fcb249a8b688b47fb50f300c0d181a082edf963d6e9aae90fe28c009e8153a19

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
Size 763KB
Sample260723-hsnjmax1dw
SHA256 fcb249a8b688b47fb50f300c0d181a082edf963d6e9aae90fe28c009e8153a19
MD5 4ec7cbab03a51d543ca56e3640d94a49
SHA1 24c33cfb0d52bbb83f2edd0c76542a68af375a60
SHA512 e8e3437a959c5d023873d203df2dd876897868261b91ceb040c07d7eff030bf58d6817bca41a23264e059dffcbc4195256d329d68ed059a8f684f03d30547863
SSDEEP 12288:kKghkarNotnS6fIPFlDSUwZOxfcdly/tPE5vZxzn0bxxfkBSE1o2jF7V:ChNHDcDdly/NE5HzAxcBSj2Z5
TLSH
T1D7F45A2266ADFCEAC1B5127267BB93D6632DED210326D1CF62C03919683C1E37B35761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ctdownloader_2760 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe\" /afterreboot=\"C:\\Users\\Admin\\AppData\\Local\\spglobalenergy-excel-add-in-v1.7.0_2026723812\""	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\dual_engine_adapter_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\identity_proxy\win10\officehub.identity_helper.Sparse.Dev.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\identity_proxy\win10\copilot.identity_helper.Sparse.Dev.msixbundle	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\6d781dd9-92f4-47b9-bf3d-498b309784b6.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\dxil.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\edge_game_assist\VERSION	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.targetsize-16_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\StoreLogo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\LogoCopilotDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.scale-400.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square71x71Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.targetsize-256_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\es-419.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\is.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\EdgeUpdate.dat	MSIFAA4.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\EdgeWebView.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\mspdf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\Wide310x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\StoreLogo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_hi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\nn.pak	setup.exe
File created	C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\Microsoft.Extensions.DependencyInjection.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_pl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.scale-200.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.targetsize-32_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\StoreLogo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\fr-CA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\Square71x71Logo.scale-400.png	setup.exe
File created	C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\Microsoft.Web.WebView2.Core.xml	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\identity_proxy\win11\officehub.identity_helper.Sparse.Internal.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_eu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_ms.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_vi.pak	setup.exe
File created	C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\sl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.targetsize-32_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_ar.dll	MSIFAA4.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MSIFAA4.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\identity_proxy\win11\officehub.identity_helper.Sparse.Stable.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.targetsize-24_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.targetsize-256_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\Resources\lighttheme\dataset_link.svg	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDE21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAA4.tmp	msiexec.exe
File created	C:\Windows\Installer\{47BBC7A6-9A2F-4DE2-87B3-B4DECC32A4AF}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF67177456BAB7A8A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\System.Buffers.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\System.Memory.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\System.Runtime.CompilerServices.Unsafe.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\System.Numerics.Vectors.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\e59d20c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB271A451831AFAFA.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\System.Resources.Extensions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\SPG_Logo.ico	rundll32.exe
File created	C:\Windows\Installer\e59d20e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{47BBC7A6-9A2F-4DE2-87B3-B4DECC32A4AF}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5EE623FA6C6F128D.TMP	msiexec.exe
File created	C:\Windows\Installer\e59d20c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{47BBC7A6-9A2F-4DE2-87B3-B4DECC32A4AF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6368460D09DE661F.TMP	msiexec.exe

Executes dropped EXE 17 IoCs

pid	Process
5944	MSIE4F8.tmp
2960	MSIFAA4.tmp
908	MicrosoftEdgeUpdate.exe
5788	MicrosoftEdgeUpdate.exe
4344	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdateComRegisterShell64.exe
3888	MicrosoftEdgeUpdateComRegisterShell64.exe
3852	MicrosoftEdgeUpdateComRegisterShell64.exe
4928	MicrosoftEdgeUpdate.exe
864	MicrosoftEdgeUpdate.exe
2976	MicrosoftEdgeUpdate.exe
1720	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe
4140	MicrosoftEdgeUpdate.exe
5952	MicrosoftEdge_X64_150.0.4078.83.exe
4472	setup.exe
2584	MicrosoftEdgeUpdate.exe

Loads dropped DLL 36 IoCs

pid	Process
3360	MsiExec.exe
5892	rundll32.exe
5892	rundll32.exe
5892	rundll32.exe
5892	rundll32.exe
5892	rundll32.exe
3360	MsiExec.exe
3360	MsiExec.exe
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
908	MicrosoftEdgeUpdate.exe
5788	MicrosoftEdgeUpdate.exe
4344	MicrosoftEdgeUpdate.exe
4420	MicrosoftEdgeUpdateComRegisterShell64.exe
4344	MicrosoftEdgeUpdate.exe
3888	MicrosoftEdgeUpdateComRegisterShell64.exe
4344	MicrosoftEdgeUpdate.exe
3852	MicrosoftEdgeUpdateComRegisterShell64.exe
4344	MicrosoftEdgeUpdate.exe
4928	MicrosoftEdgeUpdate.exe
864	MicrosoftEdgeUpdate.exe
2976	MicrosoftEdgeUpdate.exe
1720	MicrosoftEdgeUpdate.exe
1720	MicrosoftEdgeUpdate.exe
2976	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe
4140	MicrosoftEdgeUpdate.exe
2584	MicrosoftEdgeUpdate.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSIE4F8.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIFAA4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIE4F8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4140	MicrosoftEdgeUpdate.exe
2584	MicrosoftEdgeUpdate.exe
864	MicrosoftEdgeUpdate.exe
5008	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\SPGlobal_Platts_Excel_AddIn.AddinModule	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns	MSIE4F8.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\AddIns\SPGlobal_Platts_Excel_AddIn.AddinModule\ADXStartMode = "FIRSTSTART"	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	MSIE4F8.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SPGlobal_Platts_Excel_AddIn.Properties.UserApplication\ = "SPGlobal_Platts_Excel_AddIn.Properties.UserApplication"	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6DCF5E38-3DE0-31BA-9491-0A8761404366}\ProgId	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95D984D4-4CE2-3DDD-B25F-1F753AF219E8}\InprocServer32\1.7.0.0	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.65\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43EB3DCE-90A8-3C8E-AA3A-A0FB8BBB856B}\InprocServer32	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD1BBE14-D0A9-3F61-8253-F579E27C6BEC}\ProgId	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2D9E2D0-1AC4-393A-9B20-1922FFF57FEF}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.65\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D9E2D0-1AC4-393A-9B20-1922FFF57FEF}\InprocServer32\ThreadingModel = "Both"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{775CE119-F7E4-3D1A-A69B-9348464D95D5}\ProgId\ = "SPGlobal_Platts_Excel_AddIn.BaseRadForm"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.65\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E57C844-CF16-36AE-B33E-FB4793841CDF}\InprocServer32\RuntimeVersion = "v4.0.30319"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{049712A5-981C-4EF5-85F2-117BF0C37ADC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{049712A5-981C-4EF5-85F2-117BF0C37ADC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DCF5E38-3DE0-31BA-9491-0A8761404366}\InprocServer32\1.7.0.0\Class = "SPGlobal_Platts_Excel_AddIn.Helper.SheetDictionary"	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SPGlobal_Platts_Excel_AddIn.UserApplication\CLSID	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.65\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6DCF5E38-3DE0-31BA-9491-0A8761404366}\InprocServer32\1.7.0.0\RuntimeVersion = "v4.0.30319"	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D9E2D0-1AC4-393A-9B20-1922FFF57FEF}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95D984D4-4CE2-3DDD-B25F-1F753AF219E8}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/S&P Global/S&P Global Energy Excel Add-in/SPGlobal.Platts.Excel.AddIn.DLL"	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C82A5998-20F1-38FD-A9C5-7E5250A9830F}\InprocServer32	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95D984D4-4CE2-3DDD-B25F-1F753AF219E8}\ProgId	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D9E2D0-1AC4-393A-9B20-1922FFF57FEF}\InprocServer32\ = "mscoree.dll"	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E57C844-CF16-36AE-B33E-FB4793841CDF}\Implemented Categories	MSIE4F8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{049712A5-981C-4EF5-85F2-117BF0C37ADC}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SPGlobal_Platts_Excel_AddIn.UserApplication\CLSID\ = "{42D8B0CF-E117-3FA3-960B-55478E97EA33}"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SPGlobal_Platts_Excel_AddIn.FeedbackForm\ = "SPGlobal_Platts_Excel_AddIn.FeedbackForm"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SPGlobal_Platts_Excel_AddIn.SearchTextBox\CLSID	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DCF5E38-3DE0-31BA-9491-0A8761404366}\InprocServer32\Assembly = "SPGlobal.Platts.Excel.AddIn, Version=1.7.0.0, Culture=neutral, PublicKeyToken=null"	MSIE4F8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10E914C3-21C1-38D6-BCB7-95E5346E0457}\InprocServer32\Class = "SPGlobal_Platts_Excel_AddIn.Login"	MSIE4F8.tmp

