a083bcd4d9f7a1be18de94dbc3afc2b511b5117d55feaea8f9608692e5d1797f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LineageII.exe
Size 2.6MB
Sample260604-pg2enses7z
SHA256 a083bcd4d9f7a1be18de94dbc3afc2b511b5117d55feaea8f9608692e5d1797f
MD5 f58c569b97fdfa674b94033c9b054c09
SHA1 61db8cc206b217d07066b46f6b08b900d4a90f6c
SHA512 5f7a3daa1d173756a1b846933c993796f1831e5caf5024729b2866fd37628fb055bbbafe189e3dc48e965824374c9a3b2e2aad4a295d46aa87a79c8de8627753
SSDEEP 49152:40v7Rm5tvOnc3zW2rPaexWaf1LTkBBrlZIXUw4+5+O941hR1EAVOm0qiBxM4:Vv8zvOncDLr9xWafqQXUJ3O9EEA4Hqz4
TLSH
T1E8C5331463EC9A52C17B0ABDF4B6270A4E36750615DFE6C84CBCA9C485E7B803D187BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
3376	WebView2Setup.exe
1060	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
220	MicrosoftEdgeUpdate.exe
4072	MicrosoftEdgeUpdateComRegisterShell64.exe
3288	MicrosoftEdgeUpdateComRegisterShell64.exe
2592	MicrosoftEdgeUpdateComRegisterShell64.exe
1436	MicrosoftEdgeUpdate.exe
1548	MicrosoftEdgeUpdate.exe
1012	MicrosoftEdgeUpdate.exe
3908	MicrosoftEdgeUpdate.exe
2444	MicrosoftEdgeUpdate.exe
4984	MicrosoftEdgeUpdate.exe
5020	MicrosoftEdge_X64_148.0.3967.96.exe
4264	setup.exe
3988	MicrosoftEdgeUpdate.exe

Loads dropped DLL 18 IoCs

pid	Process
1060	MicrosoftEdgeUpdate.exe
2968	MicrosoftEdgeUpdate.exe
220	MicrosoftEdgeUpdate.exe
4072	MicrosoftEdgeUpdateComRegisterShell64.exe
220	MicrosoftEdgeUpdate.exe
3288	MicrosoftEdgeUpdateComRegisterShell64.exe
220	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdgeUpdateComRegisterShell64.exe
220	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdate.exe
1548	MicrosoftEdgeUpdate.exe
1012	MicrosoftEdgeUpdate.exe
3908	MicrosoftEdgeUpdate.exe
3908	MicrosoftEdgeUpdate.exe
1012	MicrosoftEdgeUpdate.exe
2444	MicrosoftEdgeUpdate.exe
4984	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdate.exe	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_ca-Es-VALENCIA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_sr-Cyrl-BA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_da.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotDev\StoreLogo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\VisualElements\CopilotStable\Square150x150Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\lo.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ml.dll	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ro.dll	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_kk.dll	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Trust Protection Lists\Mu\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\ga.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\ru.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\voice.contrast-black.svg	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_lv.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\bg.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Edge.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotStable\Wide310x150Logo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\identity_proxy\win11\copilot.identity_helper.Sparse.Internal.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_sl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_pt-BR.dll	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\learning_tools.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\vision.contrast-black.svg	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\am.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\elevated_tracing_service.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source4264_1378282463\msedge_7z.data	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Installer\setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotDev\Square150x150Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\ja.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_id.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotDev\Square44x44Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\msedge.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Trust Protection Lists\Mu\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_nn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\ta.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\vi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\copilot_overlay_strings_zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\VisualElements\CopilotDev\Square44x44Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\pt-PT.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\VisualElements\CopilotStable\Wide310x150Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\bn-IN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_id.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\psuser_arm64.dll	WebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotDev\Square44x44Logo.targetsize-16_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotDev\Square71x71Logo.scale-200.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\VisualElements\CopilotStable\Square44x44Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\148.0.3967.96\Locales\copilot_overlay_strings_vi.pak	setup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebView2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4984	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
1436	MicrosoftEdgeUpdate.exe
2444	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB92A19-3D25-4335-B15A-EF459C697928}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.237.7\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.237.7\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.237.7\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB92A19-3D25-4335-B15A-EF459C697928}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38345CE1-0611-4C00-B242-2B2D2FB723BE}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{38345CE1-0611-4C00-B242-2B2D2FB723BE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB92A19-3D25-4335-B15A-EF459C697928}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	MicrosoftEdgeUpdate.exe
1060	MicrosoftEdgeUpdate.exe
1060	MicrosoftEdgeUpdate.exe
1060	MicrosoftEdgeUpdate.exe
1060	MicrosoftEdgeUpdate.exe
1060	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	LineageII.exe
Token: SeDebugPrivilege	1060	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	1548	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	1548	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1060	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3376	3024	LineageII.exe	80
PID 3376 wrote to memory of 1060	3376	WebView2Setup.exe	81
PID 1060 wrote to memory of 2968	1060	MicrosoftEdgeUpdate.exe	82
PID 1060 wrote to memory of 220	1060	MicrosoftEdgeUpdate.exe	83
PID 220 wrote to memory of 4072	220	MicrosoftEdgeUpdate.exe	84
PID 220 wrote to memory of 3288	220	MicrosoftEdgeUpdate.exe	85
PID 220 wrote to memory of 2592	220	MicrosoftEdgeUpdate.exe	86
PID 1060 wrote to memory of 1436	1060	MicrosoftEdgeUpdate.exe	88
PID 1548 wrote to memory of 1456	1548	MicrosoftEdgeUpdate.exe	90
PID 1060 wrote to memory of 1012	1060	MicrosoftEdgeUpdate.exe	91
PID 3908 wrote to memory of 2444	3908	MicrosoftEdgeUpdate.exe	94
PID 3908 wrote to memory of 2672	3908	MicrosoftEdgeUpdate.exe	95
PID 3908 wrote to memory of 4984	3908	MicrosoftEdgeUpdate.exe	96
PID 3908 wrote to memory of 5020	3908	MicrosoftEdgeUpdate.exe	99
PID 5020 wrote to memory of 4264	5020	MicrosoftEdge_X64_148.0.3967.96.exe	100
PID 3908 wrote to memory of 3988	3908	MicrosoftEdgeUpdate.exe	101

C:\Users\Admin\AppData\Local\Temp\LineageII.exe
"C:\Users\Admin\AppData\Local\Temp\LineageII.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Roaming\L2JDev Studios\L2Updater\1.0.0-release\WebView2Setup.exe
  "C:\Users\Admin\AppData\Roaming\L2JDev Studios\L2Updater\1.0.0-release\WebView2Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2968
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2592
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezRFM0Y2QkUzLTA4MDctNDk5Mi1CMTI5LTI4ODg5Njc1ODVBRX0iIHVzZXJpZD0iezJERTdDMUU1LUM0NTAtNDUyRC1COEVGLTlGMDNENEY3MkMwN30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntEMjBGRTdDQS05OEJGLTQzODAtOUU1Qy00OEQyODhGNTVBM0Z9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzVGFURlVvZFZPNmJnOXlubGpzQ3VscUMyTldZYmpiVEpEbHRmQ1B3VnlnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjY1IiBuZXh0dmVyc2lvbj0iMS4zLjIzNy43IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDkzMDU4MDk2IiBpbnN0YWxsX3RpbWVfbXM9Ijk1MyIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1436
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{4E3F6BE3-0807-4992-B129-2888967585AE}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1012

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1548" "904" "808" "900" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1456

