6a4243e03a0b73d2a0040957d276063b5e4b0e7620003061097e0b6177b91007

Analysis

max time kernel
90s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-11-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IbisPaint/MicrosoftEdgeWebview2Setup.exe
Size

1.8MB
MD5

c56905370fd00d80e6c87146b2b79043
SHA1

366288994801930c7748750811db9e9ce2b5295b
SHA256

7229ef4aff277a824fcd6db51a8df25a1daa638071b469cdde256d50e033e61e
SHA512

8b22b4331c632d63164664b90f6d26c0da0c27c877010a5f5d7a5c3cdd350661b1a2dbbf92c451e9393b379eb9d6054d4e528674957c8fc820f1c1a9459eb8c0
SSDEEP

49152:tyE3dWqT2eiYDKHAdpnrjAMjx2jA0GnvNyL3s0xK:ty3qT2huprsQr02vNyL3s0xK

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 14 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_131.0.2903.63.exesetup.exesetup.exeMicrosoftEdgeUpdate.exe

pid	Process
1988	MicrosoftEdgeUpdate.exe
2168	MicrosoftEdgeUpdate.exe
5176	MicrosoftEdgeUpdate.exe
2248	MicrosoftEdgeUpdateComRegisterShell64.exe
1512	MicrosoftEdgeUpdateComRegisterShell64.exe
1936	MicrosoftEdgeUpdateComRegisterShell64.exe
5568	MicrosoftEdgeUpdate.exe
408	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
3308	MicrosoftEdge_X64_131.0.2903.63.exe
3392	setup.exe
4808	setup.exe
2348	MicrosoftEdgeUpdate.exe

Loads dropped DLL 16 IoCs

Processes:

pid	Process
1988	MicrosoftEdgeUpdate.exe
2168	MicrosoftEdgeUpdate.exe
5176	MicrosoftEdgeUpdate.exe
2248	MicrosoftEdgeUpdateComRegisterShell64.exe
5176	MicrosoftEdgeUpdate.exe
1512	MicrosoftEdgeUpdateComRegisterShell64.exe
5176	MicrosoftEdgeUpdate.exe
1936	MicrosoftEdgeUpdateComRegisterShell64.exe
5176	MicrosoftEdgeUpdate.exe
5568	MicrosoftEdgeUpdate.exe
408	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
4964	MicrosoftEdgeUpdate.exe
408	MicrosoftEdgeUpdate.exe
3736	MicrosoftEdgeUpdate.exe
2348	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

MicrosoftEdgeWebview2Setup.exesetup.exeMicrosoftEdge_X64_131.0.2903.63.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\sq.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\sr-Cyrl-BA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\am.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\msedge.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\webview2_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Trust Protection Lists\Mu\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\gl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\edge_feedback\mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_es.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\dxcompiler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\lb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Trust Protection Lists\Mu\Entities	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\BHO\ie_to_edge_stub.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_af.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\ga.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Trust Protection Lists\Mu\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\mk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\MicrosoftEdge_X64_131.0.2903.63.exe	MicrosoftEdge_X64_131.0.2903.63.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\kk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\qu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source3392_925390045\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_helper.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_am.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\wdag.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\VisualElements\LogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.63\Locales\sr-Latn-RS.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe

Drops file in Windows directory 10 IoCs

Processes:

setup.exesetup.exe

description	ioc	Process
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\ee340d19-36c6-46c6-bc0c-eee59468d74a.tmp	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	Process
3736	MicrosoftEdgeUpdate.exe
2348	MicrosoftEdgeUpdate.exe
5568	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5F64EF81-5A6B-4203-9374-16218714CDFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.161.35\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{5F64EF81-5A6B-4203-9374-16218714CDFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.161.35\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.161.35\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{5F64EF81-5A6B-4203-9374-16218714CDFF}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{5F64EF81-5A6B-4203-9374-16218714CDFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{5F64EF81-5A6B-4203-9374-16218714CDFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99698D87-EF73-418E-B486-267173F3144B}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{5F64EF81-5A6B-4203-9374-16218714CDFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

MicrosoftEdgeUpdate.exe

pid	Process
1988	MicrosoftEdgeUpdate.exe
1988	MicrosoftEdgeUpdate.exe
1988	MicrosoftEdgeUpdate.exe
1988	MicrosoftEdgeUpdate.exe
1988	MicrosoftEdgeUpdate.exe
1988	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	pid	Process
Token: SeDebugPrivilege	1988	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1988	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_131.0.2903.63.exesetup.exe

