Overview
overview
7Static
static
3MortarCalc-Setup.exe
windows10-2004-x64
7MortarCalc-Setup.exe
windows11-21h2-x64
7$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$TEMP/Micr...up.exe
windows10-2004-x64
6$TEMP/Micr...up.exe
windows11-21h2-x64
6MORTARCALC.exe
windows10-2004-x64
6MORTARCALC.exe
windows11-21h2-x64
6uninstall.exe
windows10-2004-x64
7uninstall.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MortarCalc-Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
MortarCalc-Setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
MORTARCALC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral14
Sample
MORTARCALC.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral15
Sample
uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
uninstall.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- Sample260605-dvtffaby5r
- SHA256 73c49019991e9cf301e1942ae570e6c2918a4aba75bd233b5a1356b8d514026e
- MD5 567b3fdc8790325346626fbdd552c46c
- SHA1 c88f6efc05ecd08e9b496f33631a25f2841d5a6e
- SHA512 89e38e29202c23c73b88435cec267f5c0eee7f11bd32daa5e68b3c6d29c9396fbf963716212ff39917fa7e4565eb3d66321b31d93f6b450cb4287b05ff5de0ee
- SSDEEP 49152:uiiGT3Ds8j1fukXjNWnlD6KerDpLRqDQODloWt:jiiRfukZWerDp9SDt
- TLSH T1CB75232676E04035F0B71A3086F096B22D7EBE710B711DAF13517A2E1F70992E6357AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fr-CA.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mt.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ne.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdateSetup.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\psmachine_arm64.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fil.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_sr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ta.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_tr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_cy.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdateSetup.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_nl.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdateBroker.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\psmachine.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\EdgeUpdate.dat MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ar.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_te.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_gd.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_tt.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bg.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_en-GB.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bn-IN.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_eu.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ga.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_nn.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_sr-Cyrl-RS.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ug.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_da.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_en.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_hi.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_iw.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_uk.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_vi.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_kok.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mk.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\NOTICE.TXT MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ro.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_sk.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\CopilotUpdate.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdate.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\psuser.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_es-419.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fa.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fi.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ml.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_sl.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_sv.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\psuser_arm64.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_es.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_lv.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ur.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_zh-TW.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_af.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_as.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\psmachine_64.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bn.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ca.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_id.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_pl.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_pt-PT.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bs.dll MicrosoftEdgeWebview2Setup.exe - Executes dropped EXE 12 IoCs
pid Process 5216 MicrosoftEdgeUpdate.exe 568 MicrosoftEdgeUpdate.exe 3888 MicrosoftEdgeUpdate.exe 5364 MicrosoftEdgeUpdateComRegisterShell64.exe 2308 MicrosoftEdgeUpdateComRegisterShell64.exe 1408 MicrosoftEdgeUpdateComRegisterShell64.exe 3124 MicrosoftEdgeUpdate.exe 4724 MicrosoftEdgeUpdate.exe 5968 MicrosoftEdgeUpdate.exe 1912 MicrosoftEdgeUpdate.exe 5576 MicrosoftEdgeUpdate.exe 2252 MicrosoftEdgeUpdate.exe - Loads dropped DLL 17 IoCs
