37bde6655e1272e159b9c2e3a7eee3f4e9a837c0f04240645d3991d112287f8d

Analysis

max time kernel
17s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20241007-de
resource tags

arch:x64arch:x86image:win10v2004-20241007-delocale:de-deos:windows10-2004-x64systemwindows
submitted
21-11-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

9.4MB
MD5

f2a6133b7f38fc49f792ae799d1b4750
SHA1

6bef46ddde325f45a0e9ff123112c96bbd47c795
SHA256

37bde6655e1272e159b9c2e3a7eee3f4e9a837c0f04240645d3991d112287f8d
SHA512

f9611bed83b4bce1841868880a42dacb6b8f7e8859be1d85b3c8d3a365a0244566cbfb12294c7b2c82b15d6c0e47095d8246a95d522c3a064a0d8511b2411254
SSDEEP

98304:UHuETr54/xXEPmZM8l2EKSxOyFOiC0YYWtS7tkk6Q9SFxVLUeRF:2pIxXoSTlzdFfCtlIZ/9iZX

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Deletes itself 1 IoCs

Processes:

Luna.exe

pid process

1436 Luna.exe
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

Processes:

Luna.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exe

pid	process
1436	Luna.exe
1112	MicrosoftEdgeWebview2Setup.exe
4472	MicrosoftEdgeUpdate.exe
4360	MicrosoftEdgeUpdate.exe
2384	MicrosoftEdgeUpdate.exe
2092	MicrosoftEdgeUpdateComRegisterShell64.exe

Loads dropped DLL 5 IoCs

Processes:

Luna.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exe

pid process

1436 Luna.exe
4472 MicrosoftEdgeUpdate.exe
4360 MicrosoftEdgeUpdate.exe
2384 MicrosoftEdgeUpdate.exe
2092 MicrosoftEdgeUpdateComRegisterShell64.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

31 raw.githubusercontent.com
33 raw.githubusercontent.com

flow	ioc
31	raw.githubusercontent.com
33	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

Processes:

MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psuser_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_or.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_is.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_af.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\EdgeUpdate.dat	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psuser_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psmachine_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_am.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeWebview2Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

MicrosoftEdgeUpdate.exe

pid process

4608 MicrosoftEdgeUpdate.exe

pid	process
4608	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CurVer\ = "MicrosoftEdgeUpdate.Update3WebSvc.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\ = "Update3COMClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C76C02A1-BCDF-4632-88E6-55698920001E}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreClass"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35725228-BF11-429E-B5B8-ED0F2BCABF82}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Bootstrapper.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Bootstrapper.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Bootstrapper.exeMicrosoftEdgeUpdate.exe

pid process

2572 Bootstrapper.exe
2572 Bootstrapper.exe
4472 MicrosoftEdgeUpdate.exe
4472 MicrosoftEdgeUpdate.exe

pid	process
2572	Bootstrapper.exe
2572	Bootstrapper.exe
4472	MicrosoftEdgeUpdate.exe
4472	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Bootstrapper.exeLuna.exeMicrosoftEdgeUpdate.exe

description	pid	process
Token: SeDebugPrivilege	2572	Bootstrapper.exe
Token: SeDebugPrivilege	1436	Luna.exe
Token: SeDebugPrivilege	4472	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Bootstrapper.exeLuna.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	pid	process	target process
PID 2572 wrote to memory of 1436	2572	Bootstrapper.exe	Luna.exe
PID 2572 wrote to memory of 1436	2572	Bootstrapper.exe	Luna.exe
PID 1436 wrote to memory of 1112	1436	Luna.exe	MicrosoftEdgeWebview2Setup.exe
PID 1436 wrote to memory of 1112	1436	Luna.exe	MicrosoftEdgeWebview2Setup.exe
PID 1436 wrote to memory of 1112	1436	Luna.exe	MicrosoftEdgeWebview2Setup.exe
PID 1112 wrote to memory of 4472	1112	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 1112 wrote to memory of 4472	1112	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 1112 wrote to memory of 4472	1112	MicrosoftEdgeWebview2Setup.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 4360	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 4360	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 4360	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 2384	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 2384	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 4472 wrote to memory of 2384	4472	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
PID 2384 wrote to memory of 2092	2384	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2384 wrote to memory of 2092	2384	MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateComRegisterShell64.exe

