647e3c8983b38fe7d1f55fefa0c90d2ca3b0cedf3d820c32a700eacd747fc4c72401

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
7ed8de68978a390eeda6b9f4145f8fec

SHA1
d4553ca5efd8801608196c81649dcd045e8beacf

SHA256
6ddf0517c8e51150048ee6ac66d5659559ecd4e6c3343245068ea1b8a3350878

SHA512
61806df41a9f2df86c71880be3e5e338ac35dad2a4964856e42a6d821b3d432b4412daa7a849cbbb3cb05228be777948387d90f6a4ed2276c537656098636e71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
f0a758482ae88ee848215489129ec7bc

SHA1
d1298f7e6e60f4a2c11a61c137200665aabdb3ad

SHA256
2d76f0bf2669c672d1fa6c46417e65ac9a160a01d11990804ca40d3a3d9dbe76

SHA512
0ec2be7863d2a7f187e831529ab959ffb9c90b4d90d45ad86a9e3522d77af86c12eef4bf9a5cdfadb7957e3e8fd8fd3841f4c301865b823bfaf99e1b55182bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
dde9aacccb335e8a14bc4c0f2ac28eab

SHA1
8dfd19ecafda06c7e760e8fc17cc1dc43b9f3508

SHA256
c701a69236db5927f925a7d2d9845ca22cd59e03e83bfaabe5c4db35d373c056

SHA512
37de0760864b0e25277664ef8d8c4ac0df1f90ec6caa37f6e527be3b6af7a977b58453d26095fdede13ea9383166a9e60e9e0fdb9d8856eb54632a2943c1fada

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
7e8d44be65ac66ce05fb0bae2ba06f59

SHA1
f7341452313b2e38c0212b1ed499912d210fd315

SHA256
564c505c5f3617b2ccbffafff9f81771055b6edccce22917fa0bf553386a3749

SHA512
59417deaed339aa61f19336f307f2a5f5057f7ee18a13f1c8b4055e0bf0b8ee15bba6b15233aff239a7dc9b1fedc4a993fa8f4fbf9d76393f930c6ab2f52da85

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
4c3382b9bb276730ac626a30904420f6

SHA1
622af5199231a82a88fc70af89474f55af5fc2ed

SHA256
430a568d7d001f4dbd4c3473838146542f06e8b7a0e8a8f41dec5de94feb9f84

SHA512
1248bf0a772a7ad2264dfc3ddc6d0ffd278c83c335c8a4a1468ddee742fb6a0fa033ffd40bdd135c2604ce35c12f882951cdfd6ea728709ed287294e5fc149ec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
8b51e86ace114d92a5fd2f53269a0785

SHA1
c175ead12ddc50d1df4b9b1687364aabee035a65

SHA256
7b5b4c7eb487f5411c6dda6e7a91501f9473e2fa66dedcce28a12f356b984840

SHA512
96de82a64d420120cc6eaf16d4ca77fd5aef1e848d6b006c2ec0ce5bbbc1ce6fae9fe57de552f3df9dcc59c49f5cdb024097a33c24c10de12c4adb6a5fecee4f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
8a3bd0c8f91564d3be5696756e05969d

SHA1
5388d1afb06786bfd4907b7580f763810d07d4dc

SHA256
a8d60b8d17da26931755bdca16c486f03a5423d368f64eb164b22a7839bb17bd

SHA512
4ec41f8e7c945f583d35ce61e58cb84d97fd8fddd31619c9ded8da7b90a4bfd5bc41c350d15bee2d7ca430ac69f04df980d67a5b931e5e1adc4fcf5ea2afe8b9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
33639788ab5d596a09d2fdf7688ee4cc

SHA1
c6697fdd982c0ebe1559084f81d4e22304cd7184

SHA256
f2763c899c134238e169d0fd09eb8bfdb8fd42b25d0724dbb6a1adf329a7845e

SHA512
7a2998a7f7301671c7dcad8723ff5cd694710848ee1c43c9f06e525489b91a344d369aae45dc1d259c10c1ae083f88de8cdf1b8ce07b5a0d1a99fdfc87cfc21f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
a3ae249b4498363bfc94043e725c5e2f

SHA1
fd1baf19de13def5c9e8dc3d91e57f2ad1a7aca7

SHA256
7c6c0a0ebc9e48da16f54f559f48af5ccdb375dcd914a36cc4662db0b7fe82b1

SHA512
e8d6cd5981e96f7c4897355fe3283c8b3a0da20cead2e1a6bc2dff9f00a6fa7493fe129607c24d9dded9ab86cfb09e090af3038d4f16268d473d417b4dc2dfd6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
635e9a59fb087047b6521a8c622dc31c