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2760	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
2760	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
5892	rundll32.exe
1028	msiexec.exe
1028	msiexec.exe
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
5944	MSIE4F8.tmp
908	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdate.exe
908	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5056	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5056	msiexec.exe
Token: SeSecurityPrivilege	1028	msiexec.exe
Token: SeCreateTokenPrivilege	5056	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5056	msiexec.exe
Token: SeLockMemoryPrivilege	5056	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5056	msiexec.exe
Token: SeMachineAccountPrivilege	5056	msiexec.exe
Token: SeTcbPrivilege	5056	msiexec.exe
Token: SeSecurityPrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeLoadDriverPrivilege	5056	msiexec.exe
Token: SeSystemProfilePrivilege	5056	msiexec.exe
Token: SeSystemtimePrivilege	5056	msiexec.exe
Token: SeProfSingleProcessPrivilege	5056	msiexec.exe
Token: SeIncBasePriorityPrivilege	5056	msiexec.exe
Token: SeCreatePagefilePrivilege	5056	msiexec.exe
Token: SeCreatePermanentPrivilege	5056	msiexec.exe
Token: SeBackupPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeShutdownPrivilege	5056	msiexec.exe
Token: SeDebugPrivilege	5056	msiexec.exe
Token: SeAuditPrivilege	5056	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5056	msiexec.exe
Token: SeChangeNotifyPrivilege	5056	msiexec.exe
Token: SeRemoteShutdownPrivilege	5056	msiexec.exe
Token: SeUndockPrivilege	5056	msiexec.exe
Token: SeSyncAgentPrivilege	5056	msiexec.exe
Token: SeEnableDelegationPrivilege	5056	msiexec.exe
Token: SeManageVolumePrivilege	5056	msiexec.exe
Token: SeImpersonatePrivilege	5056	msiexec.exe
Token: SeCreateGlobalPrivilege	5056	msiexec.exe
Token: SeCreateTokenPrivilege	5056	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5056	msiexec.exe
Token: SeLockMemoryPrivilege	5056	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5056	msiexec.exe
Token: SeMachineAccountPrivilege	5056	msiexec.exe
Token: SeTcbPrivilege	5056	msiexec.exe
Token: SeSecurityPrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeLoadDriverPrivilege	5056	msiexec.exe
Token: SeSystemProfilePrivilege	5056	msiexec.exe
Token: SeSystemtimePrivilege	5056	msiexec.exe
Token: SeProfSingleProcessPrivilege	5056	msiexec.exe
Token: SeIncBasePriorityPrivilege	5056	msiexec.exe
Token: SeCreatePagefilePrivilege	5056	msiexec.exe
Token: SeCreatePermanentPrivilege	5056	msiexec.exe
Token: SeBackupPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeShutdownPrivilege	5056	msiexec.exe
Token: SeDebugPrivilege	5056	msiexec.exe
Token: SeAuditPrivilege	5056	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5056	msiexec.exe
Token: SeChangeNotifyPrivilege	5056	msiexec.exe
Token: SeRemoteShutdownPrivilege	5056	msiexec.exe
Token: SeUndockPrivilege	5056	msiexec.exe
Token: SeSyncAgentPrivilege	5056	msiexec.exe
Token: SeEnableDelegationPrivilege	5056	msiexec.exe
Token: SeManageVolumePrivilege	5056	msiexec.exe
Token: SeImpersonatePrivilege	5056	msiexec.exe
Token: SeCreateGlobalPrivilege	5056	msiexec.exe
Token: SeCreateTokenPrivilege	5056	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5056	msiexec.exe
Token: SeLockMemoryPrivilege	5056	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2760	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
5056	msiexec.exe
5056	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5056	msiexec.exe
1028	msiexec.exe
3360	MsiExec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 5056	2760	2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe	89
PID 1028 wrote to memory of 3360	1028	msiexec.exe	93
PID 3360 wrote to memory of 5892	3360	MsiExec.exe	94
PID 1028 wrote to memory of 4956	1028	msiexec.exe	100
PID 1028 wrote to memory of 5944	1028	msiexec.exe	102
PID 1028 wrote to memory of 2960	1028	msiexec.exe	103
PID 2960 wrote to memory of 908	2960	MSIFAA4.tmp	104
PID 908 wrote to memory of 5788	908	MicrosoftEdgeUpdate.exe	105
PID 908 wrote to memory of 4344	908	MicrosoftEdgeUpdate.exe	106
PID 4344 wrote to memory of 4420	4344	MicrosoftEdgeUpdate.exe	107
PID 4344 wrote to memory of 3888	4344	MicrosoftEdgeUpdate.exe	108
PID 4344 wrote to memory of 3852	4344	MicrosoftEdgeUpdate.exe	110
PID 4928 wrote to memory of 4488	4928	MicrosoftEdgeUpdate.exe	112
PID 908 wrote to memory of 864	908	MicrosoftEdgeUpdate.exe	113
PID 908 wrote to memory of 2976	908	MicrosoftEdgeUpdate.exe	114
PID 1720 wrote to memory of 5008	1720	MicrosoftEdgeUpdate.exe	117
PID 1720 wrote to memory of 1276	1720	MicrosoftEdgeUpdate.exe	118
PID 1720 wrote to memory of 4140	1720	MicrosoftEdgeUpdate.exe	119
PID 1720 wrote to memory of 5952	1720	MicrosoftEdgeUpdate.exe	122
PID 5952 wrote to memory of 4472	5952	MicrosoftEdge_X64_150.0.4078.83.exe	123
PID 1720 wrote to memory of 2584	1720	MicrosoftEdgeUpdate.exe	129

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MicrosoftEdgeUpdate.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\spglobalenergy-excel-add-in-v1.7.0_2026723812\SPGlobal.Platts.Excel.AddIn.Setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5056