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\luna\Luna.exe
  luna\Luna.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2384
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2092
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        
        PID:3436
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzlBQTg1QTItMzREQi00RTA3LTkyN0QtNkMyMkM5MDM1QjIxfSIgdXNlcmlkPSJ7MTk4REYwMkMtNzYyMi00QTYyLUIwOTctODFGNjY5NDNDQTVFfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0MyNUZENDRDLUUwM0QtNDEyMS05NjQyLTlFNkI3REJEQURBNn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NjM2ODgyNDYiIGluc3RhbGxfdGltZV9tcz0iODc1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
1723c5e707061e59d769c492a95d5083

SHA1
3b535b7a0df2f7a4ab5e531956dad9892adfb5e9

SHA256
e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab

SHA512
a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
35a79bd6de650d2c0988674344bf698b

SHA1
a0635c38472f8cc0641ceb39c148383619d221dd

SHA256
a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1

SHA512
afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
c55b37823a672c86bc19099633640eab

SHA1
da5e15d773c794f8b21195e7ad012e0ed1bceb72

SHA256
3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0

SHA512
1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
262KB

MD5
dd30f3ff486b830211df62d20348f86f

SHA1
08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf

SHA256
9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7

SHA512
af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
39ac5a029f87748e964491b97936d890

SHA1
24777aad794a13d0e7381fc6f32f0e1bcdb1ba80

SHA256
ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc

SHA512
2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
2a9524cf8afae49394379d9d9be69206

SHA1
e43d4146f8abebbb30831fbd39a39846bfb7eeef

SHA256
e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0

SHA512
a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
1903bc250fc269e79c9f7aada2979aff

SHA1
efbf76b1259217c02c138078c56f36b2cb8543ab

SHA256
228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04

SHA512
9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
b4c28669b9d4e56b094af6062f4db065

SHA1
4c492c03138c8a796cf0673866892b9e0c2073ec

SHA256
7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb

SHA512
35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
16b0c8a664626da016a95fb46fdc9c0e

SHA1
c674b635cd8927511825847f3d86a5562b4155d7

SHA256
b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255

SHA512
ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
bf510bb9b7639af7da969f77620b480f

SHA1
17a6693a5d6aea1f3fa6f34abc46daf558cac645

SHA256
2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3

SHA512
6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
4b23c7229eb43740744cfbf48c4242ca

SHA1
4938dcf6239e14db53c8f085d3c477905a9986af

SHA256
a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2

SHA512
4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
1e038b27661b303e15a39a55305e86bb

SHA1
35b48fe72d50406063f9145fea64c57f205f0084

SHA256
385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364

SHA512
13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
9afe531b6472cf9eb66028e9638584bb

SHA1
6212292867bd59fe376e79988c07f4db8ad26cdc

SHA256
383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812

SHA512
352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_bs.dll

Filesize
29KB

MD5
5e06d311c2e24b94f378c4d3b3deb260

SHA1
ef7df63f63746eb197c21694ebb21cfb86c0b2b8

SHA256
d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65

SHA512
8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
afdafc9f56401b662f42cef830d92b38

SHA1
b56966370ec07cd676e35d93fad001e0f6b3fb8a

SHA256
03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72

SHA512
884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
15ee7526536790bf77317975896542f9

SHA1
365bc54203b490daa0e24a1c9813d5d99c9de720

SHA256
5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e

SHA512
475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
8eff4531519a4b768005b9411d4a5f9c

SHA1
59b354e3f32f0a0da8755c27b903803994f4aa31

SHA256
2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0

SHA512
4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
11b92ae8fe94c784480d465a37935766

SHA1
f4ead29d4b20c57bb0e4d16a7488784f61a25972

SHA256
571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161

SHA512
b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_da.dll

Filesize
29KB

MD5
19a7aee0daf68fdc1a24e3228a8bf439

SHA1
1fc6ce227a11245787c80f3932e2c311de2d44bb

SHA256
409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99

SHA512
0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_de.dll

Filesize
31KB

MD5
ce66ef1a806c21949b75055f81cac760

SHA1
3719e4af114a3c0baceb133d152a02bc6a1fb9f8

SHA256
23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f

SHA512
04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_el.dll

Filesize
31KB

MD5
09cf47260852ff7b2c91c65d127b9314

SHA1
b3d362f3d08f81bd1b719a1c94b54f5f9c9610da

SHA256
eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920

SHA512
114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
39dc20ae50a0e2ba9c55dda91256b3cc

