336f66c0a9d28399ce5d373e3a34756118257a416cba9ebb7e72a25a7cf0b1dc

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1792850632661_TradeBayInstaller.exe
Size 16.1MB
Sample261024-rese4avthv
SHA256 336f66c0a9d28399ce5d373e3a34756118257a416cba9ebb7e72a25a7cf0b1dc
MD5 cea4e47ace3150fd4c296f1f2fefc5d9
SHA1 eff61256f5f69744dd6bd80ded38b34e1b458912
SHA512 69159208864d815969c98ac587eb883c491666c10dc90237e24807aa3acbb1bc39111196276d7f1d6cfdd92b28bd57bb562ca1a9b2ebf5ba26fac39282ace93f
SSDEEP 393216:juXLbngonk0CRoSstTk0vTdErOKUrN/ocurRaQHh+dXaH:K77gok0SoSYvJNlobrVB+sH
TLSH
T14F07333FB28B613DE57A1A367A76E150443B763065138C4297F4C89CDF265B02E3FA86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
4568	1792850632661_TradeBayInstaller.tmp
4432	MicrosoftEdgeWebview2Setup.exe
3988	MicrosoftEdgeUpdate.exe
2200	MicrosoftEdgeUpdate.exe
4152	MicrosoftEdgeUpdate.exe
4912	MicrosoftEdgeUpdateComRegisterShell64.exe
2272	MicrosoftEdgeUpdateComRegisterShell64.exe
5036	MicrosoftEdgeUpdateComRegisterShell64.exe
3708	MicrosoftEdgeUpdate.exe
4492	MicrosoftEdgeUpdate.exe
32	MicrosoftEdgeUpdate.exe
792	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
4520	MicrosoftEdge_X64_156.0.4314.42.exe
3848	setup.exe
2272	MicrosoftEdgeUpdate.exe

Loads dropped DLL 17 IoCs

pid	Process
3988	MicrosoftEdgeUpdate.exe
2200	MicrosoftEdgeUpdate.exe
4152	MicrosoftEdgeUpdate.exe
4912	MicrosoftEdgeUpdateComRegisterShell64.exe
4152	MicrosoftEdgeUpdate.exe
2272	MicrosoftEdgeUpdateComRegisterShell64.exe
4152	MicrosoftEdgeUpdate.exe
5036	MicrosoftEdgeUpdateComRegisterShell64.exe
4152	MicrosoftEdgeUpdate.exe
3708	MicrosoftEdgeUpdate.exe
4492	MicrosoftEdgeUpdate.exe
32	MicrosoftEdgeUpdate.exe
792	MicrosoftEdgeUpdate.exe
792	MicrosoftEdgeUpdate.exe
32	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
2272	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\hr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotStable\Square44x44Logo.targetsize-256_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotStable\Square44x44Logo.targetsize-32.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\copilot_overlay_strings_en-US.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\VisualElements\CopilotStable\Square44x44Logo.targetsize-256.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat	setup.exe
File opened for modification	C:\Program Files\TradeBay\TradingLauncher.exe	1792850632661_TradeBayInstaller.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\msvcp140.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotStable\Square44x44Logo.targetsize-48_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\mip_core_gn.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\sq.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\bs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\copilot_overlay_strings_kk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\sl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\SmallLogoCopilotApp.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\copilot_overlay_unscaled_images.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\zh-CN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\identity_proxy\win11\officehub.identity_helper.Sparse.Dev.msixbundle	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\identity_proxy\win10\copilot.identity_helper.Sparse.Dev.msixbundle	setup.exe