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezRFM0Y2QkUzLTA4MDctNDk5Mi1CMTI5LTI4ODg5Njc1ODVBRX0iIHVzZXJpZD0iezJERTdDMUU1LUM0NTAtNDUyRC1COEVGLTlGMDNENEY3MkMwN30iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0iezY3NTY1N0ZELUVGMDctNDQ3QS1CMDZCLTcyMEVFREFCRDYwNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3NUYVRGVW9kVk82Ymc5eW5sanNDdWxxQzJOV1liamJUSkRsdGZDUHdWeWc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Nzg3MTU4NjUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQyMzE4ODQyMTA0MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDciIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwOTk3NzM1ODYiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2444
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3908" "1108" "1080" "1112" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2672
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezRFM0Y2QkUzLTA4MDctNDk5Mi1CMTI5LTI4ODg5Njc1ODVBRX0iIHVzZXJpZD0iezJERTdDMUU1LUM0NTAtNDUyRC1COEVGLTlGMDNENEY3MkMwN30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins1MzU5ODVGNi1FNjk2LTRDNjItQTAyRC0wOTFCQkQwNTRCMkZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtsU2Q4YWJiSmhqcVBkdGFVT0VLMnZadGtib2sxMWI1RVkvWEIxUjMyZTlVPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMzkuMC4zNDA1LjEyNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Nzg3MTUxNjEiPjxldmVudCBldmVudHR5cGU9IjMyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI0IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTA1NTU1MjM5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4984
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A528986C-6238-47D5-A6B1-88B729F0A12D}\MicrosoftEdge_X64_148.0.3967.96.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A528986C-6238-47D5-A6B1-88B729F0A12D}\MicrosoftEdge_X64_148.0.3967.96.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A528986C-6238-47D5-A6B1-88B729F0A12D}\EDGEMITMP_2FCE1.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A528986C-6238-47D5-A6B1-88B729F0A12D}\EDGEMITMP_2FCE1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A528986C-6238-47D5-A6B1-88B729F0A12D}\MicrosoftEdge_X64_148.0.3967.96.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:4264
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezRFM0Y2QkUzLTA4MDctNDk5Mi1CMTI5LTI4ODg5Njc1ODVBRX0iIHVzZXJpZD0iezJERTdDMUU1LUM0NTAtNDUyRC1COEVGLTlGMDNENEY3MkMwN30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins0N0EzQUZCNi01NzYyLTQ5NkItOUZEMi1BQUZGQzkyQkI3OEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtsU2Q4YWJiSmhqcVBkdGFVT0VLMnZadGtib2sxMWI1RVkvWEIxUjMyZTlVPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNDguMC4zOTY3Ljk2IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMjEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMyMTgwNTA0MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzMjE4MDUwNDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDgwMjQyMTgyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9kOTk1NmE3Ni1hYjQyLTQyOGMtYjY0Mi1jZTNmZTY0MTZmZjE_UDE9MTc4MTE4MDY1OCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1tbWhaRCUyZiUyZiUyZkNmenRwUGdrRmNBTWV6dVoybm5UQmM5bmElMmJEWDRzZHdua2l1Y3J4T1VrMlVIc2xPSU9BbSUyZkRPcCUyYnYwVHZGZmRjWVNqM2ZJNUV2UDklMmJ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTkzMTQ4NzkyIiB0b3RhbD0iMTkzMTQ4NzkyIiBkb3dubG9hZF90aW1lX21zPSI4OTg0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ4MTE3OTY1MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0OTU1NTQ4NTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3ODk3NzM5MTciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyMTQ1MyIgZG93bmxvYWRfdGltZV9tcz0iMTU5MjIiIGRvd25sb2FkZWQ9IjE5MzE0ODc5MiIgdG90YWw9IjE5MzE0ODc5MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjk0MDYiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.96\Installer\setup.exe
Size 5.1MB
SHA256 a14996885114643e2419d470a02c29d182bddb0204565ab1987cff0c01774492
MD5 153532b40e866cb6182c56b775408852
SHA1 a6fb303fa275587b01cab8c2f8edf0e6cb444e71
SHA512 31b13dd01a477621ffc0957c5abcea63d6b84f44a48149ed6f966f0488e7f5a6d5c25a741c048f70bbd719e7268993e6c8807dba0166f58d4f496ee05c7a5ef4
SSDEEP 49152:7kbWiBjUoRwzIf14MVpTj9kvVDy3veL0OIlFuxFdcwMTvMcxW53or+950geiwvBG:gb8MjH9NlFGku6+fEaT
TLSH
T153366D03F2EA41D8E0BAD6798BB69232E976BC454B34A2DF065136151E35FE09F3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopilotUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\CopilotUpdate.exe
Size 22KB
SHA256 01093a46273f0cb2a5c1882bc4e7e5dcaec20329917d5cc68c3703cddd89d520
MD5 619ce8a6fa7aac85dc395f04ac94087a
SHA1 2806513b33b1858cdf29ddbdec1f916793e79ceb
SHA512 398e709aa84a80fd3e784c624e815f92e63179179e9a32815c1c704f6a4a39ab09128bcac242d1376b779dd185cc3ab49db9da828d127ad08a852a5d8f3c4b30
SSDEEP 384:7+71xOBF1m6yWAH/ELvmtmKeWk44y2y4GlNzqki+R9zB6zOZ:iZEdm6yWLqEKkUZ9zEaZ
TLSH
T16FA28DC2A7788083DADB68B04469DD437C39AFA34A605BA76085F45D3D277C0F7126AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
TLSH
T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 190KB
SHA256 1c904d7076f36b18733eeeecf73c633b870d5e8ed140976fb5132252db3373ad
MD5 637cd9b3e6468149e0c6c8a0c61c704e
SHA1 2df1ff8e42e65468c298b90b9659dfab2e2138ae
SHA512 27f4a3cc997348f55b91feafdc02a9769f99e0bc4c5356fa9b1ddca305d7144a246e7c64963a457e5e399f77573a346c0737d9c4a641a26a546a770fca11d3a6
SSDEEP 3072:n8czz2uil5YOgydCsD1B4S/cU3iUMcc4DBIgPSQ:1z3il5YOFCS17Sz4lNF
TLSH
T13C143A6619FC30E3D1E2D6F8DFD48E12B32AE576A1204CA75283024D9D17E819DA7E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 9433867b0e1f703728adbb2b83e43113dabadcff5e77a56d62da02780d5a3350
MD5 023d0db75c48e6e0eed9a2995740523f
SHA1 0b9b7e339ebf047625c6624daeb35bdca1070bcb
SHA512 46a0fa78b0a04b4a128ef585469459bd5fdd47284523aca20ef8c58c70dcc14d29e6e7177f5632f66c20f62c4aa319646988f580ffc0da9e20dc8b7ee6ebbd88
SSDEEP 3072:+7rfRYtM+X/mnITlED/to+Mghf+GvC6C36oPWDDVuB+VIVHQ2s3TDpQr9bx5+YmT:rfO8lED/e+3C3kDEB+XCE
TLSH
T17F145F2277F80A68F8F36E315C349F2A993BBC319D34EA6E1594218D1D34A51DA71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 224KB
SHA256 26851260f16e76e556471ca51d973f386f504addcfc8134b89d077eed54f1b1b
MD5 631bc3c6f197653bd6a2884c132d85b2
SHA1 55dca8a26e63e1f5f5c3ae16aabb5138dbb87cbb
SHA512 9067ccd15fae7130a1f84df027906a11490f111daf124735d254dabea149e96245a2574a4692143b130bd29a13f12be378a4baedbe208bfe251bad8fb09a224f
SSDEEP 3072:ZmQcudCe+ha01jpzyYrvGg7nycKXZTO2PQoY46GTY88j1JCRkW:AQcudvaa01jpzyYzGg7wXEohSA
TLSH
T1A224E66929FC14F3E1B6D1F98FD08903F271E87262118DFB4391424A9E13A916D6BE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\MicrosoftEdgeUpdateCore.exe
Size 272KB
SHA256 34dab27cf63e8d478158e18a709c12f13420e04f139de2a11fabe9798de1d7f3
MD5 714a9b40f271c7f0e03d8dc56c3ba3b9
SHA1 4e3e3b6d16601aaa7926cddce4aefc2366824959
SHA512 db59eb8b46db148e97b9ee3be595cec84e0c65920a6802388695487db249267ba9af212f8ddd7314d725d86a12ffe8cdcfa12448c1b074b5fc2ed09068421b50
SSDEEP 6144:d8VsA8iTDAHGHWdfommUAdVIAOj4eXYQxh+B6CBMK:CSSAHGHWdfoYa+Ych+BL7
TLSH
T12954296528F84073D0B595B98FE4DA32B478F87256118DFB43D2474E1F22A82526BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