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ec7cbab03a51d543ca56e3640d94a49_elex_mafia.exe" /afterreboot="C:\Users\Admin\AppData\Local\spglobalenergy-excel-add-in-v1.7.0_2026723812"
1⤵
- System Location Discovery: System Language Discovery
PID:1752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 524D82A43BBB7466F52C0A349391FE82 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2D50.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725468 1 SPGlobal.Platts.Excel.AddIn.PlattsCustomAction!SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.CustomActions.PluginInfo
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5892
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4956
- C:\Windows\Installer\MSIE4F8.tmp
  "C:\Windows\Installer\MSIE4F8.tmp" /install="C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\SPGlobal.Platts.Excel.AddIn.dll" /scope="perMachine"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Windows\Installer\MSIFAA4.tmp
  "C:\Windows\Installer\MSIFAA4.tmp" /silent /install
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5788
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4420
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3888
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3852
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTMyMjlFRjAtODZEMC00OTFDLThDMzMtQUM2MTQ2RDhGRDBFfSIgdXNlcmlkPSJ7NDA2MkVEQUMtREM2Ri00QUMzLTg5MUMtQzgyMTJBNDMyMUYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFRkUxREQ4QS1CMDNELTRGNUYtODc1OS0zRUY2NDYyQzFBNkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O1hMQUYrNC9oMWhybnQ2djcya3FLMTJwU2hPSzJSbG4yejl0VVo4d0thd3M9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjY1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzE4MDkzMTQ0IiBpbnN0YWxsX3RpbWVfbXM9IjYwMSIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:864
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{A3229EF0-86D0-491C-8C33-AC6146D8FD0E}" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1532

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4928
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4928" "844" "848" "816" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1720
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTMyMjlFRjAtODZEMC00OTFDLThDMzMtQUM2MTQ2RDhGRDBFfSIgdXNlcmlkPSJ7NDA2MkVEQUMtREM2Ri00QUMzLTg5MUMtQzgyMTJBNDMyMUYyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7M0VEODM4NzYtMjFEMy00NjAxLUJCRTktNDk4NkFFNjExNUIzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtYTEFGKzQvaDFocm50NnY3MmtxSzEycFNoT0syUmxuMno5dFVaOHdLYXdzPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzgzNjA4MTQyIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MjgwODAyNTc3MzcwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMyMzUyMjEzNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5008
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1720" "1368" "1352" "1388" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1276
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTMyMjlFRjAtODZEMC00OTFDLThDMzMtQUM2MTQ2RDhGRDBFfSIgdXNlcmlkPSJ7NDA2MkVEQUMtREM2Ri00QUMzLTg5MUMtQzgyMTJBNDMyMUYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3MTg2Q0EzMC03OURGLTREM0YtOUQ1Mi0xMDA2MDI1MTFENTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O2FiNmxoTkhzN3JlWkNGQVhCanphL29VaTVaTjZXb3ZSSXo5SGpqNTI3KzQ9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEzOS4wLjM0MDUuMTI1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTMiIGluc3RhbGxkYXRldGltZT0iMTc4MzYzMTc4NyI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjYzMzA2MDM4NzQiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4140
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{36EDFB58-4E3B-49E9-B7DA-52D60DFDE713}\MicrosoftEdge_X64_150.0.4078.83.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{36EDFB58-4E3B-49E9-B7DA-52D60DFDE713}\MicrosoftEdge_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{36EDFB58-4E3B-49E9-B7DA-52D60DFDE713}\EDGEMITMP_0172E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{36EDFB58-4E3B-49E9-B7DA-52D60DFDE713}\EDGEMITMP_0172E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{36EDFB58-4E3B-49E9-B7DA-52D60DFDE713}\MicrosoftEdge_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    PID:4472
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTMyMjlFRjAtODZEMC00OTFDLThDMzMtQUM2MTQ2RDhGRDBFfSIgdXNlcmlkPSJ7NDA2MkVEQUMtREM2Ri00QUMzLTg5MUMtQzgyMTJBNDMyMUYyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCNDdCREM0Qy03MEQyLTQwMzAtQkJGOS1CRURBQzAwNERBNDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O2FiNmxoTkhzN3JlWkNGQVhCanphL29VaTVaTjZXb3ZSSXo5SGpqNTI3KzQ9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1MC4wLjQwNzguODMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIxMyI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MzM1ODM3MjgzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjMzNTk1OTUyMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2NTE0Mjg5ODEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2U0YTczZGRhLTgyMGMtNDRlMC04ODA0LTRlYjQ0NDYzYWFhMT9QMT0xNzg1Mzk0ODc5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVYyZ3J1UmhtWVdXcGdURVAzd2I3Q0tQVkQzVWhEanhJSmNTS29LaHY5MXJtRjBwQkdrZ2ZUN1ZpRVolMmJtJTJmOGoxcTVZWUhlcVVrbDl3QWRueVEwbkRNUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE5Nzg1NjA4MCIgdG90YWw9IjE5Nzg1NjA4MCIgZG93bmxvYWRfdGltZV9tcz0iMjQwODAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NjUxNTg1NTc5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjY3MjIzOTEzMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzAzNzg1OTA1MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM3NyIgZG93bmxvYWRfdGltZV9tcz0iMzE1NDUiIGRvd25sb2FkZWQ9IjE5Nzg1NjA4MCIgdG90YWw9IjE5Nzg1NjA4MCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzY1NTEiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d20d.rbs

Path C:\Config.Msi\e59d20d.rbs
Size 213KB
SHA256 dee3cb46fbc448d97fc4d170492281ba557b26f7ee8f8336b8635b0a1ddb5d7f
MD5 77bd8212cdaca4fbb849d85ea4f3b420
SHA1 28d1f13896cffd64d33cc515968745d440193b92
SHA512 cdb2f2d61882994dd75da72cfb322660f59e38119b810cb67b817d3bbc9d9b3b01003aece8e9af4151945a9f3926bc2f77e40fdc10f3135a977acba1bcd1450c
SSDEEP 3072:BQJfCYy7T8JDLZbxrtY4slAkxiHkKDRUAxfJsafKnV+/uVXq:2JfCYyEJv5PY4slDxiHPUms+Kn7VXq
TLSH
T1BD245B452E99C2F3E293493A27F2960226697A720F3D918F739C46AE4F717C06D7C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_7z.data