description	pid	Process	procid_target
PID 5576 wrote to memory of 1988	5576	MicrosoftEdgeWebview2Setup.exe	80
PID 5576 wrote to memory of 1988	5576	MicrosoftEdgeWebview2Setup.exe	80
PID 5576 wrote to memory of 1988	5576	MicrosoftEdgeWebview2Setup.exe	80
PID 1988 wrote to memory of 2168	1988	MicrosoftEdgeUpdate.exe	81
PID 1988 wrote to memory of 2168	1988	MicrosoftEdgeUpdate.exe	81
PID 1988 wrote to memory of 2168	1988	MicrosoftEdgeUpdate.exe	81
PID 1988 wrote to memory of 5176	1988	MicrosoftEdgeUpdate.exe	82
PID 1988 wrote to memory of 5176	1988	MicrosoftEdgeUpdate.exe	82
PID 1988 wrote to memory of 5176	1988	MicrosoftEdgeUpdate.exe	82
PID 5176 wrote to memory of 2248	5176	MicrosoftEdgeUpdate.exe	83
PID 5176 wrote to memory of 2248	5176	MicrosoftEdgeUpdate.exe	83
PID 5176 wrote to memory of 1512	5176	MicrosoftEdgeUpdate.exe	84
PID 5176 wrote to memory of 1512	5176	MicrosoftEdgeUpdate.exe	84
PID 5176 wrote to memory of 1936	5176	MicrosoftEdgeUpdate.exe	85
PID 5176 wrote to memory of 1936	5176	MicrosoftEdgeUpdate.exe	85
PID 1988 wrote to memory of 5568	1988	MicrosoftEdgeUpdate.exe	86
PID 1988 wrote to memory of 5568	1988	MicrosoftEdgeUpdate.exe	86
PID 1988 wrote to memory of 5568	1988	MicrosoftEdgeUpdate.exe	86
PID 1988 wrote to memory of 408	1988	MicrosoftEdgeUpdate.exe	87
PID 1988 wrote to memory of 408	1988	MicrosoftEdgeUpdate.exe	87
PID 1988 wrote to memory of 408	1988	MicrosoftEdgeUpdate.exe	87
PID 4964 wrote to memory of 3736	4964	MicrosoftEdgeUpdate.exe	89
PID 4964 wrote to memory of 3736	4964	MicrosoftEdgeUpdate.exe	89
PID 4964 wrote to memory of 3736	4964	MicrosoftEdgeUpdate.exe	89
PID 4964 wrote to memory of 3308	4964	MicrosoftEdgeUpdate.exe	92
PID 4964 wrote to memory of 3308	4964	MicrosoftEdgeUpdate.exe	92
PID 3308 wrote to memory of 3392	3308	MicrosoftEdge_X64_131.0.2903.63.exe	93
PID 3308 wrote to memory of 3392	3308	MicrosoftEdge_X64_131.0.2903.63.exe	93
PID 3392 wrote to memory of 4808	3392	setup.exe	94
PID 3392 wrote to memory of 4808	3392	setup.exe	94
PID 4964 wrote to memory of 2348	4964	MicrosoftEdgeUpdate.exe	95
PID 4964 wrote to memory of 2348	4964	MicrosoftEdgeUpdate.exe	95
PID 4964 wrote to memory of 2348	4964	MicrosoftEdgeUpdate.exe	95

C:\Users\Admin\AppData\Local\Temp\IbisPaint\MicrosoftEdgeWebview2Setup.exe
"C:\Users\Admin\AppData\Local\Temp\IbisPaint\MicrosoftEdgeWebview2Setup.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2168
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1512
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.161.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1936
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjEuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjEuMzUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OThDRDNEQUMtMzI4MC00MTcwLUIzN0EtRTQ5RUY2RUI4Nzk5fSIgdXNlcmlkPSJ7RjlCRjZCMTMtMTdDRC00NDQxLTlBQ0MtMzgzMThCQzc2MERBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezRGRTlDREI5LUExRUUtNEJDOC1BNTU2LTYxMUU1QTlBOEJGNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xNjEuMzUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNzE5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{98CD3DAC-3280-4170-B37A-E49EF6EB8799}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:408

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjEuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjEuMzUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OThDRDNEQUMtMzI4MC00MTcwLUIzN0EtRTQ5RUY2RUI4Nzk5fSIgdXNlcmlkPSJ7RjlCRjZCMTMtMTdDRC00NDQxLTlBQ0MtMzgzMThCQzc2MERBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc2NjhENjU3LTQxRDUtNDVFOC1BOEVBLThDRTQ1NTk0MEU2OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3736
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\MicrosoftEdge_X64_131.0.2903.63.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\MicrosoftEdge_X64_131.0.2903.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\EDGEMITMP_111F9.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\EDGEMITMP_111F9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\MicrosoftEdge_X64_131.0.2903.63.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\EDGEMITMP_111F9.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\EDGEMITMP_111F9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBC73D6D-EA4E-4DCF-862F-3CE3526A1456}\EDGEMITMP_111F9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.63 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7375d2918,0x7ff7375d2924,0x7ff7375d2930
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4808
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjEuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjEuMzUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OThDRDNEQUMtMzI4MC00MTcwLUIzN0EtRTQ5RUY2RUI4Nzk5fSIgdXNlcmlkPSJ7RjlCRjZCMTMtMTdDRC00NDQxLTlBQ0MtMzgzMThCQzc2MERBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0REMEUzOTQ1LUQ0RDUtNEQ3Qi05RUI5LUE4NEQ1QzlEM0MyOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjYzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2NiMjNhOWExLTg4ZTctNDFhZS05NTEwLWRiOTM4ODQzYmU3Mz9QMT0xNzMyODU1MjM1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUw5NTgyWlBnTzVSMnlvVTMlMmZMTG15SkFKVHpOMSUyZm5jNUU3JTJiRmE1OHl0Uno1VHZPMnlISFN6OUhydW5Zd29EbDBEOVVPeUtGVFJDV2V4U1NrdEZ4WlV3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NTc4MTQ0IiB0b3RhbD0iMTc2NTc4MTQ0IiBkb3dubG9hZF90aW1lX21zPSIxNDU2MiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNjcyIiBkb3dubG9hZF90aW1lX21zPSIyMTU2MyIgZG93bmxvYWRlZD0iMTc2NTc4MTQ0IiB0b3RhbD0iMTc2NTc4MTQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTk4NCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.63\Installer\setup.exe