SHA1
9a6b5f14738fe1d11b0bdc52ac86962145a4c852

SHA256
698d85a10bed433032d04d8221b2fec183ee7d944dbcb685ee90d28483084c64

SHA512
cb368f6bcdc85c41adfaf77f4705109a74794b7b99d2ffa2c4af4a7457ebab3777164bcd42c4de2d7c4944460342c8efd8102de6b9e51ee7c193b43205ff5eac

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
1a743785d82759aeb4d8cd84f163e515

SHA1
55949bb303ce5285bfba2603df34249fead59a6d

SHA256
e73749cb09eee8f9b6b62e0aca144ddb73b35c89c06432f5f24c8a3ad609e731

SHA512
6f90905195914560db4050514e496978964501173f13b0d6df499e8659bb53681e19669be4d5b0a6467a2beeca88ac9512edd17558b7ff75580d15bbdc59b540

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
63167811b5d67909811ab2ea52f69687

SHA1
3c8c954d7e9295a89dd5b347598c55c450575aef

SHA256
cbe59981860ccdba144c645bd1fbb70072643bab98a21e2008e2731daf74ca59

SHA512
c33ba711dacca5219f3029b6d0ac0da2895d4ab9a203e6bb37b39cb9e558a555b9d7244f2b5c026d2a75a01901931830a15358e109215022958d089af0d66bb4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
aa92c3750a7c959d96701e389be062a5

SHA1
1dcdfaa8b19ca5606864db6e6b81d8ab3ce55d16

SHA256
7b1597017f98a23571d37718ca774fd2510cebbaf25f702635043a3146d1b6b0

SHA512
44c2f8123050bf37b89e1ad43996be8694d12b1528d1bbe0fb5af0af2251af1a4ec0e91cc42aae3ede3c06feba8ee947fa5ef25d6969342903f8163fae637315

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
89b440abe50e070b0dbb1089c215dbb9

SHA1
085cc73e258062989d525d2a27f3b4edb3d48c65

SHA256
b25f58082c09e3db22708401fca30fdf97040c3a11279089233db78705a3a04e

SHA512
90b17788b9b279ea262dfde5391e68752e2d384ff9c0c05ff7d83ac78aef17fd664e48aec2256145e5e8baba02a187d5479685b2259d6178a77ad48aaeb5835e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
2d1a8303693967e2b5ccffe10ee463fc

SHA1
efc19774f17b5c629930c63616cced53ed718159

SHA256
cf8d95b6f78b1c406996ed4187b28b2610067535896bc58669da41feddadd368

SHA512
527e4b5f61a90395bc274939cc1257379e443d088b48372bde7b3145cabb56632613134551b281ee4af5f2b2464231d798afec02aa9d75d9afefffb0d401e840

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
d05fb9b71ba0ff3961dd8c8eb7e2eb1b

SHA1
5057cfb73182875db3460c22685629455cfc7023

SHA256
2492a3f35b6900a335a87676e6204ec1b9434673de5df1572f83dabc37a21cf6

SHA512
fff4e4da7f6438c6dd3dd90f7c6cce6f14626963c3cfaafd42c3514337af7af0c8bea4d8fde3c56d530df5a082bfa9fd7f8a40a10eee922589c7c50a8d58361f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
84df8de6696f3f10f447b93c65558118

SHA1
cea711a6b101dec540982f70aa06a2c2aa892f86

SHA256
9aaaba5205230485c3659ee74c2ba69041540e5d62fd39f185e6759c97f7325a

SHA512
d7d0944f1d691e40f7fc35e59b199288e914fbb4a3ee90052ff2adbe11f9fd8e0c4090d0b4b7eef7e0ae39514030848311d48f5dfaf61d075ba18981d029b04d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
a6c4791612c26968b22b8124ee069e6f

SHA1
01724391167f0224c1d901b8a0f6ed1fef2e00b9

SHA256
ea1af73bd97429ed2ed3650cdc10b5c6f9296a5102821d4b69e7c0d41d9f0dd7

SHA512
1e6a801727af933683fa2f253f5fd9932257db94cfe08106ce8b1e82b2dc6b36f34fe103c7f01a28039ecd54d84647902c348a6c7cb162efdc89d88930bd7c20

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
523dab9f0691b5f9f748c2d28a690eb2