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Installer\msedge_7z.data
Size 5KB
SHA256 78ba8b213576176bb94eda7ba2d4ec3e16fadd42b5a018329252eb1b80d67994
MD5 ca9592f4474eb2c6306204ef1f984fb4
SHA1 cb3c8350819aced1f445c488ccdb55f75f01b792
SHA512 f5be47c9df869743e0c182dc58fa2c1de1a7712b49b8813d6d63c10f2e841a4dc1d4cecc5abe0741a3a19737f6f096a5bd71b469607709baea780621c27eb534
SSDEEP 96:UkZR2aD9rlyyEXIPMR4uXF2dNW/Yj6l094kjD6weLWz3pssV4VeahhFaW+Fy9:UkZvNlyyoIPAPEdNWIXj6CKsKT3A2
TLSH
T116C16D235E7E8A66AD5457DD8A0AD13E15DCD37E7A901354B917BF328005E1DF3603C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
TLSH
T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 182KB
SHA256 ff577f4c29a184a37014992de44549bd81dff20997d8deaf55df509f3d33ed1c
MD5 b9690bc05b42cdaf092162a50806264c
SHA1 dc55e6acd7e4b78bdd2a55b01bd7cc4e7f8e0d91
SHA512 1180dc506ad468a396a16b319ffacca1a007c7a841050acb5804a120d361846d6536068a41f64feaff8abb15d8b8c266d70519ecde9a616feb0b0ab193ad5c32
SSDEEP 3072:g8cz+qagFjeXge2GMjVO+avcb3i0inVEdcDtZwC:8+/gFjeXqGSkUSvDDDj
TLSH
T194043B6625FC20E2C1E6D6F8DFD48E52732AE9B5A1208C979242034DDD17AC19DE3E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 f4ce25c64da2142b2cb7d9c5b0f1540d1718e4a5cef38683634e7ba2636d7d7b
MD5 00f783b313796440834d82778f2850e5
SHA1 d887542f5fb42da3cf213ab5df7fa49b1f0d8a7f
SHA512 4d91482321782933d702a6ccea107127e56ad75f4e316a03b956a2df7dfd056dbfc5c759bd562d868c0338b9e7eda5f2560b8e6eb5a79a80fc93ab6fa438bbc1
SSDEEP 3072:PHrfzYJc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+NqLZC8eplV/iYD9XvUasQ:SAel/DRfkTC3dM7B+mCtx
TLSH
T198143E1237F84A28F8F35E305D348F29AA3EBC31AE34EA6D1650119E2D35A519D31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 215KB
SHA256 ba42d0ae2191efa24a2c90b437d693fbf63c5fc333a85e36918740aa3b8d4ef0
MD5 a0530fb9b74b7d1597fd8536393f32ac
SHA1 7412cee77aa7be0fdbb81c08730823a764cd9740
SHA512 161ef3be7f14d16822fde624750841998a036fb09b1067bda939c33f66f893c0c86b2f0db3658f57154002799824b51e3642cb816bb3c387e905512fb7ddcdd2
SSDEEP 3072:ZctUx8bhraApBWnQR7vBdZyctoSGwaZoY46OeR8HvjERubw5nZY:OtKuhraApBWQRztyYWoht+uoZY
TLSH
T15D24076925F810F2E176D1B48BD09903E275F87263208EFB4391435A5E23A916DBBF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\MicrosoftEdgeUpdateCore.exe
Size 262KB
SHA256 206f308825a05d83e4207b5aef0745377c672feed2d6f56f9026a71bc3c9c988
MD5 79421d4f94a5c0c2726b483645035727
SHA1 4b20ce487793e0d62227f520906acc745fa759a5
SHA512 1c192887718a97a7e9062a55a48e94a1a62405596e4d91c531289bc14adb4e769c53e743115dfc695f6d802ac7c8babc75bcf7c55bb22eae796d23ac25d98c3e
SSDEEP 6144:+rH9xcMkV5EalRv4m6n7OdLOL5UAOG+XYVdh+7R7:4cMkV5EalRv4mWL5UMeYPh+7p
TLSH
T15E44382138F84433D4B6D1788BE4DA22A578F97256118DFB53914B4E1E32AC2A177F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
TLSH
T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdate.dll
Size 2.1MB
SHA256 e2c8b7bd5b0095f08e9a3c4142c81936b0946394e7cd0a83b8c171c44cad3a1c
MD5 fadf3b40ea0be2351ea8cbe57d5116f8
SHA1 3d3302ad6aacc8bef02438fdfae72f776aa35aed
SHA512 126b07476b2f33ed7b1a38251ef2024e8d8b19e99524b20981ab2cd69adad7d7a33d0edcd6c7ad4bbf08015c08beb1dc09d7ea09ace719971be130acb15d9fab
SSDEEP 49152:NRiFBpbVQBFY4nDlNKJLx0catMmr2eC5haW/6AplG+aZB7j1:/CLxQBFYitxMmVW/3pYBV
TLSH
T1B1A57D2235E84075E8B243B08EF8A91695BCFD310B318CDB53B0554E7A72AD25877B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_af.dll
Size 29KB
SHA256 de5b6a655032977bcf3673a38b258d5bb31b562f932ecb762f4d7bae626baa40
MD5 695c53c6cda91f469d4d902659318fc9
SHA1 29fe9ea7a3c60b4f2ad43e7636fba40edf71b761
SHA512 734c495466d9ba8cb4c285690cbf4d745462e1464cbc89c2535df9385032971cfb0c65ed1cd1e546a5c72e7dadeebae4f9b7044960622654ec854d07ab4f6cca
SSDEEP 384:BT8NVFXh7+WWmnIWyjrYiVDxlwC3W+GqHRN7YXllwGOrjR9zCBFFBz:ipmW+jowGOrF9zMBz
TLSH
T190D2FA9057F4810DF4F73F30BDB8A6925B76BD92BE34916E2240A55C1831781EBB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 9736025f5a99f2b440687c4ef66489fde91f1261a33a6966f7c29861d2ad8302
MD5 8922d946dea77527e430aa2d931e4de4
SHA1 d8d17a4f653195c1173528a786b1dbc70430274a
SHA512 1cc5e87b13d752cc285f0e5bcf071d005e7bc05137ce6d5a7c7a2459e59453c2cfb139902c88a25964b602d7bb8fc0dd570facf20ddd74ca6176599ae1114d49
SSDEEP 384:p9nQVFXh7+WWmnIWc0Kl8js/WIHRN7vowGOrjR9zCBFf8E:GZe8js/vQwGOrF9zW8E
TLSH
T189B2194782948A0AD0677D340248CF6769BAFE0D1F64816BB115FB2434E57A3FB39B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 cda41cf066c1c7dc373c71f5cb47e6b2fc8f54ac2bff323241aff6b78988340b
MD5 85a862f833d7cb2e668bdf599eb1081c
SHA1 8b4db620d3ed7067926279b912f68a2934128d85
SHA512 cd10bb04c64cb391bd9d0b14b853b2e59f38e9c6b8b74640aaf0bfa9a4a6f856b4d6c2c03e55d602845a3972f1942d4e1300cd32c70f7ffc91ae8249322d71fd
SSDEEP 384:ZULPBb+WWmnIWNYwTPsQ8XvPGrIHRN7cRH3jIZR9z3tva:8XbQXvPLw3jIT9zg
TLSH
T185C2C8425E6CC13DF417AB34C16BDA23A63A51478DD4223A66309E0419A1772EF2FBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_as.dll
Size 29KB
SHA256 2edfa941a01248283d9dc3172682d235fffd4807b669a184bca0c295fdceb37f
MD5 9cff6ac597ea7e317129a14ff0f28c6e
SHA1 1f7070eb0863ba0ffb8aee8ee012acfee5eeb1df
SHA512 4bd4cc49af3f7e91b1781106137472215f31d5d94fc73e13f78b3f063415ada1e80f88cfed783edf1b5230ed8d6ab092bf01695c6355676868f92f49de3d5d12
SSDEEP 768:eFGZ452DuUu3+F/D06DpJKIlHpCQQZs49zS:ijgwzS
TLSH
T1B4D21D155740B524D5FD643C02D6CDAF1AFDB6CF081CA0B924E3E11478A63FA9F2A29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 478be08f3dd7a30148275936c0ade4835ec10cbe84289edeccbd51b2530b54c3
MD5 a03dc1afff2ca7b144797a499c27d90a
SHA1 8a44fbf1e3c6d9ef685e571dfe3ea049a0c1bc19
SHA512 4fc9ae07d8d61e0ded266d0b0b3251be572c5c561a649e5fb0fd2309b5703dbb1e74443d68c5cac40c922b80429427435081002f19c44b5055a5c0951edc9127
SSDEEP 768:IwIOFe5FEuo//rtkPFS5OrF9FTFYF+uA8/9z0/:IyFe5FEuobuFJrF9FTFYFoczu
TLSH
T125D22F6093ACD105FAF31F305878BD535ABB7FB37A34914B2192A15C1C71392BA34B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 016b43c72b3afaf95139348df1da0e9f32828f2fb4a1a9463a967238bd1e673b
MD5 bb056faf64f82da27a6569e3fd9d284a
SHA1 ac554c154cb2a8886db1c3b9d23d03d57ab61757
SHA512 760e5782d5f608a7da64a48c887275b5d05e82158cc3795cf774c628ec8affc77aac106780f8d1482d7ef632fdc890170cadf155319224f0ba6da2dc700c6cd8
SSDEEP 384:fuJVFXh7+WWmnIWgdsSCCdrwdPMQgv6Sf46lqHRN7rvVJl8BR9z8kdyXHu:qWdshCJCgCz6Mr+9zJy3u
TLSH
T138D23D4FB97C8204F625E6310FA6C6F735BA7751672446C6A34FBD68201D332B72928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 7a40640b7c596f2f95221abfe8acc3f7a64063bff3dea675c022ce25aedc897f
MD5 6a5eef3314665865363b2c54b056ed6b
SHA1 d694b6e0695b0472c71aeeb13d9511b5056e9636
SHA512 aacdd707d2317f9ef63389c53d4e6e2771d384a9763f585ba0797ffa6268415edbcb2a5a2d42bc511f9bbf792164ba34cdbc8b4b4669e05d7aa7c6c378670959
SSDEEP 768:1avAGEtJtVWCZsnM9/r94amPdQ8JBlHUpOa9zk:1mAGEbOO3zk
TLSH
T16DD26226A710B819D6FD283C07D6DDBF1DF87241241CA4BD29E9EA0019A23F69F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 eead3bd597fc2c8e66cd6733d017e54ac8552f511e8a3942c3f09dc680eed38a
MD5 d4376edf2f8661a4074e3eea0cfa8b7d
SHA1 ce9b526115c3f5b6dad0cf86737d46ef75c5ad47
SHA512 66f3cece58e166a8f0db088d2e4f3bc9a975dc2ea9fb238197b5fb8b1f83a8798463a7aceb1ac4901ae2aa09b3001a14bee3eb1fd1c9522573be8bfc2e09fb14
SSDEEP 768:KXvAGEtJtVWCZsnM9/r94amPdQ8JBlHfHQ9zd:K/AGEbOB4zd
TLSH
T161D25116AB11B815D6FC283C07D6DDBF1DF87241242CA4BD25E9EA0019A23F65F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_bs.dll
Size 29KB
SHA256 2117a7a79bde5ccd660e11a752968a07a08d04c5e3a79b0ff12f0d0d05c15743
MD5 299692e504cc22ad8fb9302618fd9717
SHA1 271c76183487dfa8dbe355f8a75ecac49f6d8b8c
SHA512 b3025b0a5861ba9be894662d1501d0e9b683c9dd5cb6c66eaecfc2d6d76680e6570670e4385f7d983ab36927be00058d453e8251f8cc8ecaac3162f4e6cbc38a
SSDEEP 384:/NDVFXh7+WWmnIWDaDAmqRDU5NLCdJlwcSXp+U1s47xIHRN7P/PwGOrjR9zCBFt9:FK6lwcSXp+2s4KvwGOrF9zABwQ
TLSH
T169D2FF41A7F85249F5F77F3065B4A7621D3FBDA2BE34910E224066580931781EFB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 30KB
SHA256 0a9eb34dfeddfdfecef41c140915d14444dd5c65d0f2d887c4b98113f9a43f67
MD5 95c52ddd710c8d5d4c15250517d1a5a3
SHA1 b43510622cf820d4bc557398e329fca083c5d1b0
SHA512 32ae3783f30e093a6ebbd6d6e86393819d73b8bd4f96c0c950a83ce87b292bdd3d421d2e2efbc4ed0a5fc5ce16a7c36251366e3929a7ab4860e3a7cb380f20bd
SSDEEP 384:57VFXh7mNWmnIWvbkbOnGNfNFoBWk5S0IjIHRN7WufB8KER9zxqq:05bkbOnMffoBWfRgF8R9zZ
TLSH