TLSH
T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdate.dll
Size 2.2MB
SHA256 b02dbe2d712d5d2af197cbe906e9cbbbe311eac250656554ae80ba68b13cf803
MD5 691a48b8735e5c09f3f2615d4d8e247d
SHA1 ad6562e5e9ccd0aeacca32fafe92b5ea8fc39dad
SHA512 75bb1464a93091eb865d92480fc364ae3a885e998b9520baa1416a69eb49f5a1bfe1fbee222dfc4aa223fafa5bebb927f09db259fd64b2beb1fcdd4a3f5c8f92
SSDEEP 49152:01rkzCCaXXPexXogtDYjrOyl+bQyQjUlvR0sXCta0FulDn:01rkz7EXPexhmrlovR068FuN
TLSH
T11AB58E2225E44076F4B246B1CBFCA51AA5ACF87117308CDB83A1568E7A32DC25477F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_af.dll
Size 29KB
SHA256 45c087e9de686ef8303e52d3365e1522d0171fdd73aa97301cd82a9828ee7554
MD5 6b22eae4765396b7a9c54ced3ae6fb13
SHA1 babfb1e96e986a58eecc244b967ef390309a659f
SHA512 e4daf3087aa3640cb89c5bf4c5b095c0a936929a54e17b4cada1d200b163629450e2e37965128312bba849a753fc1804c528bd5dd4f0548b48fef861499cc743
SSDEEP 384:MfvVFXh7BWmzIWWjrYiVDxlwCiO+g2y4GlNTtR9zj2D/:iNrO+aLP9zq/
TLSH
T1FDD2FA9153F4810DF4F73F30BDB896925A76BD92BE30956E2240A15C1C31B81EBB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 9b34400303f50cf9f4847299607d95dc5ebaf6a195dcacde9286d9e02dc0a9be
MD5 5604484419e05e50d05d682619e6962c
SHA1 97b17b488b3009b238337b4a09be43b4fa79b34f
SHA512 3c710d0e583925c8a1231566a61cef50efc07dcf97ebd56564cec732ea0717b4156f08fdb8ec6584efb1829c78b0946258f2044005eedd67ac85d98230b55c2a
SSDEEP 384:/30UVFXh7BWmzIWA0Kl8Ss+Q2y4GlN3cDR9zg4sBeWdj:bFe8Ss+KG9zg4JWdj
TLSH
T170B2F74783509A0AD067BD740658CF6765BAFF0C1E2481ABB119FA2434E4763FB3AB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 dd153bb18ddc7739b0fa70f4a9b8e453fede5a68ed6e4b7d3c4e9868b2e686e6
MD5 78a0a4a312401f1bad518d2ecbba29ef
SHA1 beb2fc5ec8ebc6240f25877186425832b8576002
SHA512 1fbb5a1f08a188df2b66ce15391fe8dafbe1e124b3993d269bf7117d36008af375e2b5d82baa49468ddc6d5646914eb1afa1f4c0d51a5724a79334f4b5e0ae5b
SSDEEP 384:6m0PBbBWmzIWJYwTPsQtXvfG42y4GlNwMgYR9zW88GU6:mDbpXvfLXgE9zW0U6
TLSH
T104C2D7935E5CC13CF417AE34C16ACA23A23A52478DD8223A66309D051961772EF2FBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_as.dll
Size 28KB
SHA256 c0008c220180185455ffd89a799fa65107faa3cb15bdd60f727d95d755e1bc0d
MD5 5a91436102ee816991afbf338fd2c847
SHA1 6dcbf6fd6d441a6fd99efd15111b4f236b7e03db
SHA512 550d698863eb7fed7a6528cc864d8edb6c6ccfa1e0dd12c2ee95efa1b154d1b2c1b7fd497c2f1782a3547db064850f8f131a182ffc13c37dcd589b4a216363eb
SSDEEP 384:q7WVFXh7BWmzIWdKnFUFw4sCi7mPuAsuUu3BUF/bql96u93RRSjJKlFIfNHF1Vl7:zqZ452DuUu3+F/bE6uEJKIlHp+N9zg4q
TLSH
T125D21C155740B624D5FD643C02D58DBB1AFCBACF081CA4B920E3E11478A53FA9F2B29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 26c857a73732ecefd60e59f12f2064dd80912f31febd221d34f5305396ecbccd
MD5 c0655430e00c2d22673bf9e2077c1b96
SHA1 52ba91acbac163968ed560be94a420a6e7629579
SHA512 a455287be768cdcf5243640e3e8e7a25eabdb59038cac3c936b86bcbd59d6aecdb33c99fec60f634312fdbf19069efe54a1ca9de976ca8737343c7ce06ce0945
SSDEEP 768:nMIOFe5FEuo//ctGFLFS2rF9FTFYF+WWX9zI:nGFe5FEuosAFLFvrF9FTFYFYzI
TLSH
T141D21E6193ACC105FAF35F305878BD4319BB7FB37A34914B2292A14D1C31392AA34B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 512e149d931589d00b06c6a81b0f8bd2cdddce87d92e2bca63448dc733b27f64
MD5 0ad4aa27e60b82ca94f6f2c7d50f49e2
SHA1 4a17e0a5e2336e0db7e0f92d3bb466e9ad819b80
SHA512 59ef73b296b2681971af65a72d136fb9ca609a75e3467bef88619eb0f8f807623554d02e5f3b3660d71365fc0f189cab49cdb09f15589b1145c75eb1fbf35bb9
SSDEEP 384:xp3VFXh7BWmzIW8dsSCCdCwd0Qgv66n46wt2y4GlNirNXuifSR9zr3:vqdshCUCgCr6CK5lfe9zb
TLSH
T124D2FC4FB97C8204F655E6310FA6C6F735BAB750672486C6A34FBC68201D372772928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 6d9e04f1ea5d8a07bf54ae550210c7d14a4a641b6aa0781145dde6c8ec52ec62
MD5 ad3b7417797dea10aeb76981fe834d94
SHA1 ba515eda04d65fc9da90bb25865071438eabeb33
SHA512 18ec963027df83639853a68bf96e02c88fae1b492d903f5aaa47d45c3793e4188482865b2e54508add50b83a37582beae6e04ccc3e7af9d511596bf48a5bf7b5
SSDEEP 768:FmvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHvwX9z/q:FKAGEbYczy
TLSH
T115D26316A750B814D6FD283C07D6CDBF1DF87241242CA4BD25E9EA0419A23FA9F2F51E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 6379d00bd1b255f5fcfb7022be44b0dddb2ffba286c5a316c45edacbca7b7b85
MD5 8c61494e952c2781a9d65d164697e3db
SHA1 c9cc1cbee2e9db514096d58f0543434300287ece
SHA512 cf56526e10645f796e39f87565d909c88bd076ca0a271f98f821f4e4c7bcf495c5cdb231c007c73614e862064a5ac9c47fc786951ae8711a85c3252b82ed91c4
SSDEEP 768:vrvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHmQjlfe9zr:vLAGEbYHEzr
TLSH
T1F9D26416A750B814E6FC283C07D6CEBF1DF87241242CA4BD25E9EA0419A23FA5F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_bs.dll
Size 28KB
SHA256 94cee22396b55db9bc87177b2ff04ba8586fb64f3c9ea90539e68dd4ac2975f4
MD5 40fafb0a93f05176b009e594e404a04f
SHA1 dabf65a36076bb833569ceac21b8688869d81372
SHA512 74dab3594015db688089e8469289b50b577302c17ff3baa30ebd49656a827feb6f5f536efa439969a458cec87beaefda0ae8610e483f9a4e99de5abeb17bc56c
SSDEEP 384:3d/VFXh7BWmzIW/aDAmqRDU5NLCdJlwc/Xi+UFs47vL2y4GlNiifX7R9zA3wTZ:l+6lwc/Xi+ms4bDbF9zAgTZ
TLSH
T18FD23E41A7F8524AF5F77F30597457621E3FBDA2AE34910E2200659C0931781EFB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 30KB
SHA256 a273fe4e4ff29631d58b5c20164b5fee6295ce79942f933c7b21ddf18d6e313e
MD5 a551b67e56be53290853cedf05467d5b
SHA1 f4541386059d5679ed1eb898fced67cdac975632
SHA512 b1f1fb3a39cc4e539f563a5c3d2f2972ac8b86be29e457900ff978f3a7c00059b4b7c923a0ef03873bc65f6c3e0572e912eae70ddedfe3cd5e75c0b96dad9ea5
SSDEEP 384:1iVFXh7iWmzIWDbkbOnGNfNFoBWk5gZAF2y4GlNAUMgYR9zW88G:DVbkbOnMffoBWFulYgE9zWg
TLSH
T1DAD2E941ABF84659F2F72F747D7889625E3ABD9AAC38D11D2200A50C0871F51EF74B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 c329b7a62f0486cf980bc5f0b827ea1be89d7576e526025ed65150e4f8b0dfd2
MD5 e655f7e3bd3d9de59e402d20acdfed61
SHA1 0f0db5ddfba121863278c28e66a745876d1a2683
SHA512 b31ae34261d89809107d1da676fcb7a77554ada6436945de8b48d475f9a5c179205b9ca15b41bd5c5312eae436a5d5476c70f4875d4889c29801818495508b6e
SSDEEP 384:d26fVFXh7BWmzIWKHEWdvDNfNFoBq1ZQtn2y4GlNADcUthXBnR9zcO3qo:tcHEWdvpffoBqk3LCf9zcFo
TLSH
T1DBD2FB41ABF88645F6F72F707D7899625E3ABDAAAC38D10D2201A50D0871F41EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 56859c575ed804409c586d9ea0c07fd33f2c641d9e3de58be479a5553e2b692d
MD5 caef8cda55fa74771fa0887e5833c126
SHA1 d9b36e4c13660f08f0ab9ca007365d1586706fcd
SHA512 265c5c8fa2473c87fcb8ea3f9e5a37ae59097b800a2f8861f4aa0af66bdea50a65145f99ba32dfa0f16a02d95c2edb098f98831809679e4978ed5d460b90a5ba
SSDEEP 384:v4mVFXh7BWmzIWeTL7PGQxQFnwd/l2y4GlN5oR9zFiRh2e:dITL7nFR09z22e
TLSH
T133D24E41A6F84145F2FB7F3069B44AA21D3B7D96AE34C14F6640929D1C30BC1EEB8B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 b22b1c1109cfd95f9cffdaa792b386c176fb4a1dff96507edfd93e6f9d728ce1
MD5 1c2a03674657db95e7346350230c6595
SHA1 f6837636ec383a42a4bb93af6855219ebd93b378
SHA512 2951a3bb0927288e8496728fb1369f65979e0ec65874643f241ebd4eca113a4b5257d0c64565b6585bcdb56c3d0a379348b855949516e878887bd38d5f8e9e96
SSDEEP 384:CC+VFXh7BWmzIWatZEmiuTHsyi7zAaaVamjyC8oyUFxOFqdJf2y4GlN6VscmeR9j:MYDWZUjxdJ/u7N9z6S