SHA1
26f3563ca6ad6add621bd84e8421822c5ebb2758

SHA256
6484b275195ce3b13cb31d75a4c0d2fd675a1be892440b59bd404eb0dd077e43

SHA512
fd5e0b330ad84076de13fc6a4c9abbeb8264ae5e3dd8fa03b7634d6dd20e309fc6b4ffba48f6a36e29f9ac1d5e7d818d12cdd0f31ebfc88903fce31e97feeea6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
5f3bb745fbf228f814ff7da6889a4e56

SHA1
368959b8ee12237971e7792c9e9aa113f52b2fca

SHA256
534915e0673f9bcf5dbd0a651f69065708c53e64de1a12656e3a2ae7bf4fa09f

SHA512
1d837500cdf4a317312b1c895c079c2252c7b9abd806e7ee99b89fc840e410ad781fab688858fd7a8b9c48f7bd786019f412eaa831af54bb35d942fae0742456

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
9d2ea90d056a0d4f8d75295070a67ed2

SHA1
77be93c75be719558e91aadfcd2fae5baf98fcfe

SHA256
fa796186a9159cb162ea36e92c57ec9e721d443e20e5547b5749f34510f0f837

SHA512
500f739c0cab903d1ca1a358728df0c7c105fad7ac88cff0425032640ebdc9cb87656593836e6694eb91513963a49399b4186ae34b0da1bcb6142816a0abd9bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
d2fbd4f80876839038c9c49fd545ed4f

SHA1
acc0fda636ff6f38a1b80a935242d98591f40031

SHA256
d932b0ec0f8a3980309dd93cef9c6e88cd98166715f87f42741f83e5e657a4d2

SHA512
ef0a00b362ba9d52863b260f5aeda6ac45164c29276d0c34b69338df6daed2cab2e093d186e79652c8f585c5d074224efaa748eb2d1ce973ea824a8cd291e4bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
7385c983777668a6e390dd462172c480

SHA1
af0ec0d86a60d33e6cf3d4d5929a2bae46fd0c3b

SHA256
4f465cee1dc3aa3b134744121aac07fccb1505e62bd946ae8637567c81c122b3

SHA512
ac3b69ca4e25cba580bd4ce384b500c1c96b24502b893ae1da9268e5afb23c141d19192da15123c8639a4f2a8a7ffb3fbd6d595fd845eeaf4dec4b8b26774c30

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
41146ae997baa8384ee4e5f7a8dd2a56

SHA1
77154fcab91e9ba5f093758198cf679d1ef6272f

SHA256
a965fc9103a427f73388f3cc627cf40adb34d913845487b2e01566f19c6a874c

SHA512
7a3c1fe5babcb4d9d1c70d82779a5f2a1d243be3ac26da357de662a30282f8cbdfaf2c10edd984ab3f0b37ad05b79a0660bd1cb1ff4b2c11da1167d48c39f5b7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
7a165e5128da3f8bd3a09ff89fad2302

SHA1
2a1c54a9892a76b61b35e34c9f06c9c1d85a407f

SHA256
854cb557a42f1f1747cf7ebf74700ee68e6cae3082495399cb1b970963e7e37c

SHA512
b6dc4d705558dfd7da72e7d57300c6acd5a6049a8a78d1431d932a8bb7095727f68f84a3a32cbec1e70817a138b4f55305127ed8e0c64c6d4ae82f5a0e706e17

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
783d82190e727cd2d6600f72db389fdc

SHA1
f53add9827ba99297735195213af4da12b8cb933

SHA256
da5b10fe628749034d226129c727fced827550431369ce01770ba56953e7bbfe

SHA512
22ddec82074265e2d6a0c9ffe5213a3d8f375ad79bb28f46ea84ac18aab95cd75882fd8579e0f1d4c2fdfc31e8ffad895b49afbdaf90ba9b4dea0b26294543bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
71c061fef2688bf3153a6ef49354b830

SHA1
207abd05b91ebdc3ccc631ed3e688a01770c51b9

SHA256
1b8fe3a54e66fec65686a1ed5167c5aa117f041f876050c45371e97bd3c0267f

SHA512
78870b1de78bac9edf0620ac1ffbbad78d5122d14eb4c55591bb693e1f1298bde7c30dd99f7db863f9a73b353010f682e478001654a6761be521d89aa81ef5bb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
c81d6cd31972fbffad85134b1fb99c5d