T1F5D2FB41ABF84659F6F72F707D7899525E3ABDAAAC38D11D2200A50C08B1F51EE34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 07e1e08ad8e6e35c60c87e0fe9555ec1188f900cd8e9c00e264dde0d3ef20049
MD5 a1bdbdb472e199fbd54bac050099eacc
SHA1 ff1b041d934a866f47a4b7a13276208e00d06708
SHA512 314be5bcd9283eded382ea30fb2fbe05b478ee04e5a842ed8046c5f882a23c5db59bac7ec0f6aca7e08a98670388b26e5d328d2f4944d7dfa67d80043e50f816
SSDEEP 384:0yUVFXh7+WWmnIWGHEWdvDNfNFoBq1ZqFZqHRN7MKp9R9zHjIB3UP96:EQHEWdvpffoBqiY9/9zOgY
TLSH
T16DE2DA41ABF84649F6F32F707D7499665E3ABDAAAC38D11D2200A50C08B1F41EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 2b825f3d0b3ed38d573520ca4178a7ff92c82768f6da06f17941786d550a26f6
MD5 055f5e8a1936ebc6898a4cf0dea50f51
SHA1 73a3426ea76247588b1ae82067e579ae13be032a
SHA512 8f87dc58e4f4413dc431a4a96ca76e2412b9c62362929235c416d6a7fd9a1efc44671aa252a957ce5bd8005ab9c8241219c34a204e22bcf67c5086703c9fc2ab
SSDEEP 384:AfbPVFXh7+WWmnIW6TL7PGmxQEnwd/6qHRN7p2szxIPaR9zMJZ:QrMTL7ovpfzxOW9zm
TLSH
T12ED24F4166F84185F2BB7F3069B446A21D3B7DA6AE30C14F6640A69C1C317C1FEB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 f53ef205f6e6e3d0e58c0ba7f85799697aa74a369ca144293a97938edb165a9d
MD5 fd0fe10593e8ad250b501de60f5fa04d
SHA1 a7a1f428405dd9b12f13193cad7dd9fc1c48a7a2
SHA512 5b20de08bf43afbf30ddc9147af62516172966152d96758f9bf536c2cb77dba9a1d7b7dacc1970d9d0bccfd2f32ac1c0216459d470a968db3cf4fe375441663d
SSDEEP 384:SqcVFXh7+WWmnIWmtZEmiuTHsyi7zAaaVamYylVb2UFxOF6dJSqHRN7N1u0R9zA/:S8DVEUjxdJnzu49zWl
TLSH
T184D22E5143F8810EF0F72F70A9B9A6962E36FED6AA74419E2340B5091C71782DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_da.dll
Size 29KB
SHA256 d03dd98580015df668594b433c6ead734a5a2b709bbcbd36ea11a6c84fc2586d
MD5 e407df4b4986ddeab9a106c6d9cabd1a
SHA1 5db00826d51c5c8b3b9ebea182da6d9e0699c09f
SHA512 d1a5b4063b750f46ba8d4f6fa4a6e8db811edcdb37f2aa3ef0a8afad0ec640f6b117f29114d1c3e2636a9aef13b8c27422d2a0aeb0cce83661217545af7da530
SSDEEP 384:EKKIhVFXh7+WWmnIW1m4HcyvBdcPIHRN7NJtl8BR9z8kdAh:Eshq4Pcsw9zJAh
TLSH
T17DD22F5167F88209F5F32F30BDB98692597ABDD6AE34D61D2200A44C1C31785EBB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_de.dll
Size 31KB
SHA256 747a736eca9222087687cce4601e83c8bad6935351eb25566a204f6e9ac6488a
MD5 2fda7ba41bfbbf9999a6931a43a87388
SHA1 a10205c08dd11e5ebf5b2773f015376465ad7227
SHA512 06d9254a11e4c8fcc2505edc07856945a599affe3c0d5c4c44b202d83da6f7bea3ab5089ac0259640cef0298357e809723e9bdeb79beaf0d4702760b8c942b80
SSDEEP 384:kVPVFXh7+WWmnIWXeI4FBhj3ZnswxWbzIqHRN7wa7ODtdQ5R9z51CSvJKt:kBetj3Zn7xWbzFwBds9zmSIt
TLSH
T1BDE2F99197E88608F2F72F307EB993962E76BDD5AD34E91E2300A45C1831741EB74B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_el.dll
Size 31KB
SHA256 386224dbc2ffa0bd6c568816a6d31101f554c2f36d8f265e1f4ab4415395dd89
MD5 c875c9405ec566872a8670cdad911212
SHA1 1679e4098396eb1f877b055e0d0bfd59129c880d
SHA512 a6ae7aa159e926e2ad948ef5f60090590ef18f6dbf70513b4578a2a5f48ba630a6db430704e03397d4cd06256dceaebb63447ef186cd7f91b7e2d6457236a7c7
SSDEEP 384:EZGjSVFXh7+WWmnIWwnBzBUBOTG94vTZtfFtSmFK9q8LPgbkIHRN7I5tGkeR9zFE:EFepnxmFTm9kC9z
TLSH
T163E22F8E0DAF9701DEA6ACF24573C62B5A3FF5860810DD6732F0B0449D1DA129ED7A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en-GB.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_en-GB.dll
Size 27KB
SHA256 ca89c73473c2e2cd8f1aa95e1421997e2075877133c41fb9b5dab26f2cf58da1
MD5 7ed9e23542ae356937c7d562c02cde40
SHA1 5777658bebcfa3a05c500c9e7624627a8a49c439
SHA512 e00152ad104b1b4c7bc7e7bcb3e09c61f7972a94295e14adf283489290b5e3553dc2122ab9ee0b825e5ccec5882ab2a6ebb40392073ef86b04daa4566140896d
SSDEEP 384:EiI6RVFXh76WWmnIWMkagyorTmKIHRN76SNviCksR9zdPSOND1:Eit17agyo+j5io9zkY
TLSH
T1A1C27381A7F88119F6F73F307EB896A21D3ABD91AD34D61D2200A40D1871B51EE74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 116895a87ee422bf55f3bb2c3a274845f5a4fbea29079905814f79bc43cc07f4
MD5 740f774f6238ff3284167b87efff9c37
SHA1 f5ebdfb0b3e128e3658943964ceda800620be268
SHA512 53fc7488a90f26dd0ebcf21618e71ac925169a110e592e979f62e6f4683138834277ba65b88aaa99d9b8e7603b578dbc52c1ddbd0e7bcba4464b29488627b579
SSDEEP 384:5zWVFXh7+WWmnIWBkagyDl9FRdIHRN7U53FHGR9zXZXIis:KkagyDldyUp89zJfs
TLSH
T127C2638597F88119F6F73F307EB89AA21D3ABD96AD34D61D2200A40D1871B41EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es-419.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_es-419.dll
Size 29KB
SHA256 38237a136538244c454eba1ca3f9357730b49ff345f799725298cee515913321
MD5 a84495f496f00eb853526dff156d6f6e
SHA1 7e3769a01d4d94f16b66e8b6afc5af565d7908e4
SHA512 0d71666414887a11e1e9ddd3480c79f6f05ea1f1a4533496013c30045e410b6854cc727d4af5b5ee90b829d1d5bbe52e3fd1ae333e15c6547cff8d66ece5138e
SSDEEP 384:m0wVFXh72mWmnIW6aduUrFaLIHRN78bLkwGOrjR9zCBFmBB:kHBrAY8HkwGOrF9z7BB
TLSH
T18AD2FA409BF8924AF6F73F34A9B896665D3ABD92AC38850E1210A55D0C71F41EF34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_es.dll
Size 29KB
SHA256 32efc74e3fac732d3d637a65a4cb37e8df38f09c8fb4adc8f7739031d4f9a440
MD5 0be85bc885cef987ab516dc0d9a2d3d8
SHA1 d1259d10ac1b60a944919cd8dce2aff900ef7e97
SHA512 44cd72df49ce6f30760eaab14a57f0a76887977d37409ed214dd810d0f21f5f8b74c782b925aad5d1c2de3ccfd28ce5843b34fe6ccd6b152eb1e167e4b8d3ee6
SSDEEP 384:EVerVFXh7+WWmnIWQt34jmISqHRN7/zL0P3U0R9zN4eTWG:EGCt34jmIn/fB49z1TWG
TLSH
T1C3D20C409BF8924AF5F33F34A9B896665D3ABE92AC38950D1210A51D0C71F41EF38B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_et.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_et.dll
Size 28KB
SHA256 5fa49c3c579bb988bde153d2e563a401dc07d35e77e39ee0b0fff31738c230a7
MD5 7d4efe4948a5c8e64b06d57b4b1fbb61
SHA1 00919d21781cefb5fb64cf0fddaf24fec771e604
SHA512 b37eb045b8273c34e9992ade50fcf320773a55d4d163a787bf75263633bb648555c1e16970519fe4425136b28742549b83f32384cca61371d5164c8433872879
SSDEEP 384:5RqVFXh7+WWmnIWxVc0dEyjELtX7gid1LFdsTwAiDi2IHRN72lwGOrjR9zCBFZ6A:on5jELBgG1LFd/AwsowGOrF9z0B
TLSH
T183D2FC91A7E89109F2F77F30BDB496521E7B7E93AD70E11D2600A51C1C70781EA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_eu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_eu.dll
Size 29KB
SHA256 aaeb2f1e3ebd0944bb79863bcd3ed70ab53bdcdd9dbbc94a27b5d82307500fe0
MD5 3f61182296131fe7c751ddc41b1d5803
SHA1 5d73356dc078ef05ea3f6bc94d6f4b7a31cc47e5
SHA512 f1f72ab189a3fa84b6c4165bde5509420c625df0f281e40f3be92663490295babc4bc0560f5ae2f3491d7eff87c12fc4f6e6dc1d992e64891554982a55c6991c
SSDEEP 384:PFNVFXh7+WWmnIWncLpNrX58FOXAzt4OHIHRN7DW2tq/R9zV4Eltm:3aRuFOkt4N9tU9zVxtm
TLSH
T1DED2409797E89158F6F76F30A9B895D61A77BDA23935C52D1200A51C0C32381EE34F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fa.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_fa.dll
Size 28KB
SHA256 d76fd7bdd9491a2a4443138369fbad0abb225b9f57a9bf3f71fb178aee9df412
MD5 262ca359845f5fe0d5dbc477e1789e0f
SHA1 48a8940b9f6a65046172659dfc594eb3b2930596
SHA512 d54e239fe8421430be22a62b0e8f14b24e3f77d225086f1814e816abd48acfd0ddf5f1b0dde3832622678787ca80fa4a0cd6a57f913ecbfde691e88e9b0be8d8
SSDEEP 384:EaeDcPBb+WWmnIWUXlQEqtOW0QSGfwqHRN7xcDP3U0R9zN4eXd:ETynnuCNxd49z1Xd
TLSH
T193D2820A8DA6C470F9632A34C11BD973313666DD6D4189361FE4A93C19823F9EF1F62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUFAD1.tmp\msedgeupdateres_fi.dll
Size 28KB
SHA256 6fb965f07f0287d00d7594ebeaff98bb1c461ec1c3b489e4f37d15d80884c68c
MD5 66385b1a75d0dec0b8e4e90b1b9cac3d
SHA1 878da5b239e3db77327064c066612aff1bbaa570
SHA512 cb5f84a62a3cb445b44c058746df45a36eaabff992a27c2b779aec5f379d3c7fdd351e966c1c4aff6b7e99fc06912f3aae8e20f650a270f62cc246bf075d52c4
SSDEEP 384:DNLVFXh7+WWmnIWuJWHJWEFIxnyELZWEYXSN6ZKFl+EoJth0vgtqHRN7mwP3U0Rw:VAJOJOURxUW49z1yGw
TLSH
T167D2019157FCC269F6F76F306DB886111A377ED36EB5D11E1A00A51C1822782EA34B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\AddinExpress.MSO.2005.dll
Size 4.2MB
SHA256 0093cc77d62bfe747106dd7226f3df5775659c48723a14a043c98a0dd9166564
MD5 8f95b190c0ae95de4a502c395b044f7f
SHA1 85154b26466b5468171a875d3c9d864cbf7775e3
SHA512 260300fc596dfd22ab2d845e0d481da257e3eb13debdafb1068b8427e9ef6ac2e270a4b3019f5663f2d74828671a12734ad1bb6435b1665d01f63944fedb997c
SSDEEP 24576:FUJ1nu5qPhLk5mTxkIXvY/ap/G3DXlDGbbggp8wsqJxUhWnnV0:FYuplwEgp4hH
TLSH
T1BE165D13AAEC7CEAD0396375733783D2C7ADED491211D20E54C1A62A29BE3537A077C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGlobal.Platts.Excel.AddIn.Entities.dll