TLSH
T174D24F5143F8810EF5F72F74A9B6A6622E36FED6A974419E2340B1091C71B82DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_da.dll
Size 28KB
SHA256 43a54c0648137f3874bf9b03e008bfc0a53a0fb44fb0104df05c6f94f6375557
MD5 0fe201c42cf6efb2ab81f43f4e033b03
SHA1 4210ae38b3ab3a5c2d0ece82ce9ddd21cfdeba4e
SHA512 bf94fb207bef0ca2fee76c45531aa8f458610947127dceb41763c49c4fbffc8734c6919bce0e13daf08c81d158f53ca9fc72469157dd8f2b66bc1f515b04ccee
SSDEEP 384:ECnXVFXh7BWmzIWJm4HcyvBdIp2y4GlNP+ki+R9zB5Fw:hbG4PIRXZ9z+
TLSH
T1CAD2EC5567F88219F5F32F30BCB98692197ABD96AE34D61D2200A05C1C327C5E7B4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_de.dll
Size 30KB
SHA256 4ad43580ee86f6bf01b39b08bf8618c4881c3505006d03251a3c98065c4176b6
MD5 07dc14b13121f3b70bd6512c82f4193d
SHA1 608ddceb927590f978b417aaf6467b3fc2f062ae
SHA512 aa2ea498365f860342b0ccb24c7227f17b1ed180ad39cfd16ba2fe465068652a17ce06919a38281e3b0cadca06b59a79d0a8a114aa64c2e0ec107bc25747373a
SSDEEP 384:u3mVFXh7BWmzIWDeI4FBhj3ZnsYxrPbLA2y4GlN7cDR9zg4sBUQVc:PFetj3ZnLxTbL6K9zg4GVc
TLSH
T140E2D85157E88618F2F73F30AE7893962E72BDD5AD34E95E2340A05C1831B41EB78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_el.dll
Size 30KB
SHA256 7586f50370609fb1765b48f23af8702d65a88de3c785a6593e44d1666aba1325
MD5 895df772a4b4b04d94f95a07606213f3
SHA1 66ed1eda6f964aa9dc0982f60647f1f14d42999b
SHA512 17fb3eddafcca7f28e761bcdb41e4b4c1282b2b21de90ddfe3e60d5467b5211f47d95fef0a48875974396796f786f70252da48783d06cfc602c8e1673a67e726
SSDEEP 384:GdbVFXh7BWmzIWEnBzBUBOTG94vTZtfFkmmFK9q87PgbN2y4GlNgoR9zFiXJD:iqpnxdFDE409zQD
TLSH
T147E2328E0EBF9711EEA6ADF24433862B9A3FF5860810DD6731F070449D1DA129ED791E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en-GB.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_en-GB.dll
Size 27KB
SHA256 84ae379784465903a7daedc596670827f87df1916115a4f3981e25ebfdea17f8
MD5 35899101af7e83145b397b2567a0ba19
SHA1 06f61bb08ff2674aba7c8ebd316db2b63ebf6694
SHA512 d13c65867ae6e814156b3af6bbf17e181f45a1729abf209726b777b38621c53562432a9f703f5710b3c5980ee54f84ba7ff6c7d05c5d012a938d121009fe4f7c
SSDEEP 384:fmVFXh7NWmzIWIkagyonbeg2y4GlNBgtR9zjg:I3agyoyaCP9zc
TLSH
T125C25181A7F88119F6F73F307EB496A21D3ABD85AD34D65D2200A00D1871B95EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 886a45777512cee613dff15117a30f7c6cc965dec2537b5f9966f1b471be3d9c
MD5 dbdabcc9212451e1d747c2f2d7d24bf6
SHA1 aa2b69e3c82376742eff69c0de8d004f4aa64165
SHA512 c1b938a003a2ce26e22fb64b6f7ffff77d9fd0079a923d79c1c3cb9c4f0054e983512312fcf815062d90d0745f8ff7d3f16e543835d4d736d4417edf9eed04ea
SSDEEP 384:/XZVFXh7BWmzIW1kagyDlBlRd2y4GlNpNXuifSR9zrSww:tYagyDlptLlfe9zdw
TLSH
T178C25286A3F48119F6F73F307EB896A21D3ABD91AD34D65D2201A01D1871B41EE74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es-419.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_es-419.dll
Size 29KB
SHA256 490d5be41800508904b4530740610b6beb1847e3e6365bd06073bbba78e1e0ea
MD5 af66badc2188d654e8ecf6a98d1275b9
SHA1 e67f7e6a614f0e30c8e4839770923de6d370a675
SHA512 ba4ea4ae1e4e971395e2e17b2fec7ef76c8e6b4839a3982c625e4d447f2a56f583070cd1ad7d1de3f5d67ae57a4b31b12f7244626fb4792ccea93b6eac45b4c8
SSDEEP 384:5VzVFXh7JWmzIWmadyUr4aa2y4GlNg3zMgYR9zW88MF:rrdrH0o3wgE9zWOF
TLSH
T1D5D2D8509BF8924AF6F33F34A97896665D3ABD92AC38954D1210A15D0C70F41EF38B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_es.dll
Size 28KB
SHA256 59621792791f9fed035ae7d528d157f6b9181f8ebfebe0590dba9097abfe3b89
MD5 719e77480b4647b4db630468db95ac9e
SHA1 30ccca5993aba01e6bb0c9fc33a28eefa8264289
SHA512 b8b0defc67724bd64ab5a1f631eb5cf1c5fff245ed0698dc7ae77e15a79ccaf0447a4e080b12b0a64a7588d92b8937bbf98ae8beadd557972e11ba724a89a393
SSDEEP 384:uIIVFXh7BWmzIW0t3MjNIQ2y4GlN+QFR9zj51vjN:Mut3MjNIKzX9z/p
TLSH
T1C2D20B5097F8924AF6F37F3468B856625D3ABD92AC38954D6210A51D0C70F81EF38B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_et.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_et.dll
Size 28KB
SHA256 14c02eb31eb44d88c0756c82afdc68e2d7e3de02dc4dd4a7690521d08e305afc
MD5 e2a9a04311d81294bf8fb8406114747f
SHA1 cbfb3862bdd807f5a286bf7e405bb991389b72f6
SHA512 4c6b121438ba82890e981a8383a55f5f3939384bf1abe6a423828cdaf6828147daacda0c142f4c262fbe5a9e1ea3f57a9781a5f54101921a3100483f5b985512
SSDEEP 384:KfIVFXh7BWmzIWVVc0dEyjELtX7giw1LmbVdMTwAiDiHm2y4GlNlMgYR9zW88vu:tz5jELBgr1LwdfAw1ygE9zW0
TLSH
T127D20D92A7E89119F2F77F307DB496521E777E93AE70E61D2600A11C1C30781EA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_eu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_eu.dll
Size 28KB
SHA256 e6181c997ed19dab536fb5cfd759fcca058edd05b6d1c6a7ee5db510bef61b1f
MD5 c5a57392a00e9114bdc5c4280db8a528
SHA1 a8a85cd6cfe6ca1670bd44ce37f1a90569340b72
SHA512 77c232814bf67bb28a05a9b4d725a4f86cfec6ec4e4cc2c199d838cc2e14d9a5d9bf200c535548efecac71c89b66a1e622e45a07c8b4af919c346b13a311f0a7
SSDEEP 384:FSMVFXh7BWmzIWzcLpNrX52FOX3z14Ob2y4GlN4LNXuifSR9zr:r+R0FOT14QQZlfe9z
TLSH
T1D1D2309797E89158F6F76F31A9B885E62A77BD626935D52D1300A01C0C32381EE34F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fa.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_fa.dll
Size 27KB
SHA256 471f012dd01cc7e5361ff27a967acd22c12951dbef7f703ff69fad16fe58711f
MD5 9cb9b972667fbee7a08648d835c37f52
SHA1 7819925fe470f264038282e86a1dacbc1ccc49e3
SHA512 27cfe2d15133790ee6670535f25c7a0569aa79cec484c89363ccc3d8a9e80776a08c7e15a69ff64cf6d73c310b46e0d4a8d7bacfec4731043e21d94984b6c723
SSDEEP 384:w/8PBbBWmzIWgXlQEqt0A0Q6Gft2y4GlN9cDR9zg4sBJ34:nzr2C9Y9zg4OI
TLSH
T11ED2800A8DA6C470F5636A34C50BD973303162DDAD8189361FE5A83C19813F9EF6F62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_fi.dll
Size 28KB
SHA256 6b13faef46ee9cb161201455015308f3cd9ea26359357a0a9b2e22fdfde97e7e
MD5 eb6db5e0c02f62ff0f1cf0da0c41dd3e
SHA1 500707973229ee68d2cc88adfee307cbaae7af1c
SHA512 6a6f9f5c5a60c20e903a2a24070a04864965c6c4662f65201abea158b5632703ee52baa09e1f556b77dc7dc0c01bb4ae523cdbfe51e9c2b199a0639239eb6544
SSDEEP 384:XGxVFXh7BWmzIWSJWHJWEFIxnyELZWEYXsN6ZKFl+EoOh0vFqY2y4GlNv5R9ze/:C8JOJOUjyCT9zE
TLSH
T1C0D2009153F8C229F6F76F306DB886121A377ED36DB4D21E1A00A55C1C21781EA75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fil.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_fil.dll
Size 29KB
SHA256 0bb20964c4da984392b1e34bfdbc104e97436702136b3d518c81945599efe5f6
MD5 bc08611a0e21c7b255d026946fed2a6a
SHA1 349988353e2543b63590a4b49a5675463119ff00
SHA512 54456551a29823e79d5bb11d98bc6c6f694205b6492c1dfdb7e270be2824a96ea3708d40daf4d68a2197df607eb243c353379606bc8125b31bf2418c95ea37cb
SSDEEP 384:eaVFXh7BWmzIW9sXsjbjkbkzkrJqPDLiuz2y4GlN2W/oR9zFiSR:/3sXsjboIzkrJqLLTbF09zH
TLSH
T1FFD2EE41A7B8811DFAFB6F3079B8A6A11A3BFD465D38D9092240951C18327C1EF74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr-CA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_fr-CA.dll
Size 30KB
SHA256 8e596f3278774b6a234573ff5b03e039c8d5c8852b0bb069d26134404aa3ca95
MD5 dea658f9ae03566863e7b496d9e68734
SHA1 bd4fbbced8cccca43f092225412fabc05c18836c
SHA512 0786548104317517cb46435a3a099b196cdb37e49d420ea900ac24fd8f22c4c668b59dbecac3983acfda24676be0df821e76c36d27e05d95ee68afaa843c32f1