pid Process 5216 MicrosoftEdgeUpdate.exe 568 MicrosoftEdgeUpdate.exe 3888 MicrosoftEdgeUpdate.exe 5364 MicrosoftEdgeUpdateComRegisterShell64.exe 3888 MicrosoftEdgeUpdate.exe 2308 MicrosoftEdgeUpdateComRegisterShell64.exe 3888 MicrosoftEdgeUpdate.exe 1408 MicrosoftEdgeUpdateComRegisterShell64.exe 3888 MicrosoftEdgeUpdate.exe 3124 MicrosoftEdgeUpdate.exe 4724 MicrosoftEdgeUpdate.exe 5968 MicrosoftEdgeUpdate.exe 5968 MicrosoftEdgeUpdate.exe 4724 MicrosoftEdgeUpdate.exe 1912 MicrosoftEdgeUpdate.exe 5576 MicrosoftEdgeUpdate.exe 2252 MicrosoftEdgeUpdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3124 MicrosoftEdgeUpdate.exe 1912 MicrosoftEdgeUpdate.exe 2252 MicrosoftEdgeUpdate.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{AEB92A19-3D25-4335-B15A-EF459C697928}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05FE3F4D-62DA-4976-B72B-059E095ECF9E} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5216 MicrosoftEdgeUpdate.exe 5216 MicrosoftEdgeUpdate.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5216 MicrosoftEdgeUpdate.exe Token: SeRestorePrivilege 5576 MicrosoftEdgeUpdate.exe Token: SeBackupPrivilege 5576 MicrosoftEdgeUpdate.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 396 wrote to memory of 5216 396 MicrosoftEdgeWebview2Setup.exe 80 PID 5216 wrote to memory of 568 5216 MicrosoftEdgeUpdate.exe 81 PID 5216 wrote to memory of 3888 5216 MicrosoftEdgeUpdate.exe 82 PID 3888 wrote to memory of 5364 3888 MicrosoftEdgeUpdate.exe 83 PID 3888 wrote to memory of 2308 3888 MicrosoftEdgeUpdate.exe 84 PID 3888 wrote to memory of 1408 3888 MicrosoftEdgeUpdate.exe 85 PID 5216 wrote to memory of 3124 5216 MicrosoftEdgeUpdate.exe 86 PID 5216 wrote to memory of 4724 5216 MicrosoftEdgeUpdate.exe 87 PID 5968 wrote to memory of 1912 5968 MicrosoftEdgeUpdate.exe 89 PID 5576 wrote to memory of 3884 5576 MicrosoftEdgeUpdate.exe 92 PID 5968 wrote to memory of 3040 5968 MicrosoftEdgeUpdate.exe 94 PID 5968 wrote to memory of 2252 5968 MicrosoftEdgeUpdate.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\MicrosoftEdgeWebview2Setup.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:568
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5364
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2308
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.237.7\MicrosoftEdgeUpdateComRegisterShell64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1408
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM3QjNERjQ3LUE5MTEtNEI5Qy1BMjJELTZEMDZFMUUzRjc4Mn0iIHVzZXJpZD0iezkyOTQ0QzY1LTFCRDctNDdEQS05Mzk0LTNDRDBGRTAwODA4OX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins4N0Q3ODYxMi1FOUEyLTQ0MjQtODQ0OS1DQkY0QkExMDgwRTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzVGFURlVvZFZPNmJnOXlubGpzQ3VscUMyTldZYmpiVEpEbHRmQ1B3VnlnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjY1IiBuZXh0dmVyc2lvbj0iMS4zLjIzNy43IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODUyOTA3MzE3IiBpbnN0YWxsX3RpbWVfbXM9IjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD43⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3124
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{37B3DF47-A911-4B9C-A22D-6D06E1E3F782}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4724
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM3QjNERjQ3LUE5MTEtNEI5Qy1BMjJELTZEMDZFMUUzRjc4Mn0iIHVzZXJpZD0iezkyOTQ0QzY1LTFCRDctNDdEQS05Mzk0LTNDRDBGRTAwODA4OX0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0ie0IwNDEzRTdFLUNGQzQtNDczOS1COEU0LTU5RTIxQkMyNkM1Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3NUYVRGVW9kVk82Ymc5eW5sanNDdWxxQzJOV1liamJUSkRsdGZDUHdWeWc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Nzg3MzExMTUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQyMzIwMzY1Mzg0NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDciIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTYwMzI5ODEiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1912
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "1116" "1092" "1120" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:3040
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzcuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzNy43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM3QjNERjQ3LUE5MTEtNEI5Qy1BMjJELTZEMDZFMUUzRjc4Mn0iIHVzZXJpZD0iezkyOTQ0QzY1LTFCRDctNDdEQS05Mzk0LTNDRDBGRTAwODA4OX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins1RDlBQjM4MS00RUJELTQ4NjMtQkIzRS0xODM4RTcyMURFMDR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtsU2Q4YWJiSmhqcVBkdGFVT0VLMnZadGtib2sxMWI1RVkvWEIxUjMyZTlVPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMzkuMC4zNDA1LjEyNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Nzg3MzA0MDkiPjxldmVudCBldmVudHR5cGU9IjMyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI0IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODYzMjIwMDQzIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2252
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5576" "904" "804" "900" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:3884
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\CopilotUpdate.exe
- Size 22KB
- SHA256 01093a46273f0cb2a5c1882bc4e7e5dcaec20329917d5cc68c3703cddd89d520
- MD5 619ce8a6fa7aac85dc395f04ac94087a
- SHA1 2806513b33b1858cdf29ddbdec1f916793e79ceb
- SHA512 398e709aa84a80fd3e784c624e815f92e63179179e9a32815c1c704f6a4a39ab09128bcac242d1376b779dd185cc3ab49db9da828d127ad08a852a5d8f3c4b30
- SSDEEP 384:7+71xOBF1m6yWAH/ELvmtmKeWk44y2y4GlNzqki+R9zB6zOZ:iZEdm6yWLqEKkUZ9zEaZ