File created	C:\Program Files\TradeBay\is-BUZLEKKOPM.tmp	1792850632661_TradeBayInstaller.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\copilot_overlay_strings_hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\ru.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotAppStable\Square44x44Logo.targetsize-48.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotDev\Square44x44Logo.targetsize-48_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\VisualElements\CopilotAppStable\Square71x71Logo.scale-100.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\BHO\ie_to_edge_stub.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Trust Protection Lists\Sigma\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotAppStable\Square150x150Logo.scale-100.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\LogoCopilotApp.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\ca.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\copilot_overlay_strings_el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\VisualElements\CopilotStable\StoreLogo.scale-125.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\ffmpeg.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Locales\copilot_overlay_strings_fr-CA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\copilot_overlay_strings_ne.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\webview2_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotDev\StoreLogo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotAppStable\Square44x44Logo.targetsize-32.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files\TradeBay\tls\qschannelbackend.dll	1792850632661_TradeBayInstaller.tmp
File created	C:\Program Files\TradeBay\is-A3NGRKDC46.tmp	1792850632661_TradeBayInstaller.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotDev\Square44x44Logo.targetsize-256_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Installer\setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\156.0.4314.42.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\eventlog_provider.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\textInputMethod.sccd	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\EBWebView\x64\EmbeddedBrowserWebView.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotDev\StoreLogo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\VisualElements\CopilotDev\Square310x310Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\da.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotDev\Wide310x150Logo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\VisualElements\CopilotAppStable\StoreLogo.scale-100.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\AdSelectionAttestationsPreloaded\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\VisualElements\CopilotStable\Square44x44Logo.targetsize-48_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\156.0.4314.42\Locales\copilot_overlay_strings_en-US.pak	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	MicrosoftEdgeUpdate.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1792850632661_TradeBayInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1792850632661_TradeBayInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3708	MicrosoftEdgeUpdate.exe
3084	MicrosoftEdgeUpdate.exe
2272	MicrosoftEdgeUpdate.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/4572-0-0x0000000000AD0000-0x0000000000BB0000-memory.dmp	innosetup
behavioral3/memory/4572-7-0x0000000000AD0000-0x0000000000BB0000-memory.dmp	innosetup
behavioral3/memory/4572-481-0x0000000000AD0000-0x0000000000BB0000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99980EE2-56FE-4F68-892A-D43F3E57EF9B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C3458EF4-5270-4628-996A-1B3C502760CF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.299.15\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B2F95FF7-977E-4909-A70E-1408A9777554}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{C3458EF4-5270-4628-996A-1B3C502760CF}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4568	1792850632661_TradeBayInstaller.tmp