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\SPGlobal.Platts.Excel.AddIn.Entities.dll
Size 80KB
SHA256 276ff2917d13ef79c021f2bf2b1d24b59578c3dc41f865ba003d71a9a044e164
MD5 96aed50cd92bcb96882c0b017f60e072
SHA1 5d348e60b1458f76dd7dabd8d416e7142f260e82
SHA512 57f2513fd68f9e5ec813b6af21ca64bd4a41a604c3f85ebc86e52b544002d76e83f2bab15c4cee7060769581ae38b593f49a39693e0458c3f25e4063300d683e
SSDEEP 768:Jx516iRdA9i3ibaua/npTMnntfA3ga8Qlq+HQZLN5rgbk371lfdmHWxeBmfFezWz:7eYwiaa5nlEAQBm+8Y13jxImfxt7iY
TLSH
T10583985183BCC36DD6B61A30F47489260662B74B7939E6E9C714A8CF3B17B4DB410BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGlobal.Platts.Excel.AddIn.dll

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\SPGlobal.Platts.Excel.AddIn.dll
Size 1.4MB
SHA256 fc7b62043fe0232531197db622eccfbacd5a26b44eb848cabf9c1e513f97fff8
MD5 174aa411ba87664ebbf50d1d0f7fe870
SHA1 b6449699c26a758d4207842d4fb85a136b376f5f
SHA512 d6b38946c7ea6129ba6f880b87b7fcfe331af8f59305f9c332fb1e24b224d460ae1cc6f4f0f3bbf9bca3cb6cae5b88794b0f6b95c4682c99a302debfe8061400
SSDEEP 24576:9CK8KKksKb+7wK/LnEWvKI4fUItsVM8K7B:4tKbCLwshS
TLSH
T1BA653B503AF46305E5790A3467B026AA0A2D7D4F46F8C34C5858E9CF39B3F85A89FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.WinControls.UI.dll