Filesize
6.6MB

MD5
ce03c15ce3be6b0cb6f6300e3e49aebe

SHA1
cc0710461ca0b8c67edbaec47676af8d729ccec1

SHA256
ceaabd1ad8ac7bab2fb440acc35857134cf6176e74159710b0e8c2c8b376cf52

SHA512
4f125ff16c2fe7a4e6c7b1cb9e1be15162091bdea54d4c6ef554047400a9fa61340564218af8255a8aece0dd93c00fed7c40690f58622ce9034307acaba5f4f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
171KB

MD5
a6415d15911c31a9e9c464202236ba81

SHA1
e02be9c1db3c53f16f2f9bc8935b548995b202c8

SHA256
e047d0e3f1508e96081c7cd9e1613c347a583770c0d8a4571f535053d6988ee8

SHA512
58ab67a64efbd64bcc94d221db3aae1698ae32fc06018bcedcdfff9ac4c2d5716677195526c80ae4183a02678132614f6f46d647a1722e93481624cf91d50224

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
3019ff91babc254f837717e7cb4d248e

SHA1
d5d51f6b337da30128301bac753dfbc76bc20bbc

SHA256
3f3c8c8736fb691c246b2510b3f88f6c7e56ca3b87d8532dc26424dfcaddcac3

SHA512
a781bde845914a7fead19b20cf2843b065f3b523e1beaf76ae4887be4c405c072567bd85e700087054468db35da40bb1751afadf26c6803da48d8375aa9efa9e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
204KB

MD5
c49821b802d62227791c53607b11ec05

SHA1
48e6cb29cfc0a12c069f7c0385a9a46286ba5ed5

SHA256
61fb84ddd048cd6f67791e41090fc343e885539284bf314ecdf7435343e40571

SHA512
3bfc4a244a87012c1eeda0344c04ad87b4a6ce446c706cbd67e26352851e24806d614a74fb0ef53ff253afe14dda3677250049dc058e3020ed26142f1e2e5849

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
246KB

MD5
65d602445e1ec2704c1673eb29ef6d25

SHA1
aea6ee4e56b383e702561eddd85167ba2f6e9c71

SHA256
1fb23553f49a590ef3c1c25dff909ad5c2a6e487305b4a5b95aaf62b0932ffe2

SHA512
e100c268bd40209d3838c604a82337fb8d625e66d631d84833c1c07ae8ed75217143921c6aa625c9299508a3c3c21286d3aca416be6f0d179856e8722cc8d628

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdate.dll

Filesize
2.5MB

MD5
dc59c2c33e81b3063a965475e11ff097

SHA1
5b82ddf4e4c9d4c0e95116d38893bda0746b835c

SHA256
81244d60cff4a360c418d66bede12246519e3f4cc60c2982e584a94dc2187371

SHA512
6fe50bd2f99ad4566f73a33e434bbd699340df4e2af2fc15dac89529c92938a81ac3a81f116529384ec503e886c10e317d34fb7df07e3431f2f97b080f4c8536

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
a71280a50d6e76857552a31fa334e506

SHA1
0c51541b8e898ffbd8d082cc1a44bf6dcc1da12c

SHA256
c04c34cc6077c004a4da68641d4e98e54bedc8da1ab47609a5e45b11eb258959

SHA512
27e532c8139905ec50a0106b1d680b63ff27c95b5ffa66334623d723ca4ec9cc997db2ef3786bd7bac4b427d8bac6aa98be1c317ed9f4cfa3d54d0e080164a21

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
0f6c47c5b1e92171a4fbb5ea0d366b57

SHA1
ac4827f83fd4d54d8f095ad7ca5999bd3d5eb046

SHA256
7c030fa5aea69a31a11b0f5e5fec1316f53c412cf9392faa49126d02aa205dab

SHA512
724c56b229a144102c090d55dbf87fd674f47de2a3b296e9930237e7756267d05a7539755692433644f9b6b5fe34a66d5b5d552ed2999382f5b93b9afdc4b62f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
c0a4f300c56fdbf75d37c9db164680b6

SHA1
b619d79de152351d17e4a00dca83db09487fbeb2

SHA256
9c89e057462ad05e4a6a5bae1faef5aeb8df4621efdb0a8f7ca515674af6d737

SHA512
5dccddafff6c5316e9bcfd0a9ebc7014dec2735e6e7e46d8dbd31130b6510508502222f5ad764aa99509360cd9ad4ccca1cb2f001e15ec3de6b6ae9509397f14

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
92ebc577dbbc24840d4e5528e258ae74

SHA1
ca24f577c76c8b51ef9a89e3f71f33e9175376af

SHA256
84c6d4d4bcaa064de842c9dfa6d76e8566a154582862b21c7c919340f9d3032c

SHA512
3c57cbc6fdb826ebcd158ad32946dfd902d0fa1f4145d0711c664465a228d21018d6e772eae188c6e7076a7ff1159df240c07c3729080a52624b33e63419ab1b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
17e88b471d4958e4e058925d0d681ff7