SHA1
464139f11db3fd6ae77502b183c4b59f581d6c7a

SHA256
e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14

SHA512
08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
894b6ea4b49fa390bd70167a75f3ff7b

SHA1
4f834ef6567d02f28390d63c8ca9fd3c735b2140

SHA256
a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a

SHA512
9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
bcafbabbfc8f810220b2ebdbb8a76d19

SHA1
58703c8355f996f2ce8ae5fd1ce4dc29318fd414

SHA256
7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7

SHA512
b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
3ccb8eab53a0b4c93507bf2adff6ced5

SHA1
25fa2435e97bd0e1cf986a882ce33e68f961c139

SHA256
8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0

SHA512
4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
6b03eb5b302e72727977f2431ea7f30d

SHA1
ac5cab93d3c28e46f92d2719638c739c680cc452

SHA256
b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137

SHA512
362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_eu.dll

Filesize
29KB

MD5
ed883bbd9e4b3de4db68e356707f3e67

SHA1
e03dde660c15a614442552f8c4d2cc5dd8425fc1

SHA256
168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7

SHA512
ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
ba417f44f7564f1aca70cca9166f3f44

SHA1
d8f064e25038e0076bffcd1a694b58063b7268d7

SHA256
56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703

SHA512
c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
7f47c9b9bc9488754579935209291c55

SHA1
470e590c6f5263a44b95abbd6d0c158fae326d21

SHA256
f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75

SHA512
6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
20134024ed75deda002dc0839b352f84

SHA1
e67bbd13a320d2b4413b283e165385c44a65ea0d

SHA256
425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76

SHA512
7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
08b6c8f26644370c6dcbee63e4abf884

SHA1
e4981733831c4d31715cad1749545d21dc29acf2

SHA256
916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8

SHA512
31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
cf3ff14718b5e6125b956d6d9e897196

SHA1
041de2587e03f6c52dba60e9d2459ce33b263eb9

SHA256
d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa

SHA512
551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
3ca8dfe9af49bdde95188002ebd5f227

SHA1
d18d7af889c4d03ea417c09bc56069f3f697c547

SHA256
6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5

SHA512
a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
d64f47e1971f1e9faba211ca984e550c

SHA1
6f4de57c6f174dd778788b138a9b25cf4725258b

SHA256
75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00

SHA512
722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
31276d0895baff6976c94c549efbb47d

SHA1
4f0fe790cecc28823e6359fb3b78dde13cc17681

SHA256
d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88

SHA512
413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_gu.dll

Filesize
29KB

MD5
bb4a1f9374f1c3e0cbc4788a3ce1d4c5

SHA1
30667d6dbaa689db9a08b42acacdf68435dac46e

SHA256
bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655

SHA512
d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
274c267b7ee544d36698b2db119a6929

SHA1
27377267ddc09060254033c4aa9916a60a254956

SHA256
ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f

SHA512
f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
ca9abf92edc001d3c0cea4c926bd004c

SHA1
740513a325a5c15376f4b1aea402e9c54155ab33

SHA256
d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346

SHA512
7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
df2764d7bf9bbc6d4e96301c928566b5

SHA1
1f9adfed63fff6cd144515e8a7fbf8c4131d2f65

SHA256
3dcf3b4acc066674418e30239406abf59b85f9a00ba2a0aa7ca33036caee6514

SHA512
8c1eec6d813fe2266f0e03ce72f504f355f720e0112527fd411abd5e7fea05dd4bfa3ee9a878c882c16e8cd30224727eabc5ab38bd85cf146b21547ade988391

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
c80c6530280315158443cd04f89e9169

SHA1
fb87a9ff3696f0acceee6c8f1e4fb40795a8ae7d

SHA256
52957587efb4d995597541656f38e0edcd4545acfd92e3b81cc72578839021de

SHA512
bee22709e362ade03cf385c9b09d321923cc17a9e7c227fef7717da7405ea7bcc63e6f18b5e3e18e9dc19d5b0d9d4cb32c8548d9f16803959eb13b1189df9815

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
28064f47523b575c20fc85733cddf487