- TLSH T16FA28DC2A7788083DADB68B04469DD437C39AFA34A605BA76085F45D3D277C0F7126AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\EdgeUpdate.dat
- Size 12KB
- SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
- MD5 369bbc37cff290adb8963dc5e518b9b8
- SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
- SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
- SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
- TLSH T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeComRegisterShellARM64.exe
- Size 190KB
- SHA256 1c904d7076f36b18733eeeecf73c633b870d5e8ed140976fb5132252db3373ad
- MD5 637cd9b3e6468149e0c6c8a0c61c704e
- SHA1 2df1ff8e42e65468c298b90b9659dfab2e2138ae
- SHA512 27f4a3cc997348f55b91feafdc02a9769f99e0bc4c5356fa9b1ddca305d7144a246e7c64963a457e5e399f77573a346c0737d9c4a641a26a546a770fca11d3a6
- SSDEEP 3072:n8czz2uil5YOgydCsD1B4S/cU3iUMcc4DBIgPSQ:1z3il5YOFCS17Sz4lNF
- TLSH T13C143A6619FC30E3D1E2D6F8DFD48E12B32AE576A1204CA75283024D9D17E819DA7E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdate.exe
- Size 201KB
- SHA256 9433867b0e1f703728adbb2b83e43113dabadcff5e77a56d62da02780d5a3350
- MD5 023d0db75c48e6e0eed9a2995740523f
- SHA1 0b9b7e339ebf047625c6624daeb35bdca1070bcb
- SHA512 46a0fa78b0a04b4a128ef585469459bd5fdd47284523aca20ef8c58c70dcc14d29e6e7177f5632f66c20f62c4aa319646988f580ffc0da9e20dc8b7ee6ebbd88
- SSDEEP 3072:+7rfRYtM+X/mnITlED/to+Mghf+GvC6C36oPWDDVuB+VIVHQ2s3TDpQr9bx5+YmT:rfO8lED/e+3C3kDEB+XCE
- TLSH T17F145F2277F80A68F8F36E315C349F2A993BBC319D34EA6E1594218D1D34A51DA71B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
- Size 224KB
- SHA256 26851260f16e76e556471ca51d973f386f504addcfc8134b89d077eed54f1b1b
- MD5 631bc3c6f197653bd6a2884c132d85b2
- SHA1 55dca8a26e63e1f5f5c3ae16aabb5138dbb87cbb
- SHA512 9067ccd15fae7130a1f84df027906a11490f111daf124735d254dabea149e96245a2574a4692143b130bd29a13f12be378a4baedbe208bfe251bad8fb09a224f
- SSDEEP 3072:ZmQcudCe+ha01jpzyYrvGg7nycKXZTO2PQoY46GTY88j1JCRkW:AQcudvaa01jpzyYzGg7wXEohSA
- TLSH T1A224E66929FC14F3E1B6D1F98FD08903F271E87262118DFB4391424A9E13A916D6BE3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\MicrosoftEdgeUpdateCore.exe
- Size 272KB
- SHA256 34dab27cf63e8d478158e18a709c12f13420e04f139de2a11fabe9798de1d7f3
- MD5 714a9b40f271c7f0e03d8dc56c3ba3b9
- SHA1 4e3e3b6d16601aaa7926cddce4aefc2366824959
- SHA512 db59eb8b46db148e97b9ee3be595cec84e0c65920a6802388695487db249267ba9af212f8ddd7314d725d86a12ffe8cdcfa12448c1b074b5fc2ed09068421b50
- SSDEEP 6144:d8VsA8iTDAHGHWdfommUAdVIAOj4eXYQxh+B6CBMK:CSSAHGHWdfoYa+Ych+BL7
- TLSH T12954296528F84073D0B595B98FE4DA32B478F87256118DFB43D2474E1F22A82526BF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\NOTICE.TXT
- Size 4KB
- SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
- MD5 6dd5bf0743f2366a0bdd37e302783bcd
- SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
- SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
- SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
- TLSH T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdate.dll
- Size 2.2MB
- SHA256 b02dbe2d712d5d2af197cbe906e9cbbbe311eac250656554ae80ba68b13cf803
- MD5 691a48b8735e5c09f3f2615d4d8e247d
- SHA1 ad6562e5e9ccd0aeacca32fafe92b5ea8fc39dad
- SHA512 75bb1464a93091eb865d92480fc364ae3a885e998b9520baa1416a69eb49f5a1bfe1fbee222dfc4aa223fafa5bebb927f09db259fd64b2beb1fcdd4a3f5c8f92
- SSDEEP 49152:01rkzCCaXXPexXogtDYjrOyl+bQyQjUlvR0sXCta0FulDn:01rkz7EXPexhmrlovR068FuN
- TLSH T11AB58E2225E44076F4B246B1CBFCA51AA5ACF87117308CDB83A1568E7A32DC25477F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_af.dll
- Size 29KB
- SHA256 45c087e9de686ef8303e52d3365e1522d0171fdd73aa97301cd82a9828ee7554
- MD5 6b22eae4765396b7a9c54ced3ae6fb13
- SHA1 babfb1e96e986a58eecc244b967ef390309a659f
- SHA512 e4daf3087aa3640cb89c5bf4c5b095c0a936929a54e17b4cada1d200b163629450e2e37965128312bba849a753fc1804c528bd5dd4f0548b48fef861499cc743
- SSDEEP 384:MfvVFXh7BWmzIWWjrYiVDxlwCiO+g2y4GlNTtR9zj2D/:iNrO+aLP9zq/
- TLSH T1FDD2FA9153F4810DF4F73F30BDB896925A76BD92BE30956E2240A15C1C31B81EBB8B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_am.dll
- Size 24KB
- SHA256 9b34400303f50cf9f4847299607d95dc5ebaf6a195dcacde9286d9e02dc0a9be
- MD5 5604484419e05e50d05d682619e6962c
- SHA1 97b17b488b3009b238337b4a09be43b4fa79b34f
- SHA512 3c710d0e583925c8a1231566a61cef50efc07dcf97ebd56564cec732ea0717b4156f08fdb8ec6584efb1829c78b0946258f2044005eedd67ac85d98230b55c2a
- SSDEEP 384:/30UVFXh7BWmzIWA0Kl8Ss+Q2y4GlN3cDR9zg4sBeWdj:bFe8Ss+KG9zg4JWdj
- TLSH T170B2F74783509A0AD067BD740658CF6765BAFF0C1E2481ABB119FA2434E4763FB3AB5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ar.dll
- Size 26KB
- SHA256 dd153bb18ddc7739b0fa70f4a9b8e453fede5a68ed6e4b7d3c4e9868b2e686e6
- MD5 78a0a4a312401f1bad518d2ecbba29ef
- SHA1 beb2fc5ec8ebc6240f25877186425832b8576002
- SHA512 1fbb5a1f08a188df2b66ce15391fe8dafbe1e124b3993d269bf7117d36008af375e2b5d82baa49468ddc6d5646914eb1afa1f4c0d51a5724a79334f4b5e0ae5b
- SSDEEP 384:6m0PBbBWmzIWJYwTPsQtXvfG42y4GlNwMgYR9zW88GU6:mDbpXvfLXgE9zW0U6
- TLSH T104C2D7935E5CC13CF417AE34C16ACA23A23A52478DD8223A66309D051961772EF2FBFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_as.dll
- Size 28KB
- SHA256 c0008c220180185455ffd89a799fa65107faa3cb15bdd60f727d95d755e1bc0d
- MD5 5a91436102ee816991afbf338fd2c847
- SHA1 6dcbf6fd6d441a6fd99efd15111b4f236b7e03db
- SHA512 550d698863eb7fed7a6528cc864d8edb6c6ccfa1e0dd12c2ee95efa1b154d1b2c1b7fd497c2f1782a3547db064850f8f131a182ffc13c37dcd589b4a216363eb
- SSDEEP 384:q7WVFXh7BWmzIWdKnFUFw4sCi7mPuAsuUu3BUF/bql96u93RRSjJKlFIfNHF1Vl7:zqZ452DuUu3+F/bE6uEJKIlHp+N9zg4q