SHA1
11671f33f681519d91cfaddc26dcb82115ec5f5a

SHA256
8c8c41d2bc6657205847fee817a0eb6e1475830edb01f88d6c7db27b03e3d0e6

SHA512
b42df0248e123809b9100c6909ec9f4d2a92f19d4f0bb9f220148973f6f0ba4c2ec90a99796fba3668f3d706f3fabf19ac58e214c7b9ee4dc3c9880d4a2dbc0c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
746558c6750e73f3754ba792e19b6be5

SHA1
4dab77571e8e592a533ca130f1c0c192e9e8601d

SHA256
f0790479c8c530c9480719123457853e801460d999cbe483dc184e28e0a7c999

SHA512
719800c7850a42f60c23283a12f235758360f19707c74c0e4e783f7120e79da28bdd33dcf9f19e37bbbc38dc693d6c22ace71e056202a3be4f9cbd1b32b3acf5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
767c7f35545a1bfd433cf76b925a3bc7

SHA1
8f8fb79b4024e248fa3d83eb960e695dd104825d

SHA256
3e5a52ee707962e082a6de7b6f20d278079995f90d844828d22c59641d40457a

SHA512
b688f4566584179fc0d30e9556c37b95439182cc912adebc1fb368aa1a33efe76533fd2611451f82e4a2cd88af85c5f29de71c5dad474d6878f4cfad5fadcec7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
8eae440b555baf06bed40e75aeedd4d9

SHA1
8ec5af0f1a6ee1d116c9af9099511401b39fa9a7

SHA256
4e2bb018bb90a0e83066a169b2e7a5ae816d3a55d8f8ebb1ae690bb11c06d039

SHA512
f6589d17e5a87a30b9462c76aabb1c4df3d9d34246d5b1ef7e27ce53ded85079c2aa2ff79c8b8e97435ff4769b234b31f37308a1042adddd6cc5ece8aefedb5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
f238e6bb98db09cf7afae4b07f9f9e16

SHA1
37c5d9e38af3888d8ff78c731e21b89dfdaac274

SHA256
17ae50802d0fafe4dbb814bc66cf6428937a7309b004267450927dfe50e3b911

SHA512
2d05f6270360f132f4211c275603cc4a685f56e1372330246f93ff41cb30048b6295086feb538923cbd29cb1db5834d162aaae0e9b6de18d96c99d168c626934

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
783b5af69b3d96b39410939dc7300fef

SHA1
2f59b5e8c2ecadb79b244ae83484f59dd11f2642

SHA256
d9d17df5ec0316f1170a233d0c549f30249da26b60aaf35eadfc4465e4251d8e

SHA512
3ef4b68969efe3cfc1020940da0739abf5d75b5dc47a5651cac3d5f4a01db40a8fc3728ab0f68c9a6832041a331bd36c35ab1f49776f3b5a405048c517ba6c81

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
d6b91bc282b88aa57f771075aa42a43f

SHA1
0f83001da10c74436523e5f7d83ad45614dcf2e3

SHA256
fa420c7864471e58a0d65acab285ac22da24d2093a05675cc695c0c706321814

SHA512
8576d0f596ad836b4ae7d78c4454f5fbd69754096e8ad5bb98fb9c6b3ae680a703ce61018cf8f39dedd378d22148c2bdc70e8cd8aa50184c6e0915ad8cdf8b61

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
8b1bb4be8254daaaa0a64ef20d27a9ee

SHA1
fa32617a93754c7ff9409d1b231ca5d93f856181

SHA256
b35b25f4b7f7895ec17105ced61c6ac60300b0809e1a4ad775c925a81c818552

SHA512
838f40f61ce9e36fe8020e9ead9975a1f76801b4fcb7e13a5b93f8ae577c743f2fbb48330bd7c2d45dc1d7b89d6bf40752cf491b73b98a9e01e6543cdf009042

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
62eb6f6f09cfa88f31531fa0cb3b359c

SHA1
aaaf47f44aadb1da1bda33d5d7232102081111bd

SHA256
71afb17e61d174ad9c477a1f35d2c29e234fb440ace469e036424e66728e077b

SHA512
b49096bb1224b136a42b5a06eec0004975693a191cfcb4d5ed97b3d02f0b7a23bdfeed600c99e04c6d4255208676174e5745bc64d4316221b32cee26c1c1709b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
6e696363a94b084433a07b71df71d3c5

SHA1
fb47776586da502723811b0b1816ef108464b585

SHA256
db2291b67e15f5de9eace3bf66e4d860c99189ecfecded74b03a9669470bc5b9

SHA512
708271208a209473a20d0057cd9186151145b5d50c2a453fda0b228528654695453f197e12d3c2b0b39160685e2d15b70d380b3a3adb67c70094b66bfc7f175d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
2fb9bd1dc96fdce233db6ff07a7b6f64

SHA1
3c204986243adb10efdf4199fa6aaf2606af3b5e

SHA256
8f3af5e7106f5b7d1a41ec2e8176fabdf729eea5d9de445df08549ef1fd4e62d

SHA512
9e163a18bfa24f89919f4b27cacc185aab1289a3fbc80b93a193f5fcbd329237c5f110ae54c7e0291eb82e01dc1f4d780f19c7929b75631c779ad0139bbe007a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
e80547cffc043afbd94255de40187146