SHA1
0c5583888be256c8e09a396e333ad158b5f87553

SHA256
0752855a2e2a69e0f969af6c31102db513dbc390583f07d5df60746721ada58a

SHA512
d96656335024e0228a18148de4d27f354fdc90b62f977042ac20199714ef50bad271a83547d6c6823ec03422a9b598828fdc3b0f1ae81c760a57a2d1f2a543b7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
0da1fde56fc0bf63e17a891e99f559f1

SHA1
131d18d7329be3ff21c78a3921b88e910a3d5a68

SHA256
ba936fcce39c889a3cb41569f18019d99429a13e7dbd909d9d26e540ea650dec

SHA512
67aa088ea8c01b11874537ae59c150645b61072e4f2134719e833ca0c4c3cab835cb9c51bff97582280870227d99cfb72f3a0d2069f2a9a86a7f7dbaf29ad2d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
d92167a825c73bd6246483bfa1787c8c

SHA1
0a96d89226f1e694275922e5e2640bca3d7e7020

SHA256
d477fce0f7fbbe9cf86dbfb724e28c617c8c7c5bea664974593fbf0c032e8019

SHA512
12401ac374d3050f9540a3df6fae71ff8466ed3df2bf007b52eaddfea0d549601b5756477c141fd596bd19367ad30a607160957a8ad1818ff34e6da4125e530e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
0ff69dde83bf61a768bc63870d687747

SHA1
622714cb8eac68b79021800f28f5874aa23176b5

SHA256
3a3a4d24498f0f533a5f5e4f1364e7e2a1f348dac95f649951131185c64d7bc7

SHA512
e1300b6f2dd5df3385c06fb43de5aa246f3f1da942e26b86023663e07b12104f0e74b2749d4ef2dd60cabfc8eadfe5f131a8bb5ba8fffd6374f9cd4635b4bc53

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
67eb1378381ad4d1a450bd26fe51f5e3

SHA1
ae0655d07a4d0b049ed258de646199f9004963ce

SHA256
b2ecba67a708b9fc75fc4574b72218f64517dea1aeb5ac26400ac554903cccf9

SHA512
1da5356bee3e18f9033b81927368eefb8f7a0742f7f02be9ddf0f3f309d9d4f1ceeb640acac341e504d54c0d0939f1da2bac27645adf404ed2ac48a2846a919d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
d9b956ec540d8b1e528d88d8c5e5fdaa

SHA1
bb967aeba493d9ac0b3889f7bbf9136614080331

SHA256
cf008a24b53f2d62516a2944b77fd9be17a4778c0ba1b83a09ef7e83c3cf3901

SHA512
d6d6171c95c07ddef12bc40a5fda756ed3870a06ff2434bdd7abe02407720bff01fab5eb1bafeb7d4b9b661fc364c39de4a9eab01ef39c6bdce6de58ce4c1a06

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
5ef433fe15a877e530ba0a044486f200

SHA1
db1deb37392e001353f5a098d8686a17fc156b40

SHA256
896549adb3d1a38d95e743490cf6f551cac876fa1afc4b07f8eb30ad4d853502

SHA512
97839850a49a09cbc416ba1e8e9570adfcacbfccb70903cf597ad8781c7c3d11fd07e2598dccb7e88da7617e44ca99c62dfb3404c0c2a467641d1a6dcd7e8e64

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
1ee9fe48904cb43a9147bf16823b16f1

SHA1
19fd9c0a2a1d919340eefca7956bd84df467b737

SHA256
a65da5bd18d6ac28c45cd11f56f8b868af98e42a69def6199d61235f6fa3d71d

SHA512
b556dff94243eeeb8dfe2c185c67ba7359877b8c0161f8fbe9a37a7e7591b0c8242a0be09255b616ac4f5560a728f1780cf6971c826ee6214a1b28c16551bffc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
6c3abddca78cb3ba9f724bad9fed6165

SHA1
3114daf9295215bbeed0f4bb4e282b46ec1c74ae

SHA256
d47e586aacfa638aab5d681d8b4ce0b42f9d698e213817554b9d42441191d548

SHA512
b37b7c8d7d24ead85389ce445536ef4a68c43e2a55508801ab00e9bee2c2ef428d07eb30b62228d647508dc4f6b0d78b1b8edc25052eff0ec5a9ec87fdbcba1d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
f97d285a3ba35b1395d9868e15bce4f1