- TLSH T125D21C155740B624D5FD643C02D58DBB1AFCBACF081CA4B920E3E11478A53FA9F2B29E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_az.dll
- Size 29KB
- SHA256 26c857a73732ecefd60e59f12f2064dd80912f31febd221d34f5305396ecbccd
- MD5 c0655430e00c2d22673bf9e2077c1b96
- SHA1 52ba91acbac163968ed560be94a420a6e7629579
- SHA512 a455287be768cdcf5243640e3e8e7a25eabdb59038cac3c936b86bcbd59d6aecdb33c99fec60f634312fdbf19069efe54a1ca9de976ca8737343c7ce06ce0945
- SSDEEP 768:nMIOFe5FEuo//ctGFLFS2rF9FTFYF+WWX9zI:nGFe5FEuosAFLFvrF9FTFYFYzI
- TLSH T141D21E6193ACC105FAF35F305878BD4319BB7FB37A34914B2292A14D1C31392AA34B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bg.dll
- Size 29KB
- SHA256 512e149d931589d00b06c6a81b0f8bd2cdddce87d92e2bca63448dc733b27f64
- MD5 0ad4aa27e60b82ca94f6f2c7d50f49e2
- SHA1 4a17e0a5e2336e0db7e0f92d3bb466e9ad819b80
- SHA512 59ef73b296b2681971af65a72d136fb9ca609a75e3467bef88619eb0f8f807623554d02e5f3b3660d71365fc0f189cab49cdb09f15589b1145c75eb1fbf35bb9
- SSDEEP 384:xp3VFXh7BWmzIW8dsSCCdCwd0Qgv66n46wt2y4GlNirNXuifSR9zr3:vqdshCUCgCr6CK5lfe9zb
- TLSH T124D2FC4FB97C8204F655E6310FA6C6F735BAB750672486C6A34FBC68201D372772928B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bn-IN.dll
- Size 29KB
- SHA256 6d9e04f1ea5d8a07bf54ae550210c7d14a4a641b6aa0781145dde6c8ec52ec62
- MD5 ad3b7417797dea10aeb76981fe834d94
- SHA1 ba515eda04d65fc9da90bb25865071438eabeb33
- SHA512 18ec963027df83639853a68bf96e02c88fae1b492d903f5aaa47d45c3793e4188482865b2e54508add50b83a37582beae6e04ccc3e7af9d511596bf48a5bf7b5
- SSDEEP 768:FmvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHvwX9z/q:FKAGEbYczy
- TLSH T115D26316A750B814D6FD283C07D6CDBF1DF87241242CA4BD25E9EA0419A23FA9F2F51E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bn.dll
- Size 29KB
- SHA256 6379d00bd1b255f5fcfb7022be44b0dddb2ffba286c5a316c45edacbca7b7b85
- MD5 8c61494e952c2781a9d65d164697e3db
- SHA1 c9cc1cbee2e9db514096d58f0543434300287ece
- SHA512 cf56526e10645f796e39f87565d909c88bd076ca0a271f98f821f4e4c7bcf495c5cdb231c007c73614e862064a5ac9c47fc786951ae8711a85c3252b82ed91c4
- SSDEEP 768:vrvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHmQjlfe9zr:vLAGEbYHEzr
- TLSH T1F9D26416A750B814E6FC283C07D6CEBF1DF87241242CA4BD25E9EA0419A23FA5F2F51D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_bs.dll
- Size 28KB
- SHA256 94cee22396b55db9bc87177b2ff04ba8586fb64f3c9ea90539e68dd4ac2975f4
- MD5 40fafb0a93f05176b009e594e404a04f
- SHA1 dabf65a36076bb833569ceac21b8688869d81372
- SHA512 74dab3594015db688089e8469289b50b577302c17ff3baa30ebd49656a827feb6f5f536efa439969a458cec87beaefda0ae8610e483f9a4e99de5abeb17bc56c
- SSDEEP 384:3d/VFXh7BWmzIW/aDAmqRDU5NLCdJlwc/Xi+UFs47vL2y4GlNiifX7R9zA3wTZ:l+6lwc/Xi+ms4bDbF9zAgTZ
- TLSH T18FD23E41A7F8524AF5F77F30597457621E3FBDA2AE34910E2200659C0931781EFB8B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
- Size 30KB
- SHA256 a273fe4e4ff29631d58b5c20164b5fee6295ce79942f933c7b21ddf18d6e313e
- MD5 a551b67e56be53290853cedf05467d5b
- SHA1 f4541386059d5679ed1eb898fced67cdac975632
- SHA512 b1f1fb3a39cc4e539f563a5c3d2f2972ac8b86be29e457900ff978f3a7c00059b4b7c923a0ef03873bc65f6c3e0572e912eae70ddedfe3cd5e75c0b96dad9ea5
- SSDEEP 384:1iVFXh7iWmzIWDbkbOnGNfNFoBWk5gZAF2y4GlNAUMgYR9zW88G:DVbkbOnMffoBWFulYgE9zWg
- TLSH T1DAD2E941ABF84659F2F72F747D7889625E3ABD9AAC38D11D2200A50C0871F51EF74B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ca.dll
- Size 30KB
- SHA256 c329b7a62f0486cf980bc5f0b827ea1be89d7576e526025ed65150e4f8b0dfd2
- MD5 e655f7e3bd3d9de59e402d20acdfed61
- SHA1 0f0db5ddfba121863278c28e66a745876d1a2683
- SHA512 b31ae34261d89809107d1da676fcb7a77554ada6436945de8b48d475f9a5c179205b9ca15b41bd5c5312eae436a5d5476c70f4875d4889c29801818495508b6e
- SSDEEP 384:d26fVFXh7BWmzIWKHEWdvDNfNFoBq1ZQtn2y4GlNADcUthXBnR9zcO3qo:tcHEWdvpffoBqk3LCf9zcFo
- TLSH T1DBD2FB41ABF88645F6F72F707D7899625E3ABDAAAC38D10D2201A50D0871F41EF74B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_cs.dll
- Size 28KB
- SHA256 56859c575ed804409c586d9ea0c07fd33f2c641d9e3de58be479a5553e2b692d
- MD5 caef8cda55fa74771fa0887e5833c126
- SHA1 d9b36e4c13660f08f0ab9ca007365d1586706fcd
- SHA512 265c5c8fa2473c87fcb8ea3f9e5a37ae59097b800a2f8861f4aa0af66bdea50a65145f99ba32dfa0f16a02d95c2edb098f98831809679e4978ed5d460b90a5ba
- SSDEEP 384:v4mVFXh7BWmzIWeTL7PGQxQFnwd/l2y4GlN5oR9zFiRh2e:dITL7nFR09z22e
- TLSH T133D24E41A6F84145F2FB7F3069B44AA21D3B7D96AE34C14F6640929D1C30BC1EEB8B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_cy.dll
- Size 28KB
- SHA256 b22b1c1109cfd95f9cffdaa792b386c176fb4a1dff96507edfd93e6f9d728ce1
- MD5 1c2a03674657db95e7346350230c6595
- SHA1 f6837636ec383a42a4bb93af6855219ebd93b378
- SHA512 2951a3bb0927288e8496728fb1369f65979e0ec65874643f241ebd4eca113a4b5257d0c64565b6585bcdb56c3d0a379348b855949516e878887bd38d5f8e9e96
- SSDEEP 384:CC+VFXh7BWmzIWatZEmiuTHsyi7zAaaVamjyC8oyUFxOFqdJf2y4GlN6VscmeR9j:MYDWZUjxdJ/u7N9z6S
- TLSH T174D24F5143F8810EF5F72F74A9B6A6622E36FED6A974419E2340B1091C71B82DE3473B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_da.dll
- Size 28KB
- SHA256 43a54c0648137f3874bf9b03e008bfc0a53a0fb44fb0104df05c6f94f6375557
- MD5 0fe201c42cf6efb2ab81f43f4e033b03
- SHA1 4210ae38b3ab3a5c2d0ece82ce9ddd21cfdeba4e
- SHA512 bf94fb207bef0ca2fee76c45531aa8f458610947127dceb41763c49c4fbffc8734c6919bce0e13daf08c81d158f53ca9fc72469157dd8f2b66bc1f515b04ccee
- SSDEEP 384:ECnXVFXh7BWmzIWJm4HcyvBdIp2y4GlNP+ki+R9zB5Fw:hbG4PIRXZ9z+