SHA1
f3a2bb59ebe1f634004497dcaccbceaa3f16f310

SHA256
a52559b4d14a14daed3e6a77b17cc7ad349fd7e4c1efcd7981f1be4949ecf321

SHA512
2407ced3e76a2efaea7048a5796ed8a225fac0c4926b3cb64335a987393fbac51080c9749184e27820779dde2388802e0077570eaeefa36fe60e3b77778e2a8b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
c603e58dcdba66adccbddceba1faa082

SHA1
b924c948b749ce496cb0dd5fc4bcddb79eb15716

SHA256
31d11647f329efc4d80052d81e372f493b8d8ff6de68e70d45e80fc9453d6245

SHA512
39eab00ef1988a10d2d7b70d0687c124cd658c614884689a39e65bc90afff6f53915339ca565169671b4864a6814d1a139068f894f630b6ca3c130e53ebf7be3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
11352071d40ebf9cc38d6af1038948b8

SHA1
e2a18e0c5ada72b0b276453f3c66b92d81f4789b

SHA256
814d07739e351e569594bb23e4445d58e79ef3a160d660218a3463d74df272ce

SHA512
d8ab0ad2193b2b8d3982349a1393c84efdbf207370bb5b8f1afd41ee34789654762782d42f7cfc9c207c3298b7aa13d8cb9d52579077c4ad2eced8f084fbcb49

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
b7b9997ef92cc5091ec952b62873ffaa

SHA1
49ace9cbde7cf2b45d0fdd649e2f82dfc2dab4e0

SHA256
4baae905be87e3e8c2526ca253b604e4653346d53a612c82246ad29208027318

SHA512
a2826d40786586d392dce97766793a418fd581e44045385b8ff08f111222f3ee8fb35547c7a84a9c0b9b8bcb26816459389c690b010b0038ae8bb0a8de775919

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
052646da0bd66f6f01c5e3a470771b7e

SHA1
a9fccdfddd51e289de475ec4c7cbe355a9474c3c

SHA256
2e106f92677ea291bdcfc18652cf7e8d2faa51043bf63f5b41ebd66b9f2c9ba3

SHA512
c16adf03d57867f41cf7c9083b55540b7430acd547abf2b6462c34652d517904fd379bca88846d14130a5f31078b451c5631f7f1c63ba87051aba916f8f7804f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
1db168506125f6ef5ff65d8cc4a35a6a

SHA1
96df62a5f82cd31ba6dd35e6f435f9c2e0d23bf7

SHA256
19dc27c8efee9f71ace49a7f49b6fb4a952ae5dffae815b022c70a200e0cd58e

SHA512
5631dfdf861ef3e5163cfa28f8da9cd243d8409e947759b257968d4e9c4b20e45921efbfb5389621e7a0d8e845530d7d43bff9e7d9157ebf774cc5c236164ea0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
673b70eef24ca9f65cafc05b4a3cd449

SHA1
201643424bd8bd898baaca6d7692756f5eb498f8

SHA256
b398ef0afd5d52bb972215653ed40b5fb74279848bcd2b3391ba72ce06ec658e

SHA512
4b66967706141c3c7e32cd26aa43dbef7d3f9c46835abd5318601415e54c8a3c6955b5797889279fa8620cff220d83a0df83b281651c6a17d7f9b0add1a8472a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
fac0ffd1844b756819bb23dff40eacc2

SHA1
6bb2bb32c518bcff5cc3846362709417a59564c9

SHA256
1535c386e9edc29af7b672a4f88a2f00826b27a321a1ec3355a2d026f3bb3070

SHA512
410c44e53aa01ccdc2015a950f4fbe60fd58784fc8f034e7155481f80ac09b6eb07cf432c94282468dac465c6c0a8d4f2fd4d759a22124987759a58c79592f42

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
1f4cb10e0bb9cdb9514d659004f1d767

SHA1
b394859aeb9e1e50439b475f1190459c4ed84981

SHA256
488e0ff0c7ce9521907ae4a32c454ce62edeb902935b325a37e54e627599db18

SHA512
38aad510ad50a3187d915ed3af30f8cc73ead74cbc1d252761e58736320d8c1618dee63cd5c3af3ef17295c88be87bc9629310456b866b1643628c53e2d15eec

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
0b3e31002ad0abcf2869d650cf928f70

SHA1
d735ea08fbd0db66fd8405a688197e318ad027bc

SHA256
208c5e2c964a455314af3c56878b3a2a05ed57d6946389c34c085fb9a8e4b4c3

SHA512
6146f71378ad31109afc27b2914dc895054c13ea695e916f7685836695f8e9d64e3dbecfb1fd6d0c31970637c735eb537ec1af560e6e52ff485d236c3d31f1f0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
8de7110aa911629cb1802158fba084ca

SHA1
b751df82aba9e71985c148d9325dfc17a580f1a3

SHA256
134b4461a12c070146ae33e73d9deed42ce3bdac5f9a2e89236e273a9f021cb7

SHA512
688864964246ee54ffdff7cdb1093ec579f41966ed5881298192a84b726036d690b98d8b2a7a5d1823f0b4ded51f0b72db2317b96f813ad6ee45e464decc67be

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
515a7527cf4b94593347c16fdbf25bf4