4568	1792850632661_TradeBayInstaller.tmp
3988	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe
3988	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	4492	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	4492	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	4492	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3988	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4568	1792850632661_TradeBayInstaller.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4568	4572	1792850632661_TradeBayInstaller.exe	83
PID 4568 wrote to memory of 4432	4568	1792850632661_TradeBayInstaller.tmp	92
PID 4432 wrote to memory of 3988	4432	MicrosoftEdgeWebview2Setup.exe	93
PID 3988 wrote to memory of 2200	3988	MicrosoftEdgeUpdate.exe	94
PID 3988 wrote to memory of 4152	3988	MicrosoftEdgeUpdate.exe	95
PID 4152 wrote to memory of 4912	4152	MicrosoftEdgeUpdate.exe	96
PID 4152 wrote to memory of 2272	4152	MicrosoftEdgeUpdate.exe	97
PID 4152 wrote to memory of 5036	4152	MicrosoftEdgeUpdate.exe	99
PID 3988 wrote to memory of 3708	3988	MicrosoftEdgeUpdate.exe	100
PID 3988 wrote to memory of 32	3988	MicrosoftEdgeUpdate.exe	102
PID 4492 wrote to memory of 5040	4492	MicrosoftEdgeUpdate.exe	103
PID 792 wrote to memory of 3084	792	MicrosoftEdgeUpdate.exe	106
PID 792 wrote to memory of 4520	792	MicrosoftEdgeUpdate.exe	111
PID 4520 wrote to memory of 3848	4520	MicrosoftEdge_X64_156.0.4314.42.exe	112
PID 792 wrote to memory of 2272	792	MicrosoftEdgeUpdate.exe	113

C:\Users\Admin\AppData\Local\Temp\1792850632661_TradeBayInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\1792850632661_TradeBayInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\is-KELPSYX60C.tmp\1792850632661_TradeBayInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KELPSYX60C.tmp\1792850632661_TradeBayInstaller.tmp" /SL5="$C0142,15671844,860160,C:\Users\Admin\AppData\Local\Temp\1792850632661_TradeBayInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\is-W8S4NOJZFY.tmp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-W8S4NOJZFY.tmp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4912
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2272
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.299.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yOTkuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yOTkuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjQ5M0VBNjctOENCRi00MDcwLUIyNkItQ0QxMTFCNjg4Qjc4fSIgdXNlcmlkPSJ7OUNDRkQyRDItMTk2RC00OEU1LTkzMzUtMTA1QTkwOUY0MEI0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswMEJGOEU2Qy1CODAyLTQ4QUQtOEEyMC0zMDk1MzIxN0VFMDV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS42NSIgbmV4dHZlcnNpb249IjEuMy4yOTkuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NjMwNzUyMTYiIGluc3RhbGxfdGltZV9tcz0iNzM1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3708
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{F493EA67-8CBF-4070-B26B-CD111B688B78}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:32

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4492" "944" "788" "940" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5040