- TLSH T1CAD2EC5567F88219F5F32F30BCB98692197ABD96AE34D61D2200A05C1C327C5E7B4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_de.dll
- Size 30KB
- SHA256 4ad43580ee86f6bf01b39b08bf8618c4881c3505006d03251a3c98065c4176b6
- MD5 07dc14b13121f3b70bd6512c82f4193d
- SHA1 608ddceb927590f978b417aaf6467b3fc2f062ae
- SHA512 aa2ea498365f860342b0ccb24c7227f17b1ed180ad39cfd16ba2fe465068652a17ce06919a38281e3b0cadca06b59a79d0a8a114aa64c2e0ec107bc25747373a
- SSDEEP 384:u3mVFXh7BWmzIWDeI4FBhj3ZnsYxrPbLA2y4GlN7cDR9zg4sBUQVc:PFetj3ZnLxTbL6K9zg4GVc
- TLSH T140E2D85157E88618F2F73F30AE7893962E72BDD5AD34E95E2340A05C1831B41EB78B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_el.dll
- Size 30KB
- SHA256 7586f50370609fb1765b48f23af8702d65a88de3c785a6593e44d1666aba1325
- MD5 895df772a4b4b04d94f95a07606213f3
- SHA1 66ed1eda6f964aa9dc0982f60647f1f14d42999b
- SHA512 17fb3eddafcca7f28e761bcdb41e4b4c1282b2b21de90ddfe3e60d5467b5211f47d95fef0a48875974396796f786f70252da48783d06cfc602c8e1673a67e726
- SSDEEP 384:GdbVFXh7BWmzIWEnBzBUBOTG94vTZtfFkmmFK9q87PgbN2y4GlNgoR9zFiXJD:iqpnxdFDE409zQD
- TLSH T147E2328E0EBF9711EEA6ADF24433862B9A3FF5860810DD6731F070449D1DA129ED791E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_en-GB.dll
- Size 27KB
- SHA256 84ae379784465903a7daedc596670827f87df1916115a4f3981e25ebfdea17f8
- MD5 35899101af7e83145b397b2567a0ba19
- SHA1 06f61bb08ff2674aba7c8ebd316db2b63ebf6694
- SHA512 d13c65867ae6e814156b3af6bbf17e181f45a1729abf209726b777b38621c53562432a9f703f5710b3c5980ee54f84ba7ff6c7d05c5d012a938d121009fe4f7c
- SSDEEP 384:fmVFXh7NWmzIWIkagyonbeg2y4GlNBgtR9zjg:I3agyoyaCP9zc
- TLSH T125C25181A7F88119F6F73F307EB496A21D3ABD85AD34D65D2200A00D1871B95EE74B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_en.dll
- Size 27KB
- SHA256 886a45777512cee613dff15117a30f7c6cc965dec2537b5f9966f1b471be3d9c
- MD5 dbdabcc9212451e1d747c2f2d7d24bf6
- SHA1 aa2b69e3c82376742eff69c0de8d004f4aa64165
- SHA512 c1b938a003a2ce26e22fb64b6f7ffff77d9fd0079a923d79c1c3cb9c4f0054e983512312fcf815062d90d0745f8ff7d3f16e543835d4d736d4417edf9eed04ea
- SSDEEP 384:/XZVFXh7BWmzIW1kagyDlBlRd2y4GlNpNXuifSR9zrSww:tYagyDlptLlfe9zdw
- TLSH T178C25286A3F48119F6F73F307EB896A21D3ABD91AD34D65D2201A01D1871B41EE74B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_es-419.dll
- Size 29KB
- SHA256 490d5be41800508904b4530740610b6beb1847e3e6365bd06073bbba78e1e0ea
- MD5 af66badc2188d654e8ecf6a98d1275b9
- SHA1 e67f7e6a614f0e30c8e4839770923de6d370a675
- SHA512 ba4ea4ae1e4e971395e2e17b2fec7ef76c8e6b4839a3982c625e4d447f2a56f583070cd1ad7d1de3f5d67ae57a4b31b12f7244626fb4792ccea93b6eac45b4c8
- SSDEEP 384:5VzVFXh7JWmzIWmadyUr4aa2y4GlNg3zMgYR9zW88MF:rrdrH0o3wgE9zWOF
- TLSH T1D5D2D8509BF8924AF6F33F34A97896665D3ABD92AC38954D1210A15D0C70F41EF38B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_es.dll
- Size 28KB
- SHA256 59621792791f9fed035ae7d528d157f6b9181f8ebfebe0590dba9097abfe3b89
- MD5 719e77480b4647b4db630468db95ac9e
- SHA1 30ccca5993aba01e6bb0c9fc33a28eefa8264289
- SHA512 b8b0defc67724bd64ab5a1f631eb5cf1c5fff245ed0698dc7ae77e15a79ccaf0447a4e080b12b0a64a7588d92b8937bbf98ae8beadd557972e11ba724a89a393
- SSDEEP 384:uIIVFXh7BWmzIW0t3MjNIQ2y4GlN+QFR9zj51vjN:Mut3MjNIKzX9z/p
- TLSH T1C2D20B5097F8924AF6F37F3468B856625D3ABD92AC38954D6210A51D0C70F81EF38B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_et.dll
- Size 28KB
- SHA256 14c02eb31eb44d88c0756c82afdc68e2d7e3de02dc4dd4a7690521d08e305afc
- MD5 e2a9a04311d81294bf8fb8406114747f
- SHA1 cbfb3862bdd807f5a286bf7e405bb991389b72f6
- SHA512 4c6b121438ba82890e981a8383a55f5f3939384bf1abe6a423828cdaf6828147daacda0c142f4c262fbe5a9e1ea3f57a9781a5f54101921a3100483f5b985512
- SSDEEP 384:KfIVFXh7BWmzIWVVc0dEyjELtX7giw1LmbVdMTwAiDiHm2y4GlNlMgYR9zW88vu:tz5jELBgr1LwdfAw1ygE9zW0
- TLSH T127D20D92A7E89119F2F77F307DB496521E777E93AE70E61D2600A11C1C30781EA78B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_eu.dll
- Size 28KB
- SHA256 e6181c997ed19dab536fb5cfd759fcca058edd05b6d1c6a7ee5db510bef61b1f
- MD5 c5a57392a00e9114bdc5c4280db8a528
- SHA1 a8a85cd6cfe6ca1670bd44ce37f1a90569340b72
- SHA512 77c232814bf67bb28a05a9b4d725a4f86cfec6ec4e4cc2c199d838cc2e14d9a5d9bf200c535548efecac71c89b66a1e622e45a07c8b4af919c346b13a311f0a7
- SSDEEP 384:FSMVFXh7BWmzIWzcLpNrX52FOX3z14Ob2y4GlN4LNXuifSR9zr:r+R0FOT14QQZlfe9z
- TLSH T1D1D2309797E89158F6F76F31A9B885E62A77BD626935D52D1300A01C0C32381EE34F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fa.dll
- Size 27KB
- SHA256 471f012dd01cc7e5361ff27a967acd22c12951dbef7f703ff69fad16fe58711f
- MD5 9cb9b972667fbee7a08648d835c37f52
- SHA1 7819925fe470f264038282e86a1dacbc1ccc49e3
- SHA512 27cfe2d15133790ee6670535f25c7a0569aa79cec484c89363ccc3d8a9e80776a08c7e15a69ff64cf6d73c310b46e0d4a8d7bacfec4731043e21d94984b6c723
- SSDEEP 384:w/8PBbBWmzIWgXlQEqt0A0Q6Gft2y4GlN9cDR9zg4sBJ34:nzr2C9Y9zg4OI
- TLSH T11ED2800A8DA6C470F5636A34C50BD973303162DDAD8189361FE5A83C19813F9EF6F62E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fi.dll
- Size 28KB
- SHA256 6b13faef46ee9cb161201455015308f3cd9ea26359357a0a9b2e22fdfde97e7e
- MD5 eb6db5e0c02f62ff0f1cf0da0c41dd3e
- SHA1 500707973229ee68d2cc88adfee307cbaae7af1c
- SHA512 6a6f9f5c5a60c20e903a2a24070a04864965c6c4662f65201abea158b5632703ee52baa09e1f556b77dc7dc0c01bb4ae523cdbfe51e9c2b199a0639239eb6544
- SSDEEP 384:XGxVFXh7BWmzIWSJWHJWEFIxnyELZWEYXsN6ZKFl+EoOh0vFqY2y4GlNv5R9ze/:C8JOJOUjyCT9zE
- TLSH T1C0D2009153F8C229F6F76F306DB886121A377ED36DB4D21E1A00A55C1C21781EA75B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fil.dll
- Size 29KB
- SHA256 0bb20964c4da984392b1e34bfdbc104e97436702136b3d518c81945599efe5f6