SHA1
1751ca20e8fc4a479dc86a41c48694fbbda5982e

SHA256
5e9204181b784d551975c2c054f88e89a493d801c3863a8f356658376a42bb42

SHA512
8ef9c0ff894165c29c1c93e91930eb222fb1d42843558250e46b9fce8c074f235e8b0adfb8352d4dcae33d279fb94c64f3d79f98a3286fc289239d1f6582f094

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
b60be9e8e26468b7b0aeb9ea1a17d833

SHA1
2c06357c115197cd7de9f50cd1c85f48a5690a52

SHA256
95767e328730c19555979a32503b6c256a2ea347bfd0fe7f657da7691535f540

SHA512
b85d8abadd84cd2008ca23814cee40a86fd932dfd02291a8e5048b6900ffa35f8e30c8b2cf2d7703a5a1447fa306090fdd6b3a94f4cb1906bfddb2f9b91e84f8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
b35404edb6692700143d86899edca377

SHA1
bb461e492629e527fd12d5f401c384779ee52ceb

SHA256
65101a4a85b261947f5f773bf421eb7ec678d731a91e4adde392ee66f5ecbedb

SHA512
bbadce5fbaa017d10cfac8575da2408e2321c81e9cb424c00313c3f41d8b7a3c769277ab72bac3e36edfb36b0dd5fc583ddf6476f412d8fa637c8b4242a0c72d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
5aa6f5a8c320b8d9734fb1f535af2d07

SHA1
7ca7c6dff804bd7de2d5c1ad5f6b66099d586057

SHA256
f41f72594584dca308781b97c4a594bfe1622b4463d4ce3ea7b3c6294068c47a

SHA512
f39ed531d9c7c1241bfe73776954b56acb36c75871da9a62e1e40941dbfc94c4dc2a873de116e97d97c6247513f347912302ae22c92d480e828fc80d2e706fd8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
ed199a3ec5498e0031049cfcf4ba946c

SHA1
ecef046ac17b7560ebba49cad569423e91dfa934

SHA256
9dead8729c9c009f26a3be711c1b1054971fb2a1a92ae44d8ef28f8e159c3372

SHA512
8140474780e93702f3f2fec90959873092c7ed9d7bb45b2738ca7062456dd6e33508293d9c4e2274c032ccee1272ca89a2db287d8a67a4ec81b49988e80be6a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
4bd89d273dca1d0d396f8b8a418eaefc

SHA1
84e8ad145765323867bc66eca17c102acc5bab57

SHA256
de646b541159c70ace5cb0321bc1e47bc8e56386ea9f36e937e99be566322508

SHA512
f10709bb34c4695873ca9b10c311fbbe2e0bca134c1486105d500665dfca7a8058e4ebe3e9327aeb351cd13219034d0cce4cecb5c7598aa7839cbe8f967987d1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
f795f1769894b5a4df597f503059c59a

SHA1
07ba4e980452059c70c4573b4d7415f479995e2a

SHA256
b487d31f715699b154e6e34c16b45437dd1ac8bc3100f5cf064765e9b80b561f

SHA512
3b62a212e13409af55c009be082d849356ce7821a17dd6d82b77fe3ea3967311725b412d883ba9970e096924637dfba21edf2065df728fde16c5a3e6111f55ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
ec8dd379768994f78ad0e922396e35e4

SHA1
e470bd1072bf69696d30a84cf1277530f2e3bc97

SHA256
aecbbcf737d5aa6cf595a98e208ba39f357d06025f22324c5063c6588f33f4d6

SHA512
9064eb1cb1ecca82b82711fe2c9b2009a37e18003c3090fbde99fcde334d794ce162501d06ec070cd556ef68900a91d6ac8dea2b2ccac1d3f3f5660ecd5d24bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
c1db547ed86cd70b7cebc165c32bf186

SHA1
64f91f7d8bc426eb314a01d9aaac867aeabe3d05

SHA256
cdea0d2d19767ed280d4a3111d48d814622776cc091fcd3c3f3ea22a16897b0b

SHA512
2136a1787e258d085aac92f081cd01e87305409b64357631c3698d9d412d1df91a5e0d9e25181798c4d41d6346d64c2133d382095c1945b88e6226a3a0bdba9a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
2991e96c8f3abbf01ae179cb33a83d76

SHA1
1d26863bccb658ea3811882cd7052d608e12efe2

SHA256
0cfb96319991bf6b5c425b508fe538f5a80063d55894e6f3c78f6110e6c60315

SHA512
67a50a44e69112c23078381293579a501e00c6521cb3a557ce99764e6b74da32b1e635600c1ef3f48b5bf271d31b6f49e774c24fadbae31980d09952f0482e45

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
0dfa0fae6fafb4bb862bb808088ff97d

SHA1
7a58b71e0eb4190c2b32b912664503f5758161e2

SHA256
ddae24090ba4bb58ecc1953030cc5f98af933aecbbf4583da690c266f818ba09

SHA512
bfb75f7df59345a6e01261094322b4bdc073bab9f61fbde17dfe703058ced27c882c6ad22bce07423ffa2c523c6fa1cd2c77ac7321b119bf598f1014e1ed898b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
635b796b7c0dfea2e213c84b1bf6f263