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\Telerik.WinControls.UI.dll
Size 7.0MB
SHA256 0944a5803a25ded7cb269c9d1c25b3333425ef0882a3d4c47ac6d0f54d77a24a
MD5 e11bdf8cca97b90542912b63be1bdc86
SHA1 aa88b207df0b7b36238ebb4f022b4dee4514fcfd
SHA512 0d85de95d37b86ca92a0f2d32a66f38ac3341e48e400e66312cfe90b82be3df9cf7ea7b005ffe817748e9c531afc652a1d390ebaa1c8ffb4b8bfa7254daf37a1
SSDEEP 49152:VldToRg66yxu3rgwrFK68UKTUpXKpbpSEDDBAH8Y4BNVsn107rvN3oE5IZea6Ej5:PdToRgBRZJ8kq1Lc8TXVs1uvdo
TLSH
T11A766D4267A88F3BC5BF973BA1A1006193F5EE4AA3D1D65F2150F4A83CEE7101D593A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.WinControls.dll

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\Telerik.WinControls.dll
Size 4.7MB
SHA256 b727b459208650acecd54d80ebabe9edeff2c3ef37a538e11bb89be3e93075e8
MD5 64d72a87bb37ed3cde181ff33aff9771
SHA1 be1f0af95426fc9f267e0dfe1182871504542205
SHA512 3f6e22f04583415c4bacb1326837987a0e74a91347287dfc4abefcc898ce0581fc40b823065fd544580cff4bbbee81a003187a4bec559fad2720f6ffdbc32174
SSDEEP 98304:6OmAjXXBM6aS9DMbJcioxcKK2SewFiYCJc7vfmIAAr9DMbJcioxcKK2SewFiYCJ2:6OmA7xM6aVA5qN46ahr
TLSH
T192368C12A3959636C1AA137DA836463952B0E802771793FB3C98BE751DFF7434C902FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path C:\Program Files (x86)\S&P Global\S&P Global Energy Excel Add-in\adxloader.dll.manifest
Size 346B
SHA256 e08beb1edcd76f05e84c830d24c365f08fd20109ad0a35e41073d9ef7d1203fc
MD5 1a155013ca0f7d075bfc415c54515677
SHA1 9eb578b1b3ff8f472c26d8e0d22b949cf1378414
SHA512 02eb14a401e9d77654449b769aa6922adda691ec1c6297a588c78a1e3f5d8edeae33ca187dd7291b723228b0a947914d2c974ab68d19cc0de0c1189d77570ea3
TLSH
T1E6E0C0C20A584E33A702C8CEF4A3810226E823D5EC080405F13CB5BB950280C02E2373
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 190KB
SHA256 5e0dca72cbfd82121d6176ed2801bd243309946f8884b3d8a10c522e4c670159
MD5 47dc16e12e424d0d25cefab24b672f5c
SHA1 14f4960b0dad7f4b0ca547bdaeccc51d78133987
SHA512 eb01865e5d62895daf07fb2593fb90961b8adedc3d80c40f283d99a4f15985747433080a3064cb5f242f07d29c47c70d0a147981dca5069151e8ac13c159b55a
SSDEEP 3072:efFMr0Yg8gZt2ZnEZdb/yFFPowBW25e3z5ieyFFPowBW25e3zBkOsi2myPuIM+iR:4YA2pEXyFFPowBWDieyFFPowBWLkeyPo
TLSH
T1E014133637E90659FDB79E16E9FADD6AB97BB9662C19C40C0091068E0C32F01DD7072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2D50.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2D50.tmp
Size 414KB
SHA256 4d64cee1773ab6c49131dde27989812ed77a5ff4314f3d5f2ddc25d0aadf498f
MD5 ffb04edf8a5de0f4a1357f622b8722d7
SHA1 71c3723a50ca27f26d4e2b6c9ca5f5b716b890b8
SHA512 9cf00cf569241b3751164ede0bf420bca1f6a2b9313915f3ed5d8eb08fe6afa27fcede57f75c441e8860a7e669d9400840a222a8ac2eb9749e2b4e71971c1bf7
SSDEEP 6144:KwPStp83JuQGJFnrzYHkqSIMHwEZFtnwbD57KWDkSZC0A9A3yzSwySC3tI:Fl3oLrkSIYwE+5TDkSZCz+wHC3tI
TLSH
T17094CF0179D58530E5FF193D1938CAA09A7EB9605B74CACF6B884D6E8E707C18630F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI30BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI30BC.tmp
Size 164KB
SHA256 03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03
MD5 2002556e19b51e171ee7a29407c531c5
SHA1 4e5438b8defa9a9960705c1f25b989665dd9af53
SHA512 423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84
SSDEEP 3072:2kj9MEHQJ9WT69CgihxfUUg3QqtRFiC0DM:2m9Md4gExfUrJtSCsM
TLSH
T113F3AF2236D0C832D25F1A394965C7765FBA78628B70408F6BD84A7E5F743C1DE7831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGlobal.Platts.Excel.AddIn.Setup.msi