SSDEEP 384:sWVFXh7NWmzIWjs7otIRr0UA2y4GlNjG9cDR9zg4sBTu:NlINRrN6rGA9zg4Qu
TLSH
T149D2B845A7E88215F2F77F31B8B986521E3B7D968D30D52D2200A19D2C71B81EEB8737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_fr.dll
Size 30KB
SHA256 e614046aa15649d6252f25703a79347ebb017efb0a7b7873a256ae2d3ea59ba9
MD5 34f2d6487a867bbf9c8d85149a104995
SHA1 205ece17164f390db8180f4d6d37b357f0201b5f
SHA512 5b22839abbd21db733afb2aa97e296320c5fb89a1950d2ff0834fb5c30ef7107c28717107d3628acc342f3e648b5d47d8ffbf08bf944d66ec38fd4665c00d3dd
SSDEEP 384:XMAVFXh7BWmzIWD8bW6408o2y4GlNvcUthXBnR9zcO8gV:Pl8n4lS8Cf9zcr4
TLSH
T15BD2B885A7F88205F6F73F31B8B986521D3B7D969D30D52D2200A19D1871B81EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ga.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ga.dll
Size 28KB
SHA256 5b3f1e6bd5a3e3fa31f96b653b0552d0c6f36e480848a53a8c93aefca9b027a6
MD5 ce2ce2c4aacbad9ca174067ef721cb91
SHA1 14a95f3064815e392b9f229bcaa5dd242a484388
SHA512 2eb4a76af4963c0ce1e3c7fb156cfb87cc61552ba6e0d29e8b64a74f099a1eae14de3f7eee2ebfddf71b23ba0f59770f47855cde28d95a2d5eb4776aa820a306
SSDEEP 384:VxDVFXh7BWmzIW+5vCQkcYoIoAxP7GXX2y4GlNjFbR9zBFk:LY5vTYoIoAlCXnf9zI
TLSH
T141D2FE5453FC810AF9F32F3069B487636A36BD92AE38D21D5240A64D5C35B52DE34B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gd.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_gd.dll
Size 30KB
SHA256 4dd0652934cbb40ccaf2017e8e463d78d1e136c09c99e7cd322506ec43f7dc9e
MD5 6f0b6e501868f3ce78b9478fc652ec45
SHA1 7cd2a1c9a5cb6b8d62ae63105709bb630c8944df
SHA512 f7843e6d145b839def90fb1a83a917d0c439e85bb3c35ecadacfda895e6f286011f105e1711939fab77b3f13b172af8dea75ec10f3b6889f29d2fd3eb91fd6c2
SSDEEP 384:1d0VFXh7BWmzIWfFYiA73DpfDfqKiXjR8xW2y4GlNDF6oR9zFixGZQ:+ZFYiA73Nbqfl8xYLF609zrQ
TLSH
T101D2EB4457EC8648F9F36F38197583A2AE37BC926D3886992300655C5D31B82EF39B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gl.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_gl.dll
Size 28KB
SHA256 b833276fc66448fc7014abec760c832f812397d36912f868bcc6bf982e908384
MD5 15a4996139b9e6ed456b931d74225772
SHA1 39cec094e1982c09f70654a8f7e1d87c6b776f88
SHA512 574d4c1ca5d01d123ff6f79df58c3b0a8419eac84b4bda6423e5f1c2e4418391a4a0921517874eb65868952eb3477df160a63e8f45fd2c15f6b37bae580888dd
SSDEEP 384:/UTDVFXh7BWmzIW1sCCp2RK+oV2y4GlNSXoR9zFiX/1taQ:Ozse8+o1M09zi/9
TLSH
T10BD20B4097F89206F6F77F34A97856665D3BBE92AC38854D2200A5190C71F81EF78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_gu.dll
Size 28KB
SHA256 284aa36abead44c60916a4552ebb1760e93f34baf946247dc4f6ecec5306fbbb
MD5 07774bbab4ce2b43dc542a564aa86117
SHA1 e3e7010f8928979f3697e20d8a084c562486e266
SHA512 d0a73451d831bd52050405d4f7bd7a2974f65667553522b30189c7e201022e53ac4ad5ada597cfaad2bf4d41830461cf925fddd22dcd1b5503a3ffdff68b0e7a
SSDEEP 384:lZWwjVFXh7BWmzIWZt7vdQrsojGtCAPPFZCxT3CT6xytS2y4GlNsWcFbR9zBNQ:ztvlCrngckWg9zI
TLSH
T183D262A66BA741CFD06E687082F9D533F7391191D620E1477166A3833DE3342BB2A79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_hi.dll
Size 28KB
SHA256 dfb9f2475321efdd597eff7f8a6878c0c7eeea805cd00040d743ea204accd9d2
MD5 ba491dd915124759bb4f33f0166f4d68
SHA1 78db13250cf47356295bfe35d5a22ceddf89885b
SHA512 7b1ea0910fb0804aad41b51fedfca75bf0344000dbe21c9935efe1932294ffd3377c4863b0197b31218b2fb36ec1d79025a0088543f74c7c62d118d9f8106c35
SSDEEP 384:juwVFXh7BWmzIWuQcqYmmqkKb2y4GlNhqNXuifSR9zrXH:VAQcqYmmqk0clfe9zz
TLSH
T148D2840204908F18E05C6D79E43887F36CFF6425B9CD13C5AAC171F9DCCA37B9A69A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_hr.dll
Size 29KB
SHA256 61903e920fd02e83b2a7961335c09627aafb12753cf19fa330880cbe997f1873
MD5 9feeddf0937c9d915adc9513031c1b9a
SHA1 0a4830729c7fb7dc5342a28d804152c5d14c44c2
SHA512 691bf1d1ce1a632de1052b8603d08b386ff0b3a322282d9dd0250bb03744fccc664a000a2da878f4a0b4e6eba25a034ff121d408e628cbf088b3b64bbc1b2bb6
SSDEEP 384:D5lVFXh7BWmzIWD/fbmrsCCa9gNk8qaEa/yi2y4GlNMtcDR9zg4sBo4b:XXzqJva/ys0w9zg4Q
TLSH
T103D2FC42A7F85159F6F73F30A5B457621D3FBDA2BE34950E2240A5890C31781EBB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_hu.dll
Size 29KB
SHA256 24e8727d53608e1a1edee1787ed56f076b2ad72c5f4c7d46d293f46dddbd1dd6
MD5 cf13a6a5f18f8efaaf63a6658efdb1ac
SHA1 662e3e8ae9df2d915db6d221a7892781116d3dbb
SHA512 5de57d71309bfed2675388b2b5fea640b6e9f33ff8f0042765b1ce61e66332406d3e1dcf7c93eb85e4eb6af1a7d0a2c77af954a693c5b67019c550fc97d06b24
SSDEEP 768:tlKkZ2hSV6S8yotbufJHw1bNJxslfe9zuk:tlKkZh38yvRHQbLzuk
TLSH
T1F8D2204193FC8546F5F75F323DB487931D39B964AE3CD21E6680A28C1835781EB38B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_id.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_id.dll
Size 28KB
SHA256 9bb163a6e0c654001e27596e78fd94216f11665d76b6f1677140de1dd7eb7d14
MD5 5e6a8532242ea2a6a4ad0da11161ee45
SHA1 a053e2b72b185732d1018934870639a27c24fb14
SHA512 279717ea88fba413f07006f66e654a844f7a5f9ef45109c6ab11b951593f5add09dee0ab62175727fe4a36c8cdcf597b96e0f78ac5da4dccf12f7680d58112cc
SSDEEP 384:NCFLVFXh7BWmzIWhPC8kJZT9r6T1fQC/2y4GlNcMgYR9zW88W8l9:A3737gE9zWYC9
TLSH
T11FD2DB9197D88159FAFB1F306AB896921E6BFD93AD30A64D2300A51C1C317C1EE34B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_is.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_is.dll
Size 28KB
SHA256 142b23ed07c722efa6da9f9d53ea2a793aaa001b13919d2bc4156128b4f2bfde
MD5 ab7ded2b871bec99eb927cf562c85d00
SHA1 e853436764b6593ae5d99dd42eda6eee49ccaffd
SHA512 113b6fa343c00c1dd6fd11ba657bdac2a2c56a85f890ac73adb5de1fe6a728d141e9e5ed0461ef0b8cff2db2c61356d76cd2113742c8b906905a80f3821f6543
SSDEEP 768:QKBkg5TpAhr+8wp0xoYpGYrPC3F9zAg7P:QKBkg5TpAhr+8wp0xoYp7r2zJP
TLSH
T189D2FC84E3E85109FAF75F3058F493565A3BFE979D34E60D2641A94C08363C2EA78B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_it.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_it.dll
Size 30KB
SHA256 503c95fdfa0a2bd7d07aa982283767b4319c37954d3da6624fcd127ed8447ce7
MD5 655f3da3e8cfac94cbe4414a5bb09c39
SHA1 17ac6712443a9615ed8c06a6998a08a7f02a1fd8
SHA512 4536aa4efee3755f4567831334a1e3e73dc36160f6206a5781d2b6693a14cd1f9dd4d3428b6d69b178354bbc0f133f3939677522ee03af3d97328055a160a3c9
SSDEEP 384:dSkVFXh7BWmzIWYuu1+JswzP2y4GlNTcUthXBnR9zcO2pk7:TY1+JTzvQCf9zcru
TLSH
T15ED20B51A7F89208F6F77F30AD3896A60D3BBE82AC34D51D1241A05C1831B61EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_iw.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_iw.dll
Size 25KB
SHA256 092eefae18876594665f8ae03a10e05271a9857fb88fe820d2c6ac07c9759e10
MD5 28a4755edb561986a2e2e4df77548003
SHA1 beca925d2dfaaa8a62a254bdfba8f7271326e571
SHA512 d322e462ed31d16dab4d5b112f2559773614b1e8348eec60a1f8b0aa311cb39f3b1077ba17f0855e941cce4e388a9dbf7e70f0555f9bbeb7789edba0c3d7d947
SSDEEP 384:DznPBbBWmzIWDbW1x4SCJ54LGA/ExQL2y4GlN8mUifX7R9zA3w8:jVcCTI3F9zAg8
TLSH
T1E4C295415B60C2D9E925EF33826F8A2F6634DB40063876177059A9A42D2E7D2EF3D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ja.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ja.dll
Size 24KB
SHA256 733538bcaff0d32c6d086999be78f3ed345b32f045faf0e4ecc1d60b7c94e9ab
MD5 15c096ea90e63c1d8980ce50533a24ed
SHA1 8608cc4b0b140adfeb6f2603b09f218fe744d5d9