SHA1
d0f37ecc4364b5d1511b2aa34a0befe5567c8f63

SHA256
943619e952268b6582580648f5d49efee05e59c78fb201e3733903c76e95414d

SHA512
3e18b092cd04fc64641cf526af40178416662f449e6517a1e38a278ebe57ad7990ba5ecefe3d1242ace545628cc37bec06cad19612dd79f2f131ad92884fdc17

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
de28bd6e9ce5820077805f4b467fbf6d

SHA1
df0ba96a12898d9c1b9a4e56be72f3433685d238

SHA256
d7fbdda10145194aadbed1e8d94d678405747654e08aa148c1c004b3df710ec7

SHA512
82a17ed87669b8d75d33a07a8ff224da188ef3ee4ef13aa5f829661f61a8d5affc899e865683f537853261fe9fa98e43474c0530c893e438c19c1b14b524eb8e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
509b2e222a850888e3191b37e5daf5fe

SHA1
dc9f2b1788f1575e2db40b37c279c8aca4ac5d1e

SHA256
fc197b296e528eb307e4c2b0cc804a01081d269f2195f222daa7598f423a4a6a

SHA512
41b51244e7f12721cc663cd421a08678ea702d87a874d6df61e754c34a540c7a67af4ef9ac69d25f1b312b76749cf21497898facf23017cdf1c6e152a5752f3a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
71e838eccf2045a7687535dcb7f75908

SHA1
760ee5ac1653b13f11a795c9b835cc12207672c4

SHA256
5c2c590f7b2564c633b479cd3c69cb23f4864e7be903c0b69da426914f6afdb1

SHA512
ced3fac25a95fbe63f5e04bc722feefcc4adcaf4c3b787263658eead49e89569ba13e3d6e90a2217460a2b3199647e6bb1890cb0c57dee7b48c5e3b59df9a61d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
51e5ca96d76123d22cc329939f990008

SHA1
5a0543d5ef5d97b50ff001c60d79d3edbdcbf045

SHA256
e56dc7eafe6f357344a85f3caba25ca48ccca9d8688fbda29dcd28a3c9abfb93

SHA512
fa35b400ade971c9788fb7430fc0663618d1c1b7276b91062fb73649d873f65dd294aa80747b90a0abdc7c99bbf75f1a4ba7eded7ddf3b15e0d6ed667351f3db

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_lt.dll

Filesize
27KB

MD5
abffc1e1a834ce30c50f44b40ce22729

SHA1
486ca416677f2d83d4a82bb8d145c3de9d154092

SHA256
8c63cf6a17a3f3c0eee8e3fd805def558dc03b2d1498551b1ce68e62f3ff473f

SHA512
5ec863008a55f6fa959cae10fe3f57314a5555c310f25c0651a1f93c3222b83586d1305895742f797d6c8e1140b88bc94720501d20926631f8e133138a064bc7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_lv.dll

Filesize
28KB

MD5
ace8c066152f4323cb5d2e60639a0dcb

SHA1
b73280d119dc79058eb21f4bdbb79dd2df6470a8

SHA256
a30a91190e7b5c150f0364895e8f6bed0a360944265548860a0b9e0b8e09aa36

SHA512
76b474eb827f62399cf501ad313bd55b2b9109de102f1ea5047b4b7f45269061e466bb5c8334ddf0dbe7dd58394ea9f6c14143302961f3fcdbf0c7beeabec48b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
184a07e2da03ad52fc101b519c1a6c83

SHA1
57cc7bb16668ccdee1c4716d26e0a07e41bf66a8

SHA256
d9b47367f0ee695912353c1b0d161795963292a3314f6cbccd3b2a2d7c588a49

SHA512
634bc609e2fdb598813546cb8e433dd312d3bf1327e3d0ff56013d6839783c16943f18d9a25274c13497fa97914ab7953dd84fcddbbceadb807a854fd6fd7efe

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE455.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
4ed9fe5c7b44fe0c53118edbe40ac779

SHA1
9ba9c0442a67284d4cc15c9ac28d5bccfd4bc41f

SHA256
8bf0122ee2e34e027fe847775f8e6e6466490b25cdc1bd03e09128808428d106

SHA512
331997335322ea08d1d3601afa656e1d180da71faa99640299c58cc58a28a98bfaa96a75877b421565fe032432d9a57490ce985879674410a277cf6720f9156b

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
74ced902e85f4fec946cd4216a6a6051