SHA1
a3403f399a89e01162a76bbcd27740b2bafa32e6

SHA256
b8e434c6d3107f1a0ced58f3537f6d1a66208c4fc30490fcfbe00a71c204ca43

SHA512
ce1a2cfe478eeaacd247db94ff48af11d1dd0bec2910ae1edb60382f62b6820ae9d42f159d1fc39e86c3c06d51f2584b8f67f5c972723c6cf8b0baef4e24fc37

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
1a465de82fba57c9eeaf5f78b715f5db

SHA1
94b430b54ab2383873279c01a6c7efcd9aca847c

SHA256
d05eae2b6537595022c58294197b8a4089c6b8bf8740f1de0e6fb96510d010d3

SHA512
0999aa1b9875c777041a68bbdc6adddc152d18cc6390b9b731539f98846988048b6f91486550143d1ce517fc37cee9340174ff6cb2babe1d9d4c9f91ff879074

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
5cf9a0b59ff5d2a0b05cae1ddbb24e3c

SHA1
129a55162126c9111e7deadc389f2c07f2e7e192

SHA256
6862e07293efffb2cc55b421312febdf03b176b0defb1b9c1b08ccbfca375746

SHA512
b458f61307e50273a46f2cd1479647472d72fcf190aabded20e6ebb99be2a5007e4d58ada2206729a0e1f1d64f246a3e27fe890bdaf2d210da481494542875e3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
504f150d922d0ae87107a67f1fba11f6

SHA1
e3751a4eab5392d5df5be69f780c8abdaa49ea3f

SHA256
f65076c393167701fb60df6e1cf422701a6c4c9c8ee9484db1068dd143879e7b

SHA512
014991221c77d51d770f4fe7bea397df7c9a42a1ac6042ab8daecaecefeb27ce79e5e5f12fbdb2d7b4d2ba5a49ae2a0b28554aeee287571ffb8ea1a612772110

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
06c2a4dbcb8b7983724569dbeeaa5b97

SHA1
5811e171d931a6b339120420113cb8d2e4d806fe

SHA256
d11dfb4665f3f8285e3bd2571becec51f698cbbccc6f6466f3afe02ad379eae6

SHA512
df9c49e95d67f7cd35d46d8051c374e131d650e9c527178a6693a703c4b01673997a415d6cd41506a6dc25e1752aa30071b7b0d950a983fd2353626d42cbe289

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_kn.dll

Filesize
29KB

MD5
3117f3d36acf29cf051d3f7affb87af4

SHA1
701e792b6e486deaa325657255363870d2732e6e

SHA256
3de9a0b4739b98b722a4e1f722f8b983a7d7803fdd2cbd35ebcef13da4e43884

SHA512
31a043675d9fc376d1d49b1609591e69d96dc021faea8250b6dd848264311adca88088a17ec5b4aafb8fdadf742b8fd0269090fed39bdb9f9941f118fe6afa02

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ko.dll

Filesize
23KB

MD5
a1a4083264b90782d55b6d5c8bde1ea9

SHA1
4f32aec341608f0230ff447c9aac336d1fee9401

SHA256
5e4d8d48d8d855091ef1c616f882f28885e33fdc74786c544c3ff14c66feeaee

SHA512
9cf406ec2763a1be02dfa2622cd38324b83d78b07c6387b5e9c5bc0f4937f89f68d22d6433746abab504cfba557d2f824008f0a5b5293dba079135e64b012225

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_kok.dll

Filesize
28KB

MD5
2416142eb28c88e8714aa83bc27d407e

SHA1
48972ab0db28f144da6f40ce66be8556d451d689

SHA256
384c9440185f79874bf363e42baa7d7928d25d9fdb6686ad5d2d289a8cf6f64a

SHA512
7a75fbde1898a0914459f872d0bfc8d117e4a3172c2eddd07f4dfc8e6cb4850fd520bae1436b583762aee90ef6323ed390d16cf350fbb44d2e592b19c9873ee7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_lb.dll

Filesize
30KB

MD5
64af5be1cef4dd2b92fc0d4e79a95725

SHA1
84640015f0388b6175dc0b32ed0baa9833cd56b1

SHA256
5deac1908b357118d280ca3212def4d43a74871db354e9dff649c178f9498268

SHA512
91a78896029c594a79a093bcdf918848ee36e9c6fa5d6ba1fec52f37fed6eb7940102bd42a0ba886d249dd43b7337b95579f3aec3a6a278f8ac6c771980d4dbe

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_lo.dll

Filesize
27KB

MD5
a8c3e7e68f79234f04898de2c0dc1f23

SHA1
b675ecc96fe068f56bc48f956fa394147b520b88

SHA256
60f20c9a2c5d99f900418703dc5ef4d62b60372ed77195f7c3bdab4871c245dc

SHA512
891c12167b5843cadd1a5d5b429cf92ccea45e8f9337d7b257a7c88a21ebd7ed91c7b1a9fe52b6e136aaedffaae9a95645d0a94d2ca90aa9d6277aa5a9f1c245

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_lt.dll

Filesize
27KB

MD5
9cf86ce8216888820dd656d59486e17f

SHA1
db60a97ed62d80e705507ed03f0cd729e39649c6

SHA256
477e433a1413987ac374f3a28d1cf23a56c30db44b28fc4a5b180e902354e948

SHA512
78ec640d84a54b26ca559671e573551075fe6222b6e2a401dc57060d6e5b709295a6f8ab380518557b4f1601f5d48dad475be4ba0997b3b27886e18cea97035b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_lv.dll