SHA512 8c8f7ff6f57a649cebc4dc57df7735abfd7abfa343c607de2f20b95b7b3669f5136f7f3009fe5d0df238d7690b451f232754e681c10ae3ff3d1f250f9263832c
SSDEEP 384:Nc6VFXh7BWmzIWp9gu2/2x45B2y4GlNDtR9zjvJ4:vXfALP9zW
TLSH
T12AB2F7C96B60CD0FF8F669B101A4E6A63E7DF6611AD188522641E40E28407D7EB37B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ka.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ka.dll
Size 29KB
SHA256 7ff184205da4b305a8a55e629ab3f7c56f5c4f1246fd475ea7dd4c99443fede0
MD5 3eba76ac65f20217c78a61dac2ec4435
SHA1 d28ddd7bf40a109a99a3fcad38840a630491ab58
SHA512 b090544f0152abca49422c13d900292d43d7672387bc569912775e22acea025babe57f4e63922eee271cb51aa5b784dff41e97cc0f0171bf09e4bc3984298959
SSDEEP 384:85vVFXh7BWmzIWjodoA7s4THmES4c9OkQ2y4GlNZoR9zFizXn5:A6cKR09zU
TLSH
T166D22C0247938922E19E2A3069BCCFDEB53DABC02540551BB390AE986511BC3DB7F776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_kk.dll
Size 28KB
SHA256 fd44d30353305ba091ebf208755752f57463a288a973907589fe4155d9e672c4
MD5 97835ff32b4bc9fa554f23aa70a336f3
SHA1 a0ad7ecbac48936cb0914ca97aa47224f979ecbe
SHA512 a02a4ac32ca635d1186edafda8b538271c438f1ed932e9d86b477a7da16ecc1579b30cc1d08a3e8d3b154c9f7b48b18022ed9970d58a6446b6846c7b70bf52cf
SSDEEP 384:CluVFXh7BWmzIWg9MvPQwo2y4GlNnjR9zGGB:BGWvPQwSd9zh
TLSH
T15CD2834F6570E605E0A4FAB04AE18AD324BAF3541B1845F7BD4FB5182869B32FF35AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_km.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_km.dll
Size 27KB
SHA256 66ffc0e7325d324a2e7acc8769830c45b48268d53ff2e3211a8abeb071923a1b
MD5 29a655ebc5d3df53866d38f4ddb68a52
SHA1 20f33bb060c261f80a39654d3d54e05c7512b339
SHA512 c0ab9743bfa74d22bde021a654f7b7b8fcb7fa040d8059cd30c23fc2bc12f3b5a452f6d9b63c150a84c15827943f94b1bfe9c41a0c7392038003bf6e6a1fa00b
SSDEEP 384:j1VVFXh7BWmzIW0fJoxeUnPcS7cePBpxCNpJ62y4GlNXLFR9zj51v3B:HjxdPX1PBpo/JU/LX9z/vB
TLSH
T1AEC242D40170C0B9CD23D934C1B5ABBA3632B1DB9A396D472211B8650A327C6FFA5ACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_kn.dll
Size 29KB
SHA256 b54e7d75a8a2f8068decbddda098beab6ad4a4576f2b3697781367bc31b6fd85
MD5 2146ee94a1ba7fed6a89e37bf6b9500a
SHA1 f34ce65c1f5b28088a1a2d6ee54b0e73ebdec18d
SHA512 488394880986b6e54077e6042835a92597e64bb192b96581a6a482a8cf33bbfddef2491ccfaecdb98b06be2f3a3e001d568aa0610d1b5d31a27440feb1fe1433
SSDEEP 384:OPvVFXh7BWmzIWIQd4SyQRPbwW2y4GlNCGscmeR9zlMH3qE:UaQ65YaG7N9zSqE
TLSH
T18AD250CEC3B7C815D4C43EFF016758BEE520AA9754E156D33206904C2691BF9AB39BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ko.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ko.dll
Size 23KB
SHA256 3cb1b558d15ce220774efce4640e0361571a71fd7d69ed45e8f312cf9e7402ac
MD5 38eae1d6f22375ff8f9f9ec7772ff935
SHA1 2df09b3e4f122aec9ef1875cc7f6a7d1985d25ec
SHA512 e7f9b9231beed7c101faa82c8ba490c981eb9472f4c277e8231e350b3766f8d4c8b222b615935b3cea49b590b6f520c2c4948a198578153cec68da3eee2a4ee5
SSDEEP 384:6uLCVFXh7BWmzIWslte7yWYDeYhHNjLUtUB1SGGgrxYQ8lJDuk2y4GlNZdjR9zGB:58GM+OkFzG99zI
TLSH
T12EB2E75792A8C102E461BE720AE5CBE7753AA3915E139857F700F16C28263C1FF3979D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kok.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_kok.dll
Size 28KB
SHA256 151a3caa09a6f5ab79859bcc1bd42002f791b7185b729d90536ca55e77a9f130
MD5 febda5a1368f18eac6febe7cf02a2173
SHA1 f13362d7b3ed0d99ab4f08fb7ba973e416256401
SHA512 6730c76398d2fb9d2181c0f07bd4f2b48fc93af54cefa64ca7c5480683325c3d8a3b99a5b8a4fdc1f5fb5b7193ad013ac3bffc2e8c192481abec925195b716bf
SSDEEP 384:UEn1VFXh7BWmzIWvRr+hjZ+hjgOjWfosY2y4GlN+cjR9zGGe:d52MKwsCL9z+
TLSH
T124D2964251C08728F67DBDB8E0784AB35CFD2114B6CC13866AC472E9E8C637F675D2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lb.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_lb.dll
Size 30KB
SHA256 ebae71e0d4fb2e0fc933a5a934f88fd367f97ce8b134290029c4dd334f6e7628
MD5 cc785ddc414e711190a60a6a844d1f86
SHA1 122ffb11bd20c1f6279e0d3143ee46c242244705
SHA512 5cae1c56182390893ec0fe11083958157ad7ba9a2884e86187e7487848f2e68ca2e4db1c23ee105e5f1a5ca0385c3b69be3250e4aa6477861f0e5e3f5fbe8834
SSDEEP 384:vx0VFXh7BWmzIWsse3swt/bmTRigvyOH2y4GlN7JAifX7R9zA3wULV:4as4sSuAyXznF9zAgUB
TLSH
T1E6D21E4267F88119F2F32F316D7496A62D77BD82AD34DA5E2240625C2C31B41EE78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lo.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_lo.dll
Size 27KB
SHA256 5a3d8d496908bcb9a888a73bcf5f9385a7eedd3a5bd1d8be342e59de6b0f1913
MD5 581147df4d9d529a9ce06640685d1e82
SHA1 96660ea5cba62e8468e9dda558a9f9a5646adf82
SHA512 eaf55e577f590a90dfeaa9be77bfbb071b568366590610097fab73b92fd20346223adeacf541a13050c5b41a7bcc624d4e95398f27837e5aee2e20f0c3e0c290
SSDEEP 768:SDADgApU01duiHkJwbMQpxZZPUg2gE9zWUU:SsD7pU010iHkJwbMQpxZZP0PzDU
TLSH
T1BCC295FCA2D0C01BE1EDA7F0D46DAAF57CB53644070345676744A834AB623C6EF78689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lt.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_lt.dll
Size 28KB
SHA256 63e0e437e918688a971a3dc37b81e8ea674b582e23892ddf45a7e4f33554827f
MD5 219e4fe4ed8ee66c39ebceeddcb607a0
SHA1 7fc970b3d1119bdbd4771e2a087d786a207545ed
SHA512 bb4925d6735ffff6fb9d1f9b4f58f420f0359cc18e7e357954b262bce865a3a2e46d120f96f83c3f899ae5889f827fd73c6ef2feb772db1114d72c19e236c07e
SSDEEP 384:HzwnuVFXh7BWmzIW1rVs2BZJ1f+jmU55z6B60Kmr6YDP2y4GlN+wifX7R9zA3wjP:cENrB31f+jmUnz6B60NDvGhF9zAgjP
TLSH
T1A0D2105563FC414AF2F36E3046F88A565B3BBEA66E34D21F2100A18D18317C1EB75B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lv.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_lv.dll
Size 28KB
SHA256 d5d17dc3cdf54fcd9312158ecdc61ffcc902f19f766faac8fc82db8f2db3859c
MD5 9dbf8aa8842cb4ae0077d54d104c7a61
SHA1 2e506b4a27ac9c98fef225f905c8bde267d76cf8
SHA512 3204d3788e8f1df0188ad4aa39eba9aa8e0e6a3b135d3125a935dd2950850893c232ffecc8e4a585f9a1c8ae63ff60010aed68a5a4979ed8100b98eecad07cac
SSDEEP 384:LYNNVFXh7BWmzIW5YppSepDyvK5x/mIg2y4GlNLgNXuifSR9zrr:UPma0lfe9z/
TLSH
T123D2438593EC4219F2F35F306AB48B522E3B7D926D34D15F2100E56D1971B81EBB8F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_mi.dll
Size 28KB
SHA256 fe29568b8d221cec984d1c52871d21bb79ff4a4f9aaa9be6ddec0fa433192101
MD5 0a803121330e404d7b9b203db8724313
SHA1 2ba6c808cc65a44ee85c006f8256d1e23167667e
SHA512 4f4d2296ae20e0d9f3b43dbf4bb897aa17ef6d619c661881954a322825ac5314ad649f44b641ad431519db02c76814d2ab681bad6a2aa57b1b316a8693d37e41
SSDEEP 384:EXSVFXh7BWmzIWFHDPvhHXBRDEWUDrF1/rzLOWsMVbwwH9hlnyxNCr2y4GlNw/cd:pzRp/YIm9zg4NM0
TLSH
T185D20B4256ED4206FAF73F7142B487522E3BBE66E938E74F2500946E15363C29E2472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_mk.dll
Size 29KB
SHA256 1eafea76f45119d944ab628fa8628995ab8e7430961ff66c8a4bd911a94efa9b
MD5 6e8b5f7dec2283a47e0444a413a7dcd3
SHA1 de0f6fa07eeeaf94d48be9bcbf931e94cabb9685
SHA512 ede4f42dc4df471373580a62e622c93cd74194c7b87bf482e8a34030831b2a4f25e0adce3a17810aac54d5771f12bec8bdae3f89d89d2b2de1774bc6059edcec
SSDEEP 384:QnDVFXh7BWmzIWXHbnGAYeBCEdpEXeR5qw2y4GlNsy2MgYR9zW88MU:KJLjgUp0IB/NgE9zWT
TLSH
T1DBD2114FB9BC9204F691F6310FA5C6E23579771067244687621FBC683029732B72D6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ml.dll