- MD5 bc08611a0e21c7b255d026946fed2a6a
- SHA1 349988353e2543b63590a4b49a5675463119ff00
- SHA512 54456551a29823e79d5bb11d98bc6c6f694205b6492c1dfdb7e270be2824a96ea3708d40daf4d68a2197df607eb243c353379606bc8125b31bf2418c95ea37cb
- SSDEEP 384:eaVFXh7BWmzIW9sXsjbjkbkzkrJqPDLiuz2y4GlN2W/oR9zFiSR:/3sXsjboIzkrJqLLTbF09zH
- TLSH T1FFD2EE41A7B8811DFAFB6F3079B8A6A11A3BFD465D38D9092240951C18327C1EF74B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fr-CA.dll
- Size 30KB
- SHA256 8e596f3278774b6a234573ff5b03e039c8d5c8852b0bb069d26134404aa3ca95
- MD5 dea658f9ae03566863e7b496d9e68734
- SHA1 bd4fbbced8cccca43f092225412fabc05c18836c
- SHA512 0786548104317517cb46435a3a099b196cdb37e49d420ea900ac24fd8f22c4c668b59dbecac3983acfda24676be0df821e76c36d27e05d95ee68afaa843c32f1
- SSDEEP 384:sWVFXh7NWmzIWjs7otIRr0UA2y4GlNjG9cDR9zg4sBTu:NlINRrN6rGA9zg4Qu
- TLSH T149D2B845A7E88215F2F77F31B8B986521E3B7D968D30D52D2200A19D2C71B81EEB8737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_fr.dll
- Size 30KB
- SHA256 e614046aa15649d6252f25703a79347ebb017efb0a7b7873a256ae2d3ea59ba9
- MD5 34f2d6487a867bbf9c8d85149a104995
- SHA1 205ece17164f390db8180f4d6d37b357f0201b5f
- SHA512 5b22839abbd21db733afb2aa97e296320c5fb89a1950d2ff0834fb5c30ef7107c28717107d3628acc342f3e648b5d47d8ffbf08bf944d66ec38fd4665c00d3dd
- SSDEEP 384:XMAVFXh7BWmzIWD8bW6408o2y4GlNvcUthXBnR9zcO8gV:Pl8n4lS8Cf9zcr4
- TLSH T15BD2B885A7F88205F6F73F31B8B986521D3B7D969D30D52D2200A19D1871B81EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ga.dll
- Size 28KB
- SHA256 5b3f1e6bd5a3e3fa31f96b653b0552d0c6f36e480848a53a8c93aefca9b027a6
- MD5 ce2ce2c4aacbad9ca174067ef721cb91
- SHA1 14a95f3064815e392b9f229bcaa5dd242a484388
- SHA512 2eb4a76af4963c0ce1e3c7fb156cfb87cc61552ba6e0d29e8b64a74f099a1eae14de3f7eee2ebfddf71b23ba0f59770f47855cde28d95a2d5eb4776aa820a306
- SSDEEP 384:VxDVFXh7BWmzIW+5vCQkcYoIoAxP7GXX2y4GlNjFbR9zBFk:LY5vTYoIoAlCXnf9zI
- TLSH T141D2FE5453FC810AF9F32F3069B487636A36BD92AE38D21D5240A64D5C35B52DE34B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_gd.dll
- Size 30KB
- SHA256 4dd0652934cbb40ccaf2017e8e463d78d1e136c09c99e7cd322506ec43f7dc9e
- MD5 6f0b6e501868f3ce78b9478fc652ec45
- SHA1 7cd2a1c9a5cb6b8d62ae63105709bb630c8944df
- SHA512 f7843e6d145b839def90fb1a83a917d0c439e85bb3c35ecadacfda895e6f286011f105e1711939fab77b3f13b172af8dea75ec10f3b6889f29d2fd3eb91fd6c2
- SSDEEP 384:1d0VFXh7BWmzIWfFYiA73DpfDfqKiXjR8xW2y4GlNDF6oR9zFixGZQ:+ZFYiA73Nbqfl8xYLF609zrQ
- TLSH T101D2EB4457EC8648F9F36F38197583A2AE37BC926D3886992300655C5D31B82EF39B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_gl.dll
- Size 28KB
- SHA256 b833276fc66448fc7014abec760c832f812397d36912f868bcc6bf982e908384
- MD5 15a4996139b9e6ed456b931d74225772
- SHA1 39cec094e1982c09f70654a8f7e1d87c6b776f88
- SHA512 574d4c1ca5d01d123ff6f79df58c3b0a8419eac84b4bda6423e5f1c2e4418391a4a0921517874eb65868952eb3477df160a63e8f45fd2c15f6b37bae580888dd
- SSDEEP 384:/UTDVFXh7BWmzIW1sCCp2RK+oV2y4GlNSXoR9zFiX/1taQ:Ozse8+o1M09zi/9
- TLSH T10BD20B4097F89206F6F77F34A97856665D3BBE92AC38854D2200A5190C71F81EF78B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_gu.dll
- Size 28KB
- SHA256 284aa36abead44c60916a4552ebb1760e93f34baf946247dc4f6ecec5306fbbb
- MD5 07774bbab4ce2b43dc542a564aa86117
- SHA1 e3e7010f8928979f3697e20d8a084c562486e266
- SHA512 d0a73451d831bd52050405d4f7bd7a2974f65667553522b30189c7e201022e53ac4ad5ada597cfaad2bf4d41830461cf925fddd22dcd1b5503a3ffdff68b0e7a
- SSDEEP 384:lZWwjVFXh7BWmzIWZt7vdQrsojGtCAPPFZCxT3CT6xytS2y4GlNsWcFbR9zBNQ:ztvlCrngckWg9zI
- TLSH T183D262A66BA741CFD06E687082F9D533F7391191D620E1477166A3833DE3342BB2A79C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_hi.dll
- Size 28KB
- SHA256 dfb9f2475321efdd597eff7f8a6878c0c7eeea805cd00040d743ea204accd9d2
- MD5 ba491dd915124759bb4f33f0166f4d68
- SHA1 78db13250cf47356295bfe35d5a22ceddf89885b
- SHA512 7b1ea0910fb0804aad41b51fedfca75bf0344000dbe21c9935efe1932294ffd3377c4863b0197b31218b2fb36ec1d79025a0088543f74c7c62d118d9f8106c35
- SSDEEP 384:juwVFXh7BWmzIWuQcqYmmqkKb2y4GlNhqNXuifSR9zrXH:VAQcqYmmqk0clfe9zz
- TLSH T148D2840204908F18E05C6D79E43887F36CFF6425B9CD13C5AAC171F9DCCA37B9A69A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_hr.dll
- Size 29KB
- SHA256 61903e920fd02e83b2a7961335c09627aafb12753cf19fa330880cbe997f1873
- MD5 9feeddf0937c9d915adc9513031c1b9a
- SHA1 0a4830729c7fb7dc5342a28d804152c5d14c44c2
- SHA512 691bf1d1ce1a632de1052b8603d08b386ff0b3a322282d9dd0250bb03744fccc664a000a2da878f4a0b4e6eba25a034ff121d408e628cbf088b3b64bbc1b2bb6
- SSDEEP 384:D5lVFXh7BWmzIWD/fbmrsCCa9gNk8qaEa/yi2y4GlNMtcDR9zg4sBo4b:XXzqJva/ys0w9zg4Q
- TLSH T103D2FC42A7F85159F6F73F30A5B457621D3FBDA2BE34950E2240A5890C31781EBB8B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_hu.dll
- Size 29KB
- SHA256 24e8727d53608e1a1edee1787ed56f076b2ad72c5f4c7d46d293f46dddbd1dd6
- MD5 cf13a6a5f18f8efaaf63a6658efdb1ac
- SHA1 662e3e8ae9df2d915db6d221a7892781116d3dbb
- SHA512 5de57d71309bfed2675388b2b5fea640b6e9f33ff8f0042765b1ce61e66332406d3e1dcf7c93eb85e4eb6af1a7d0a2c77af954a693c5b67019c550fc97d06b24
- SSDEEP 768:tlKkZ2hSV6S8yotbufJHw1bNJxslfe9zuk:tlKkZh38yvRHQbLzuk
- TLSH T1F8D2204193FC8546F5F75F323DB487931D39B964AE3CD21E6680A28C1835781EB38B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_id.dll
- Size 28KB
- SHA256 9bb163a6e0c654001e27596e78fd94216f11665d76b6f1677140de1dd7eb7d14
- MD5 5e6a8532242ea2a6a4ad0da11161ee45
- SHA1 a053e2b72b185732d1018934870639a27c24fb14