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yOTkuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yOTkuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjQ5M0VBNjctOENCRi00MDcwLUIyNkItQ0QxMTFCNjg4Qjc4fSIgdXNlcmlkPSJ7OUNDRkQyRDItMTk2RC00OEU1LTkzMzUtMTA1QTkwOUY0MEI0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0E1QzNFRTYtOTM4Ri00RTA3LTk1MUItREJFNTUzMTk1NjQ0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3ODkxNDA1NjMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQzMzYxMjgwNTA3MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI4NjA2NTk0MyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU2OTk1MDE0NCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3084
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{518DEF3D-BD07-409B-9E7A-92278B1F71F9}\MicrosoftEdge_X64_156.0.4314.42.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{518DEF3D-BD07-409B-9E7A-92278B1F71F9}\MicrosoftEdge_X64_156.0.4314.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{518DEF3D-BD07-409B-9E7A-92278B1F71F9}\EDGEMITMP_4D7BE.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{518DEF3D-BD07-409B-9E7A-92278B1F71F9}\EDGEMITMP_4D7BE.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{518DEF3D-BD07-409B-9E7A-92278B1F71F9}\MicrosoftEdge_X64_156.0.4314.42.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3848
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yOTkuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yOTkuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjQ5M0VBNjctOENCRi00MDcwLUIyNkItQ0QxMTFCNjg4Qjc4fSIgdXNlcmlkPSJ7OUNDRkQyRDItMTk2RC00OEU1LTkzMzUtMTA1QTkwOUY0MEI0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyMzEzNjc5QS0wOUEyLTQ0MjEtOTMyMy1GNTc5Q0EwOEUzNUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7SGh2SElXcFVOWlRNblYyVlQxbGUzZjVZSlE5T1NvVEQ2TXhIRGxBODlQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTU2LjAuNDMxNC40MiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjQyIiBjb2hvcnQ9InJyZkAwLjgxIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1ODI2MDY3MzMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTgyNjA2NzMzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTg1ODg1NjQ4OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOTRkZTJlMjMtYmI0OC00NDU1LWJlNGUtYzAzODU4ZGM5M2Q4P1AxPTE3OTM0NTU2NjMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TWgxJTJmekxYRGZkMUwzTHV4d0o4JTJmMUc0akwyTk9ORHolMmJuNXlpM08zNUp3SWVVJTJmSW9EckVYcjRsblpYcm1mR0pMb0Y0dTRrQXR6Q3ZNTE92cGVzJTJiY2VRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMjA4MzMwNTc2IiB0b3RhbD0iMjA4MzMwNTc2IiBkb3dubG9hZF90aW1lX21zPSIyMDM5MSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4NTkwMTI2NjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODgxNTEyNTI4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MTgzODU2NTkyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODI4IiBkb3dubG9hZF90aW1lX21zPSIyNzYyNSIgZG93bmxvYWRlZD0iMjA4MzMwNTc2IiB0b3RhbD0iMjA4MzMwNTc2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMDIzNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_7z.data

Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Installer\msedge_7z.data
Size 6KB
SHA256 65a9952b8f63ccb0373f8fa010a87366598f17386627f3c1bc71b7cb65a971b8
MD5 5fd4a73dfe1b1e3bd8a69e756fd752a4
SHA1 1246356fd8fdc57d3bc5eae16b8d77b7dbc3c11d
SHA512 5f773655d2f57eeef252a70c5aafb31ef9095477bde5a0dbeff59889c5eab23059e04a103ea0cc4227c5f58089b86dfdf30ad8239f6ee057bd91a3dec4421c5b
SSDEEP 96:8uFHzCOX7Xw9HJT6k3hA/LY4SKozIkRtJRJCzzW5wS13aqWa3OLglte+:8uF49HJT6k3hA/knlwzg3adHLgn
TLSH
T1A6D19ECE31850A43EFC65D7A2630DE3545E7AE1EC0D6191B6C45CB48D3BD849C4974D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.42\Installer\setup.exe
Size 6.3MB
SHA256 af67293e82ee5ae58c51e3ffee49f9dd6227c4be39639c91c90cb58eb0dc7094
MD5 8f7aec383e4b02eebe722b7e39167c98
SHA1 929a7a623f7aa0f2b830b46199b1d002c6d18530
SHA512 c5d38670de03fe39ab078d186dce76f64535b0b64c9f72fc721f166d5bbf42e30a63fbefbe4e102ebbc037ca62c70e0c8b60cff3ff0a61a9ccb048eb0b71c526