Path C:\Program Files (x86)\Microsoft\Temp\EU487E.tmp\msedgeupdateres_ml.dll
Size 30KB
SHA256 a0ddcc46795a982d65a20cf0647be28d75aa117481e80312453429fa56b431c1
MD5 ee40dd6357357cf5ced1de612a4ac10c
SHA1 f15d6b1501ed7deae4e762236402a219dc470358
SHA512 7ed12954691c17b3700f4d055b404a5ebc730a56bdef87843ca38b8475c94056318ff9e6d99861c95fab790b4fc2a3a0d52c8e40ff47f1b671d773a70560fad5
SSDEEP 384:BQUVFXh7BWmzIWQh3l/cdGKXpVcGOR/uLZpIqCX841SG92y4GlNMEMgYR9zW887Z:d5d+1B0rgE9zWj
TLSH
T1EEE24FA76550FE13FBDC14F40E4A8A57E5ECAB0EC95866A8192061F23D5E3036F2C7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 219KB
SHA256 4e397a8689865b98d4a922f9f23cfbec2d9c2164a17bbac234e482b030fe3b60
MD5 c924d04ed2954cce905ac258fdb6683b
SHA1 2782a3ce535fa8b204df06de45b0c9b6e7f6ac74
SHA512 672485a67dbeab0a3d32ef6fcc96eea67d762910f3577cd7e7c9ff91d0b20fc1aabf6e26df6b6760c26f6e1b77ab8972f28f7d261cf2a4096036824effedefa7
SSDEEP 6144:/yP3iYl9m9rzHJF18+EJrpMFwDVyPTFw9HgHYL3LO1dZDS7FFowWDADFo9bxE:vupJ
TLSH
T19C24366977E80219BDF79A16EDF6DC66B97BB9572C18C90C0091168E0C37F02E97072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Setup.exe