Filesize
28KB

MD5
dc1dd3cc97f422d457a9195cd61987a3

SHA1
381cf8d949deb6c6b9372438c1dcf1203b6ee2c5

SHA256
c74a02c85c0bc70bd5b44e9f8dbdfa6b56501f7c516a0b023f19dd52c94aea1f

SHA512
7d697fca830326d3c10d24d8fea9371f9b9034c5c9ee50ed49250f12a29f9347d2cd26da26c57ad5437f9fd393ca5cea6745c2a0fb117ae09a8d7bf8a4bd1465

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_mi.dll

Filesize
28KB

MD5
9b450422f047aaef75770c25e0e4a345

SHA1
ad6e8b4f331bb142c0234e49f742c6ba5027cfcd

SHA256
980adb83e4b9f76d5b1f665112ec1193d5bb5eff371b2750d35b89b15f749575

SHA512
ab1181b1c02ff7077b2edafe106a579f5e5b6a0a8a968446b41ba84cb7133c5b4eff32c582433803be29b762b1d6f6b0f33a95d8f8980097082581f131d023f7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_mk.dll

Filesize
29KB

MD5
1c0e0a9033f6283f10fcfa4ea5526d86

SHA1
7f7b9f22cc8d96205af4d12851e28615142e473c

SHA256
5a3672bcf5ddb5bef42976d67e49ff7037ea4a0cbb45d72241fdb4b107822fce

SHA512
856f7023084f3b371b69eefe4a626e1517bb7b311bd87aa056cf3c6479cf4e2dd03535c9293fe688fc4bcb10d41b504def820b965b15674406522582f768b8e0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ml.dll

Filesize
30KB

MD5
117250c29c76357bcb2139b05c8b20fb

SHA1
71508ed2a9d0986c0e629767ce003be6c857bd89

SHA256
8d251198d2aa68f7a3345cc8c2e1a724f9711f215a7a55b312bc4f43f9ae016f

SHA512
1c0430b82a1a2d716f6a288816488adf483a74ced3a4f905a88eae2707fce52384f19b2d26199dbacc8161fd42b6384e09ca290fba6cae195f20b9c737985501

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_mr.dll

Filesize
28KB

MD5
a683ebfad2752af7cfb0c6adb15a0032

SHA1
5a8076da1331924ba1c6ba2a61fb110f835645ff

SHA256
4dec9f8b611ae26dd38b6fe4ca07900aa6c4da29fb40c32b61bb4044b151ce65

SHA512
3835d6e95cf83f719b0c53b78c0dfa332621dc53d7be9d88d6e5ff4ce0dbe184becaa740b9151d5585c42683089104001074ab544a1bcaadcf80fc8ad231b31f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_ms.dll

Filesize
28KB

MD5
89a1adbec7529b39e17f312607c4c28a

SHA1
a0bbf0fb419ae76ea6b8dc65ba01695b15cbbf23

SHA256
0334faa1879862cf1f9b5797d7254b517716512dc66527ce1733f9ae3fa3bf79

SHA512
50d59450db3b6a5cd1082a203381d6255708fb502d205f55e6c3094e31dd28ca16da164b7cb77250c32df6249d19e124ff241755cdb37c7cc9b2b9f7345ac5bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA921.tmp\msedgeupdateres_mt.dll

Filesize
29KB

MD5
385abebbfcae966b0944d0d7b25511a7

SHA1
d47ced10703d8988c4cdb84b865306ac87d2af43

SHA256
7a49039d9df13af558eaedea0ca70613a24253da6ec9f743dfa4275383697681

SHA512
6472593d008be26acd36725d42e48700d9b93fd766e329f08c5ad1f05bd8001a0df0287c6f86161b7366c9ec90bb8983356bdfb402a9e76a4bfae50022031c73

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
15KB

MD5
dc2d4128bf8dcb3f2a5c28ef41afbaf4

SHA1
425301cf578a50a0d45570cd4ddd29252c38d893

SHA256
8d6fe3768a67df11e49dc0fc22e0bcd0c8ae724fd3852a9f116d9f45182fe097

SHA512
34271dc022e7df43c37b3fbcfe0015b4552d3ab944eafe8fd467c08d3fb2584bbee041ab29e6fdea668650e756042306be868218f68917e3ade499fbf394bf76

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
2b743afa2ee6b128a547ff4c1181ca80

SHA1
c0ee498a0bef98eaf6c8e593578585cd63ba167f

SHA256
abcb9f5e6f3d04ba7730726224e09675f8d18e238b33ee7de57cf062d97f3db2

SHA512
c02648b65d0e180764bbad863f9f6238ddc7b47048627464f630999ba125e6ce2335f215386950b02ba36e5d5a2d943b26b078a9ab9020467187b7fac877bdad

Download Submit
memory/1988-193-0x0000000000BA0000-0x0000000000BD5000-memory.dmp

Filesize
212KB

Download
memory/1988-194-0x0000000074350000-0x00000000745CF000-memory.dmp

Filesize
2.5MB

Download
memory/1988-234-0x0000000074350000-0x00000000745CF000-memory.dmp

Filesize
2.5MB

Download
memory/1988-250-0x0000000000BA0000-0x0000000000BD5000-memory.dmp

Filesize
212KB

Download