SSDEEP 49152:1tYHWAOpni6mNkCT9XA8a0SzH5gMqe3rv9yooe1eZTGOH9P3MrEeZeui0GlecYBo:WIipA8sHGHSoP3MidlHb+o4JJC
TLSH
T121665C03F2EA51D8E0BAF6B58B269233E972BC454B34A2DF0A5036151E75FE09B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopilotUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\CopilotUpdate.exe
Size 22KB
SHA256 7f60a32df11a72001bdca3ce76dd2507d5d6e2a69a692c7100b0aeaf7ffda351
MD5 76334f1212b86cf721e84fe903cd4ffc
SHA1 dfd9b1e8f3ef857d5466de6bd1c58f2de6dbd59f
SHA512 fc32ce46934b3088f7d2d943bd2c5e781eab67cbefd770166fbec937646188acdadecf8e5b3d2883b4bc889022c3c764e9fefc319ae828042fae862eec9b5c0d
SSDEEP 384:R2r1xOBF1myyWAH/ELvmtmKyRWo4k92y4GlN8ItR9zlBI+Cln:AJEdmyyWLqEKkZrP9zADR
TLSH
T1E4A27BD3A7684043EAAB68B0842DCD437C3CAFA349209B6760D5F45C2D137C4FB1679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeUpdate.dat

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\EdgeUpdate.dat
Size 12KB
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
SSDEEP 96:x8fvS9V3rAXcjA6VZkS9oA9fczR+qkqUHvNWLiA1qkqUHvkO:evEZ7JIAasJqJ
TLSH
T1A74298117BE4C690F4B22E310D7ACFA65B3AF542AD74C60F7380231E8EB6B058971312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Size 221KB
SHA256 b43534ce45ca2488bf84b9776704096c13f73e0ad336229e4ea7eed12ba46448
MD5 628ec4b125307f3034a5316a9ab1b700
SHA1 e103d600802218994a08f66f128868bae530aeb8
SHA512 a64ec8234b419387cbf57002d54ea97b5a54de002b9e25acd49c7c8fedf9ba4f8cb9ad1ed74823c4dfc91ed70559af6b3dbe07867746e803c7038421fb2a25c9
SSDEEP 3072:w8cz7gBfsLoQ3pXMysxrxpb6plfgNsZKoexQUex86YTwoj:s0BfssQ3Z3qMPfRE
TLSH
T1CD240A6A18FC24E3D1E6D6F8DFE0C913B329E576A0108CA75283424E9D17D81AD97E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdate.exe
Size 203KB
SHA256 bb68553f5ff43302f1984f67d6284d3a6b94a611755d78d97ab560115d67aaea
MD5 3a0e7fc471c5dc2dac0e7e3f03e4c13a
SHA1 8b37f4d909fc9d7e53afe2e88abf2578e9445342
SHA512 0dc3d2609c991bc6a19c95e63112e89a110fd8fad039ee28e09285c54e1f88bddf334d313f9492c164c849c8518916c2120244661bff4759d21b30f8a690b58f
SSDEEP 3072:Rmrf6YfagE9c7l0DhtR6Vg9fh/yOn86ImWTDVhB+kdwqVjR62GcVPouME7tTGjyr:a7l0Dhr1xn8RD7B+kCw
TLSH
T161144C1237F80A68F9F36E315C749F26AA3EBD319D34E66E1640118E2D35A51AD31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 255KB
SHA256 67ede64fcd68184fbe0dfb2dc57a23a437aeeb3c60aa88da960d388b47860585
MD5 7146966410b935cb6b50e8d17e4eb9ff
SHA1 9ee57ab712dc3f2e438c3814511cc99870004dce
SHA512 2263963bc8016d79790c0a4acb486d0dbbc5e26f89bd4be62832581c630c39c4d6f5bfaa342bae70122f648056e50fb8f54b727d4ac734071169e9e9310b6bda
SSDEEP 3072:UAniA4VSAcbMmSTtzbOvBBo4LkLfroY46YlzJnpBW7/SzW9VIX:UAn1USAcbFWtHQBQohveaX
TLSH
T11544D56929F804F3E5B6D1F98FD49903F160E8736210CDFB4292424A4E13E916DABE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateCore.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\MicrosoftEdgeUpdateCore.exe
Size 357KB
SHA256 3170ea229f3eed245eec865b2e527ac2534ad68677c71c383df6e8a5e383eeb2
MD5 0d39f082216051952205f1a0d723fff1
SHA1 2f1d9686dd6d7e6ef6d2f880b42373cfe07ba848
SHA512 5aa342fd036b2ad91b680b07a3186b2b37ace986e517729507636321bcf9f7ca826e4c937e7c987b6aec639978589fe24d79e10f17dfee8cdbdcda0af2c60f78
SSDEEP 6144:zamyEHaE3IWgGfkhXy1+PrbkaGy8mU2AObEf8Y6Hh+Llu40:VHaTWgGfkhXy1+5U2BEEYMh+Lc40
TLSH
T12F743A2528F84033E0F5D5B58FE4E953B47CE97222114DFB43D24A4D9E22A92617BE3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.TXT

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\NOTICE.TXT
Size 4KB
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
SSDEEP 96:rYpPbDCkOmjFHFJoirt6d5y9EygHEN80t6d5y9EygHEn:rYnjFHV4U2ygHEN8VU2ygHEn
TLSH