Path C:\Users\Admin\AppData\Roaming\L2JDev Studios\L2Updater\1.0.0-release\WebView2Setup.exe
Size 1.6MB
SHA256 73c49019991e9cf301e1942ae570e6c2918a4aba75bd233b5a1356b8d514026e
MD5 567b3fdc8790325346626fbdd552c46c
SHA1 c88f6efc05ecd08e9b496f33631a25f2841d5a6e
SHA512 89e38e29202c23c73b88435cec267f5c0eee7f11bd32daa5e68b3c6d29c9396fbf963716212ff39917fa7e4565eb3d66321b31d93f6b450cb4287b05ff5de0ee
SSDEEP 49152:uiiGT3Ds8j1fukXjNWnlD6KerDpLRqDQODloWt:jiiRfukZWerDp9SDt
TLSH
T1CB75232676E04035F0B71A3086F096B22D7EBE710B711DAF13517A2E1F70992E6357AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-222-0x0000000000710000-0x0000000000745000-memory.dmp

Download

memory/1060-262-0x0000000000710000-0x0000000000745000-memory.dmp

Download

memory/1060-233-0x0000000074CD0000-0x0000000074F11000-memory.dmp

Download

memory/1060-223-0x0000000074CD0000-0x0000000074F11000-memory.dmp

Download

memory/3024-4-0x000001F73B0C0000-0x000001F73B248000-memory.dmp

Download

memory/3024-0-0x000001F71CB10000-0x000001F71CDA6000-memory.dmp

Download

memory/3024-198-0x000001F71EB50000-0x000001F71EB60000-memory.dmp

Download

memory/3024-2-0x000001F71D210000-0x000001F71D21E000-memory.dmp

Download

memory/3024-3-0x000001F7374F0000-0x000001F737592000-memory.dmp

Download

memory/3024-124-0x000001F71EB50000-0x000001F71EB60000-memory.dmp

Download

memory/3024-1-0x000001F71EB50000-0x000001F71EB60000-memory.dmp

Download

memory/3024-5-0x000001F71EB50000-0x000001F71EB60000-memory.dmp

Download