- SHA512 279717ea88fba413f07006f66e654a844f7a5f9ef45109c6ab11b951593f5add09dee0ab62175727fe4a36c8cdcf597b96e0f78ac5da4dccf12f7680d58112cc
- SSDEEP 384:NCFLVFXh7BWmzIWhPC8kJZT9r6T1fQC/2y4GlNcMgYR9zW88W8l9:A3737gE9zWYC9
- TLSH T11FD2DB9197D88159FAFB1F306AB896921E6BFD93AD30A64D2300A51C1C317C1EE34B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_is.dll
- Size 28KB
- SHA256 142b23ed07c722efa6da9f9d53ea2a793aaa001b13919d2bc4156128b4f2bfde
- MD5 ab7ded2b871bec99eb927cf562c85d00
- SHA1 e853436764b6593ae5d99dd42eda6eee49ccaffd
- SHA512 113b6fa343c00c1dd6fd11ba657bdac2a2c56a85f890ac73adb5de1fe6a728d141e9e5ed0461ef0b8cff2db2c61356d76cd2113742c8b906905a80f3821f6543
- SSDEEP 768:QKBkg5TpAhr+8wp0xoYpGYrPC3F9zAg7P:QKBkg5TpAhr+8wp0xoYp7r2zJP
- TLSH T189D2FC84E3E85109FAF75F3058F493565A3BFE979D34E60D2641A94C08363C2EA78B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_it.dll
- Size 30KB
- SHA256 503c95fdfa0a2bd7d07aa982283767b4319c37954d3da6624fcd127ed8447ce7
- MD5 655f3da3e8cfac94cbe4414a5bb09c39
- SHA1 17ac6712443a9615ed8c06a6998a08a7f02a1fd8
- SHA512 4536aa4efee3755f4567831334a1e3e73dc36160f6206a5781d2b6693a14cd1f9dd4d3428b6d69b178354bbc0f133f3939677522ee03af3d97328055a160a3c9
- SSDEEP 384:dSkVFXh7BWmzIWYuu1+JswzP2y4GlNTcUthXBnR9zcO2pk7:TY1+JTzvQCf9zcru
- TLSH T15ED20B51A7F89208F6F77F30AD3896A60D3BBE82AC34D51D1241A05C1831B61EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_iw.dll
- Size 25KB
- SHA256 092eefae18876594665f8ae03a10e05271a9857fb88fe820d2c6ac07c9759e10
- MD5 28a4755edb561986a2e2e4df77548003
- SHA1 beca925d2dfaaa8a62a254bdfba8f7271326e571
- SHA512 d322e462ed31d16dab4d5b112f2559773614b1e8348eec60a1f8b0aa311cb39f3b1077ba17f0855e941cce4e388a9dbf7e70f0555f9bbeb7789edba0c3d7d947
- SSDEEP 384:DznPBbBWmzIWDbW1x4SCJ54LGA/ExQL2y4GlN8mUifX7R9zA3w8:jVcCTI3F9zAg8
- TLSH T1E4C295415B60C2D9E925EF33826F8A2F6634DB40063876177059A9A42D2E7D2EF3D73C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ja.dll
- Size 24KB
- SHA256 733538bcaff0d32c6d086999be78f3ed345b32f045faf0e4ecc1d60b7c94e9ab
- MD5 15c096ea90e63c1d8980ce50533a24ed
- SHA1 8608cc4b0b140adfeb6f2603b09f218fe744d5d9
- SHA512 8c8f7ff6f57a649cebc4dc57df7735abfd7abfa343c607de2f20b95b7b3669f5136f7f3009fe5d0df238d7690b451f232754e681c10ae3ff3d1f250f9263832c
- SSDEEP 384:Nc6VFXh7BWmzIWp9gu2/2x45B2y4GlNDtR9zjvJ4:vXfALP9zW
- TLSH T12AB2F7C96B60CD0FF8F669B101A4E6A63E7DF6611AD188522641E40E28407D7EB37B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ka.dll
- Size 29KB
- SHA256 7ff184205da4b305a8a55e629ab3f7c56f5c4f1246fd475ea7dd4c99443fede0
- MD5 3eba76ac65f20217c78a61dac2ec4435
- SHA1 d28ddd7bf40a109a99a3fcad38840a630491ab58
- SHA512 b090544f0152abca49422c13d900292d43d7672387bc569912775e22acea025babe57f4e63922eee271cb51aa5b784dff41e97cc0f0171bf09e4bc3984298959
- SSDEEP 384:85vVFXh7BWmzIWjodoA7s4THmES4c9OkQ2y4GlNZoR9zFizXn5:A6cKR09zU
- TLSH T166D22C0247938922E19E2A3069BCCFDEB53DABC02540551BB390AE986511BC3DB7F776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_kk.dll
- Size 28KB
- SHA256 fd44d30353305ba091ebf208755752f57463a288a973907589fe4155d9e672c4
- MD5 97835ff32b4bc9fa554f23aa70a336f3
- SHA1 a0ad7ecbac48936cb0914ca97aa47224f979ecbe
- SHA512 a02a4ac32ca635d1186edafda8b538271c438f1ed932e9d86b477a7da16ecc1579b30cc1d08a3e8d3b154c9f7b48b18022ed9970d58a6446b6846c7b70bf52cf
- SSDEEP 384:CluVFXh7BWmzIWg9MvPQwo2y4GlNnjR9zGGB:BGWvPQwSd9zh
- TLSH T15CD2834F6570E605E0A4FAB04AE18AD324BAF3541B1845F7BD4FB5182869B32FF35AC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_km.dll
- Size 27KB
- SHA256 66ffc0e7325d324a2e7acc8769830c45b48268d53ff2e3211a8abeb071923a1b
- MD5 29a655ebc5d3df53866d38f4ddb68a52
- SHA1 20f33bb060c261f80a39654d3d54e05c7512b339
- SHA512 c0ab9743bfa74d22bde021a654f7b7b8fcb7fa040d8059cd30c23fc2bc12f3b5a452f6d9b63c150a84c15827943f94b1bfe9c41a0c7392038003bf6e6a1fa00b
- SSDEEP 384:j1VVFXh7BWmzIW0fJoxeUnPcS7cePBpxCNpJ62y4GlNXLFR9zj51v3B:HjxdPX1PBpo/JU/LX9z/vB
- TLSH T1AEC242D40170C0B9CD23D934C1B5ABBA3632B1DB9A396D472211B8650A327C6FFA5ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_kn.dll
- Size 29KB
- SHA256 b54e7d75a8a2f8068decbddda098beab6ad4a4576f2b3697781367bc31b6fd85
- MD5 2146ee94a1ba7fed6a89e37bf6b9500a
- SHA1 f34ce65c1f5b28088a1a2d6ee54b0e73ebdec18d
- SHA512 488394880986b6e54077e6042835a92597e64bb192b96581a6a482a8cf33bbfddef2491ccfaecdb98b06be2f3a3e001d568aa0610d1b5d31a27440feb1fe1433
- SSDEEP 384:OPvVFXh7BWmzIWIQd4SyQRPbwW2y4GlNCGscmeR9zlMH3qE:UaQ65YaG7N9zSqE
- TLSH T18AD250CEC3B7C815D4C43EFF016758BEE520AA9754E156D33206904C2691BF9AB39BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ko.dll
- Size 23KB
- SHA256 3cb1b558d15ce220774efce4640e0361571a71fd7d69ed45e8f312cf9e7402ac
- MD5 38eae1d6f22375ff8f9f9ec7772ff935
- SHA1 2df09b3e4f122aec9ef1875cc7f6a7d1985d25ec
- SHA512 e7f9b9231beed7c101faa82c8ba490c981eb9472f4c277e8231e350b3766f8d4c8b222b615935b3cea49b590b6f520c2c4948a198578153cec68da3eee2a4ee5
- SSDEEP 384:6uLCVFXh7BWmzIWslte7yWYDeYhHNjLUtUB1SGGgrxYQ8lJDuk2y4GlNZdjR9zGB:58GM+OkFzG99zI
- TLSH T12EB2E75792A8C102E461BE720AE5CBE7753AA3915E139857F700F16C28263C1FF3979D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_kok.dll
- Size 28KB
- SHA256 151a3caa09a6f5ab79859bcc1bd42002f791b7185b729d90536ca55e77a9f130
- MD5 febda5a1368f18eac6febe7cf02a2173
- SHA1 f13362d7b3ed0d99ab4f08fb7ba973e416256401
- SHA512 6730c76398d2fb9d2181c0f07bd4f2b48fc93af54cefa64ca7c5480683325c3d8a3b99a5b8a4fdc1f5fb5b7193ad013ac3bffc2e8c192481abec925195b716bf
- SSDEEP 384:UEn1VFXh7BWmzIWvRr+hjZ+hjgOjWfosY2y4GlN+cjR9zGGe:d52MKwsCL9z+