SHA1
154dfcb8646bdb02b618dddf8a0dc1cbdab2269a

SHA256
33506ad10fafd8a767afcdd93cab2d91999b4e6468771379d944ff4758c2f5e4

SHA512
bae3152e85cc5e8f96299e7d45be8a85e47ea1119fd4d8d2bcb038ce293dab6820e35bcfffc03c9596b95e716e40711c47682f0c71e308755dc71b4c20c57628

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
9c7c3dec8769f8b33aab63a15f642d81

SHA1
41ab17373c388d005b6d39c3ffc9fd5aac1a75cb

SHA256
c088700c358cfad6bd692233e450b8f4836a30a457c7b047e67681c10aecf2f7

SHA512
86923405fdcb2ebbf9a2dff24847d55bf1cf39550f475b1268e7edf279269e317c09b638b06e29f4d30ba59fd606f4ab5787f7d09da5ae3c5572ad41f3b3fac8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
b0973b4e4407ea116a723bd7c39c1d45

SHA1
011e9126cf2fd3db3f0f810dc1d8e60891ef0695

SHA256
36e1ea95cd9663137ae49504980e00fbb311023c8f5f6f40f3cfe14a14ff183a

SHA512
574eb8426f774a7ccf860b4f0e324a2cc32581c9aecb834aa25c5f62946d15ef781a9f32feea8cd44e352d4878f3f6b8f097635bddb9df3bf2a443fecd0946e5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUDD60.tmp\msedgeupdateres_lt.dll

Filesize
28KB

MD5
883f3e1c963322852aa6ce7177ba11fd

SHA1
3da37835cb54a847e3fa2edec45c4589e2c31561

SHA256
c3e3bd953b1035bcb34db9077c41643a503aafeecf99afbc92c9e4326bc6fea5

SHA512
52e7eae669ce211be72ed62cddd43f926c8d581a28a5efc167d1bb9c7f132f40a000cec02c91cd81604ca9f1cbb61952a9da8d09044703a49309a4faf2ff2f25

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
62KB

MD5
864028cf63390eba273a6d93ed26eeaf

SHA1
bbc8afee5d2be2bb5d11a99a2ab94f02ce8df5f8

SHA256
fe3deca2ba40c1e75667f51be51168ca02c3082cefebd5809a63f1b29924b99e

SHA512
e3ed8cd11f94d05053b5e0f6ed3c7fefd0f5d3114ddc3ab9dde1710aea4f5f44a7d8354dbb50e16c6db7171f71bc506427eb657c42a863ee0e78f60ddb5d793c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
431a51d6443439e7c3063c36e18e87d6

SHA1
5d704eb554c78f13b7a07c90e14d65f74b590e3a

SHA256
726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6

SHA512
495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.json

Filesize
36B

MD5
e0f7e372f9e325ca56a76f8e1234a137

SHA1
72569fb0810ef4c886a826a6e60a6631dd5b87e3

SHA256
3634c5649f548068e67b8a81a94c20bce5fb77e2d024330ed41c3f8181aaed5c

SHA512
0acb431138b7021daf5af1588f90d8dea3cf7d374d98f65e93a40927cad682fc7bd2f0ce55d7998dc9d1213f905da5efe0683fd91547a0b12ae0dbf0fd42517d

Download Submit
C:\Users\Admin\AppData\Local\Temp\luna\Luna.dll

Filesize
1.4MB

MD5
d3418af778a91c134b8361c10fd16be4

SHA1
1654ab09bcc1ef4d168088518adc165e0c6469a4

SHA256
d21975e541c3838d2f83bf6faf360d7a7417da2106a610489a768b382ad3b91a

SHA512
128e8741bbe08bb90185d0c1c352572757e2848773ec39f21c8744ce4eb0bf9095ade326174f9164e94f568a00714be8bedc197f36a46c6fb16a880f2c6f9c8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\luna\Luna.exe

Filesize
16.2MB

MD5
bffd87503832012f3feaa2b358e3b28d

SHA1
fc7e4208b1921292399b63d007b20dd89055c388

SHA256
7c2751f93d3c65548bb07ca0ab17ea7501901b857c5b661b43aa15b74b5f25e7

SHA512
788e35a4c2d30ead2cd5cc72b162ad47e786d69b2b93a0a4ce8e3c00c39a2f65542b5a9d33aaf1305045b440f436e49c969f28f3ac17cd43207e25e66508d3b9

Download Submit