Path C:\Users\Admin\AppData\Local\spglobalenergy-excel-add-in-v1.7.0_2026723812\SPGlobal.Platts.Excel.AddIn.Setup.msi
Size 23.3MB
SHA256 d007165476b4dc2475f28c6b2210b09376d718ce48638d3e3c1f90a9225b0235
MD5 3192bf94c30168faa3cd9c104fa85801
SHA1 fc5a92cca7397432af2dc57afc7a4c78cc63baff
SHA512 e824f3f4ca16b59acba7a824795eb12ff5b40eeb4502556510ecd9ceeb6fba9f2bb1bb3b0d236bb0113c476e10ae244f54484281a9852af20652609fe2350883
SSDEEP 393216:z9jD05iBxKlCVhWOsigTL4/r/p8rT0pqygViHh0iPKvvXYue84Jc3Gyp:zZD0UB/VgwgTL47C0pBHAHYm4Jc2y
TLSH
T1B5373310B8C28435D56B093194E9E7711A3ABD306771A38B37A8BD1F6F30292EE74F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE4F8.tmp

Path C:\Windows\Installer\MSIE4F8.tmp
Size 172KB
SHA256 13ee293726cc1233a7518eb4cec41499c580485c415a1b7b6d15b8802838918c
MD5 d1840f0cdab875fb7ffb861133437c12
SHA1 4f139f6253e59948a4869817bff3c998d6c211c8
SHA512 7a95192a94c62cc07cc7d8e7eff4eb729bcce81e50c4ef464be73b127603937d6837fb6290ec9b0c07ba94b6dd003044b95782cbbe7c9ac04653a9e2024a3449
SSDEEP 3072:tJDLZbxrtY4slAkxiHkKDRUAxfJsafKnV+/uVI:tJv5PY4slDxiHPUms+Kn7VI
TLSH
T1DD047D503BD6C072E2A2193255F587A26A79BB325B32D0CB775C0AA85F307D1BA3D317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFAA4.tmp

Path C:\Windows\Installer\MSIFAA4.tmp
Size 1.6MB
SHA256 1bdcfc30fd8f711134ddc400c39c126a7678ed5717e9e3a320bbf4f4e4da2ed4
MD5 fb7ff07f000ef3f6ebf22b0044f0dc13
SHA1 68d88e76d574582c762ca52454415057b5f1b46a
SHA512 bd386598ca7353d85812c788f5ddcabab05dc765843c8861418d3d4da6bd255f986de987fe17edcab15ca6ff4b3deb7dbb89a25471ada35f52106a6bc0009113
SSDEEP 49152:BiEa3B/yvJJHBXNTn325kSiV3QpOmTiGIcNMzwjbVPTIR:BihyvJdn3JSiVgEK2cK4bVbIR
TLSH
T1A875122076D14071F2F31E30A5F09AB10D7ABD710B7584DF23859E5D1E34AE1E639BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll

Path C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll
Size 29KB
SHA256 a8d237e7d2712e476466e7312c9c8ef0b2b6ab2e2c65905497129a7e818265c4
MD5 e7ddae32fbf6e2d2319384ad1aa5e80d
SHA1 47a71c560503cd93b5a6101100116cdb38eb0472
SHA512 3042c7bae9d18d66ca6f8cc4c7ecf94feb6f32b906e7621d326adc45e324f331b3f6e29235045664a1a073a9c3b904a1a88ce89c86f6b1ab8b7329617b7fc4c7
SSDEEP 384:GF5fx/shHX5ULDOlQ4QQeAmWH2Pcg681+a0d3faa0d+OwffghrikQz4W2OcZzXYl:GzZ/sNZpQ+u+XAXdnhrB8Y9
TLSH
T1BED21D4167F90256FAFA5F357DFEA6100A72BD076D32D35E2689F04D4A72A40F860B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA16E4707FE54B585A8473BE04973D72DC\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 44d9af209e0b220ab5128aa75c573cbca73809548806736ebb10b03d44639752
MD5 6fc0fd21a4761bfcb07aff8b1c7a60da
SHA1 e56db4ae91cff109caa6008573c43c3bc2679726
SHA512 4a67389d9f141c25455e6afe10ce65c9f290c71e47d8a1020cee8481c75c0b759cabe7938027613ade7da35672f54ce7710d27388140979a556ff0cb005e813e
SSDEEP 3072:xOf7tVL6+Yvj12FuDHYQj69UgoTqddixCnfKlRUjW01KyGzxXc8NV3TKs8:xgTex224Qj6jomdxCXcKto
TLSH
T182149D2697F84B3ECEFF8B78E2B54252C7B1E1E67103D71D5D8281A52163780B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path \??\c:\program files (x86)\s&p global\s&p global energy excel add-in\adxloader.dll.manifest
Size 337B
SHA256 5dd80457ff117fe653798056586a998763eeac763813f603a5bedaf145cb0ee2
MD5 ab3c0157dc55341cd1069d030d907397
SHA1 b93d35f7729892b258f6e2e1b52384867ae8b4ff
SHA512 7ce4bdc348cdffca843add200978735e360ce97d271fff23fd1aede02001ab47ce1c33d79e164c2fe82e0d7e99534f0e17ac577f23b0319b02dae861d8b0a738
TLSH
T197E0C6C206180D33AA02CCEEF8A384022AE833E5E8080806F13CF4BB900280D02C2362
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-408-0x0000000072150000-0x0000000072377000-memory.dmp

Download

memory/908-407-0x0000000000DC0000-0x0000000000DF5000-memory.dmp

Download

memory/908-448-0x0000000000DC0000-0x0000000000DF5000-memory.dmp

Download

memory/908-429-0x0000000072150000-0x0000000072377000-memory.dmp

Download

memory/5892-38-0x0000000005CC0000-0x000000000627A000-memory.dmp

Download

memory/5892-37-0x00000000056B0000-0x00000000056BE000-memory.dmp

Download

memory/5892-33-0x0000000005670000-0x00000000056A4000-memory.dmp

Download

memory/5944-230-0x0000000007810000-0x0000000007F08000-memory.dmp

Download

memory/5944-219-0x0000000005760000-0x0000000005B8A000-memory.dmp

Download

memory/5944-220-0x0000000005B90000-0x0000000005C22000-memory.dmp

Download

memory/5944-221-0x0000000005710000-0x000000000571A000-memory.dmp

Download

memory/5944-226-0x0000000005F90000-0x00000000060F4000-memory.dmp

Download

memory/5944-234-0x0000000007F10000-0x00000000083BC000-memory.dmp

Download

memory/5944-238-0x0000000007110000-0x0000000007128000-memory.dmp

Download