- TLSH T124D2964251C08728F67DBDB8E0784AB35CFD2114B6CC13866AC472E9E8C637F675D2A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_lb.dll
- Size 30KB
- SHA256 ebae71e0d4fb2e0fc933a5a934f88fd367f97ce8b134290029c4dd334f6e7628
- MD5 cc785ddc414e711190a60a6a844d1f86
- SHA1 122ffb11bd20c1f6279e0d3143ee46c242244705
- SHA512 5cae1c56182390893ec0fe11083958157ad7ba9a2884e86187e7487848f2e68ca2e4db1c23ee105e5f1a5ca0385c3b69be3250e4aa6477861f0e5e3f5fbe8834
- SSDEEP 384:vx0VFXh7BWmzIWsse3swt/bmTRigvyOH2y4GlN7JAifX7R9zA3wULV:4as4sSuAyXznF9zAgUB
- TLSH T1E6D21E4267F88119F2F32F316D7496A62D77BD82AD34DA5E2240625C2C31B41EE78B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_lo.dll
- Size 27KB
- SHA256 5a3d8d496908bcb9a888a73bcf5f9385a7eedd3a5bd1d8be342e59de6b0f1913
- MD5 581147df4d9d529a9ce06640685d1e82
- SHA1 96660ea5cba62e8468e9dda558a9f9a5646adf82
- SHA512 eaf55e577f590a90dfeaa9be77bfbb071b568366590610097fab73b92fd20346223adeacf541a13050c5b41a7bcc624d4e95398f27837e5aee2e20f0c3e0c290
- SSDEEP 768:SDADgApU01duiHkJwbMQpxZZPUg2gE9zWUU:SsD7pU010iHkJwbMQpxZZP0PzDU
- TLSH T1BCC295FCA2D0C01BE1EDA7F0D46DAAF57CB53644070345676744A834AB623C6EF78689
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_lt.dll
- Size 28KB
- SHA256 63e0e437e918688a971a3dc37b81e8ea674b582e23892ddf45a7e4f33554827f
- MD5 219e4fe4ed8ee66c39ebceeddcb607a0
- SHA1 7fc970b3d1119bdbd4771e2a087d786a207545ed
- SHA512 bb4925d6735ffff6fb9d1f9b4f58f420f0359cc18e7e357954b262bce865a3a2e46d120f96f83c3f899ae5889f827fd73c6ef2feb772db1114d72c19e236c07e
- SSDEEP 384:HzwnuVFXh7BWmzIW1rVs2BZJ1f+jmU55z6B60Kmr6YDP2y4GlN+wifX7R9zA3wjP:cENrB31f+jmUnz6B60NDvGhF9zAgjP
- TLSH T1A0D2105563FC414AF2F36E3046F88A565B3BBEA66E34D21F2100A18D18317C1EB75B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_lv.dll
- Size 28KB
- SHA256 d5d17dc3cdf54fcd9312158ecdc61ffcc902f19f766faac8fc82db8f2db3859c
- MD5 9dbf8aa8842cb4ae0077d54d104c7a61
- SHA1 2e506b4a27ac9c98fef225f905c8bde267d76cf8
- SHA512 3204d3788e8f1df0188ad4aa39eba9aa8e0e6a3b135d3125a935dd2950850893c232ffecc8e4a585f9a1c8ae63ff60010aed68a5a4979ed8100b98eecad07cac
- SSDEEP 384:LYNNVFXh7BWmzIW5YppSepDyvK5x/mIg2y4GlNLgNXuifSR9zrr:UPma0lfe9z/
- TLSH T123D2438593EC4219F2F35F306AB48B522E3B7D926D34D15F2100E56D1971B81EBB8F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mi.dll
- Size 28KB
- SHA256 fe29568b8d221cec984d1c52871d21bb79ff4a4f9aaa9be6ddec0fa433192101
- MD5 0a803121330e404d7b9b203db8724313
- SHA1 2ba6c808cc65a44ee85c006f8256d1e23167667e
- SHA512 4f4d2296ae20e0d9f3b43dbf4bb897aa17ef6d619c661881954a322825ac5314ad649f44b641ad431519db02c76814d2ab681bad6a2aa57b1b316a8693d37e41
- SSDEEP 384:EXSVFXh7BWmzIWFHDPvhHXBRDEWUDrF1/rzLOWsMVbwwH9hlnyxNCr2y4GlNw/cd:pzRp/YIm9zg4NM0
- TLSH T185D20B4256ED4206FAF73F7142B487522E3BBE66E938E74F2500946E15363C29E2472B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mk.dll
- Size 29KB
- SHA256 1eafea76f45119d944ab628fa8628995ab8e7430961ff66c8a4bd911a94efa9b
- MD5 6e8b5f7dec2283a47e0444a413a7dcd3
- SHA1 de0f6fa07eeeaf94d48be9bcbf931e94cabb9685
- SHA512 ede4f42dc4df471373580a62e622c93cd74194c7b87bf482e8a34030831b2a4f25e0adce3a17810aac54d5771f12bec8bdae3f89d89d2b2de1774bc6059edcec
- SSDEEP 384:QnDVFXh7BWmzIWXHbnGAYeBCEdpEXeR5qw2y4GlNsy2MgYR9zW88MU:KJLjgUp0IB/NgE9zWT
- TLSH T1DBD2114FB9BC9204F691F6310FA5C6E23579771067244687621FBC683029732B72D6CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ml.dll
- Size 30KB
- SHA256 a0ddcc46795a982d65a20cf0647be28d75aa117481e80312453429fa56b431c1
- MD5 ee40dd6357357cf5ced1de612a4ac10c
- SHA1 f15d6b1501ed7deae4e762236402a219dc470358
- SHA512 7ed12954691c17b3700f4d055b404a5ebc730a56bdef87843ca38b8475c94056318ff9e6d99861c95fab790b4fc2a3a0d52c8e40ff47f1b671d773a70560fad5
- SSDEEP 384:BQUVFXh7BWmzIWQh3l/cdGKXpVcGOR/uLZpIqCX841SG92y4GlNMEMgYR9zW887Z:d5d+1B0rgE9zWj
- TLSH T1EEE24FA76550FE13FBDC14F40E4A8A57E5ECAB0EC95866A8192061F23D5E3036F2C7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_mr.dll
- Size 28KB
- SHA256 b806bbb5bf20117b54d2870ccb90771e694e6f44485cd2037ddedecbd739f847
- MD5 d6c90c0f0d5adda6e8b2febbd8ba63ee
- SHA1 986b3bb30ceafb756134b35230599c528f2f3bf2
- SHA512 93522ea47766100fa810b2dc8463086f5257882c68c502d46f4d186de8633bdbe1e1c18e0e5aaa022355498bb0a437f1670256d1e07ff00f64fcb46f2f275554
- SSDEEP 384:RwfVFXh7BWmzIWRMdGDFC+0ULAvVuJG2y4GlNoHqFbR9zBcDe:g9E9gHu9z3
- TLSH T140D2740251808728C55C6DF4F47447B72CFB2458B9CD13C6AEC5B1EAF8CE37EAA18669
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Temp\EUE501.tmp\msedgeupdateres_ms.dll
- Size 28KB
- SHA256 2417bc0621f5b270da42c2bdc6cfe97c59540cb25d95cb8587e5559e590f3e6e
- MD5 c87dc24f3fede6e33140d8dc0024d4bb
- SHA1 f713301b604c4ad251eaa381de0255599b8f3d60
- SHA512 9a5b2dcaf75c1085721d0bf38a9b4245b42b91fbda058fc7894f0596602a3fe7d9a86cacf2bdc16cac7df4ae25f672d019c0021d4ede99fa709e380149cdd233
- SSDEEP 384:iJbVFXh7BWmzIWcn1QHdtfEjyq/u3ySj6rQcCWyXrEZPyfQ/xXUN42y4GlNMYVck:OiHc1b34/yY0L9zg4i
- TLSH T177D2CA9163EC9109FAFB5F305AF496921E3BFE93AD34866D6340A5181C217C1EE34B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
- Size 215KB
- SHA256 eeb3156598c0eb03e751530ca0463cea15f01381f8319f4c3447931200524807
- MD5 b80d7171af3986f353fd9f6c24b08b02
- SHA1 f93a86dc89e4f401cc94e8a8f903e8de1ab621d6
- SHA512 222cac89083bc0e13f341c6c803e3b5c9b5c394abc4990998768bf66a98bc30252268392e7579c151e658aca891913af92a26db163d68e11c6fa2e1dd0b1d8f2
- SSDEEP 6144:7yPXqgA5QfbHCBget0J0Fw3s/0JyPw0FFowWhRrKxeqFoBvbP:u
- TLSH T10924487677F8065ABDF79E16E9F6DC66B97BBA662C18C40C0091128E0C36F01D97072B
- MD5 SHA1 SHA512 SSDEEP TLSH