SHA1
dcd8356adb01c33313cd0c0435a78eec1f63d7d0

SHA256
c7c0f3d7c7d3ebddd216375ebea325e18ef5b0c00036a811659558c4a2b53748

SHA512
1bc7a3e069b917946e1360ae54cf8f9d439925e93159ee85afad32bc9782b1176cd2efe1a497a5cd606c4a7552484e7c7ab25fa5477555079d511bec4fbe9469

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
80KB

MD5
7c2811e1207e111c23d8bd2a021f62c1

SHA1
762599d96728247de66ce690a3fac433aa54b5f4

SHA256
900ca1cde436f3c0f3b37c0a104c2c1044e1bbd9fca0295d3ab9864637e12345

SHA512
ef4ac7924ba37ef6d7b9af018a99360c9bd4c8b515a76e6eba3149085d95e9339a2cabb855b2a5b7659cae77ef7b9b060df9fb318aac1e3a188f9b1eca4ee8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-34VGC.tmp\MuAwaY-Installer-v3.0.0.tmp

Filesize
3.3MB

MD5
6f006f16a9c883d9b3a7a84064f7f9b3

SHA1
6b20106f41b112d87565946054e374d0cff541bc

SHA256
6c3523fa2324dbef1a778a23696768ee096c45d955ab1258ff703b2a7eeb4916

SHA512
3accab87f9e275fee41c0733ea97959c0b25c4a62778bbba3b39d087150b0b15f9d10e35b39c9a61e6e191912c582a434bcfabe45b65ff3751dda9bb62a13e44

Download Submit
C:\Windows\Installer\e595309.msi

Filesize
180KB

MD5
828f217e9513cfff708ffe62d238cfc5

SHA1
9fb65d4edb892bf940399d5fd6ae3a4b15c2e4ba

SHA256
a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886

SHA512
ffc72b92f1431bbd07889e28b55d14ea11f8401e2d0b180e43a898914209893941affacc0a4ea34eeefc9b0ca4bc84a3045591cd98aae6bdb11ae831dc6bb121

Download Submit
C:\Windows\Temp\{03BDA04B-2B3A-4560-A36B-92FC5F60DF01}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{1F7F9511-ABA2-44EE-BC03-DD7B14A0FC4C}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{1F7F9511-ABA2-44EE-BC03-DD7B14A0FC4C}\.be\VC_redist.x86.exe

Filesize
634KB

MD5
337b547d2771fdad56de13ac94e6b528

SHA1
3aeecc5933e7d8977e7a3623e8e44d4c3d0b4286

SHA256
81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0

SHA512
0d0102fafb7f471a6836708d81952f2c90c2b126ad1b575f2e2e996540c99f7275ebd1f570cafcc945d26700debb1e86b19b090ae5cdec2326dd0a6a918b7a36

Download Submit
C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.ba\license.rtf

Filesize
9KB

MD5
04b33f0a9081c10e85d0e495a1294f83

SHA1
1efe2fb2d014a731b752672745f9ffecdd716412

SHA256
8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

SHA512
d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

Download Submit
C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
C:\Windows\Temp\{CD6F48C2-8DAD-44E0-8D3A-CA4F492B878E}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
memory/1928-491-0x0000000000030000-0x00000000000A7000-memory.dmp

Filesize
476KB

Download
memory/2288-795-0x0000000000290000-0x0000000000307000-memory.dmp

Filesize
476KB

Download
memory/2388-9-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2388-227-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2388-836-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2388-358-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2388-6-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2388-20-0x0000000000400000-0x0000000000761000-memory.dmp

Filesize
3.4MB

Download
memory/2712-228-0x0000000000B10000-0x0000000000B45000-memory.dmp

Filesize
212KB

Download
memory/2712-277-0x00000000737C0000-0x00000000739D1000-memory.dmp

Filesize
2.1MB

Download
memory/2712-300-0x0000000000B10000-0x0000000000B45000-memory.dmp

Filesize
212KB

Download
memory/2712-229-0x00000000737C0000-0x00000000739D1000-memory.dmp

Filesize
2.1MB

Download
memory/3132-757-0x0000000000290000-0x0000000000307000-memory.dmp

Filesize
476KB

Download
memory/3448-0-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3448-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3448-8-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3812-529-0x0000000000030000-0x00000000000A7000-memory.dmp

Filesize
476KB

Download
memory/4144-794-0x0000000000290000-0x0000000000307000-memory.dmp

Filesize
476KB

Download
memory/4276-528-0x0000000000030000-0x00000000000A7000-memory.dmp

Filesize
476KB

Download