T1C181853AB362077206D007909A9A9CD7F92FA2ABE35A6744B82CD10D133745DD3FE564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdate.dll
Size 2.5MB
SHA256 a73704e223c054daa669bf5ca6011d6292f6e2e923f0b37f1f18a6b9b8c27ede
MD5 1f25686c850d25dc512faf5c49d3d66e
SHA1 f1736074fbc62c6159ae799a9d9f94842008e409
SHA512 36ad83db34c646f2a44ff61b2e1c0a64a1c2461828b93c6a686517e4e6f531b9df44f1a718aad543f575e7bb1fccef317efc06ac3a0cd739df582881cac6a636
SSDEEP 49152:utnuDmnjeedWoL7cNHEiJZ2g95gTq9gJPcis+aSa9Jtuduvywyx:utL66WG7sHVigis+NvEvyv
TLSH
T1D5C58D2225F54073E4F392B8CBEDE916A5BCF83607218CDB1391464E7A72AC154B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_af.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_af.dll
Size 29KB
SHA256 0c991f20a203a14250b1a28108e43a92e87d55148eef8844b1fb5ed6a5b82ca0
MD5 0891c8f32b7334c9f57ea04818f78bbb
SHA1 e475588c996d169b1bf7617c034a5dbd33a8f024
SHA512 7c4226d33d5dbe6248436f44724597764f703e8bd350ecbd7fb14a933d124828672b5c8071984cd5bcf7eaa0f6c947755e3377e63a94e83c3bdc4bf8e263a52e
SSDEEP 384:Mi85VFXh7OyWmvIW6jrYiVDxlwCiO+5k2y4GlN+FbR9zCsh3:6RrO+EC9zb
TLSH
T1E9D2EB9157F48109F4F73F30BDB896925B76BD92BE34956E2240A15C1C30B81EBB8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_am.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_am.dll
Size 24KB
SHA256 047cc1527426776d2ea88a6462ba952f840186b1923ac2d621159a3b4bf7dff7
MD5 9ffba5d8ff6b98ec0773704ba273b662
SHA1 68a7b4338f18b7300216818124ca3c857a2930d4
SHA512 ec7ad71264bad62775c3d1efc4071d478f581e96f2abd421ee33d2ca57e19715018a26148d61247c4b5df58972974d44c01975800e14e8d089754b8849108e75
SSDEEP 384:ohn6VFXh7OyWmvIWU0Kl8Ss+2y4GlN2+HcDR9zgpiGF00d:DBe8Sswc9zgDN
TLSH
T178B2184783509A0AD0677D744648CE27B5B9FF0C1E2581BBB115FA2434E47A2FB3AB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ar.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ar.dll
Size 26KB
SHA256 8851b8e516127a0645a042fe08293da10817ec9738684e7b92ac68e910c2b4e3
MD5 bcdc2fca0069fcafba4c011a0c264833
SHA1 89a4da4d47aae1d61bcb3093339d0dd636881557
SHA512 0b632c9ac6b163375746d2749ec0f63bc58f3be965ba0705875cb39d58f0d824235460609d393b6073b97134b3a5289fec33c78d484801edf5d87f597c4f508c
SSDEEP 384:9PsPBbOyWmvIWlYwTPsQtXvfGu2y4GlNOG+jR9ztbxIH:cfbpXvfRro9zZ0
TLSH
T1D3C2C8825E5CC13CF457AE34C16BCA53A23952474DD8223B66609E0509A1772EF2FBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_as.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_as.dll
Size 28KB
SHA256 1aba4a24176232fbed6f86835acf53ff6e5dd9e85bfb55b24bd2b8adb81cef54
MD5 50e8e173fd24095047f4df4fa40045bb
SHA1 fccc98bd72619a3432584f93ad10cddc43831bd9
SHA512 90e3d0db7b5b3c80e73a568c33864f103df90a43d1b625b230320b24f1f190d3a4a26aa299d3810a7b68a879f22c439fde6422d3e20fdabe2bc167e3f756c8d2
SSDEEP 768:+i+Z452DuUu3+F/bE6uEJKIlHpmZgE9zMv:9hPzMv
TLSH
T1F3D21C555740B624D6FD643C02D58DBB1AFDBACF081CA4B920E3D11438A53FA9F2B29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_az.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_az.dll
Size 29KB
SHA256 3591a2a5a49dfd9ec2d0a39b7b263fe2ea665710ea8cedfaac898cbe5f591e1b
MD5 fcb6842c6ac414c3b734f6d4c5dc4cf5
SHA1 a018ef64c02d9145c70a77fdf0b019ee1411c599
SHA512 b4925d1307cd8c2404628a14bb6168b05e0d4babe44042acf10f551577ab11b12d7199d23dee0466cc4af9eaadf11474ed2d46285a6a73c42f8fa9baa3e164c7
SSDEEP 768:sIIOFe5FEuo//ctGFLFS2rF9FTFYF+WSF9zIvbN5:saFe5FEuosAFLFvrF9FTFYFazc/
TLSH
T14CD21E6193ACD105FAF35F305874BD531ABB7FB27A34914B2282A14D1C713D2BA34B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bg.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_bg.dll
Size 29KB
SHA256 921b7eb9abd94424e9139262ae6d906ac82d7ccc65827ae5da21d960b9357ae1
MD5 ff4d51982fec601abc1936eedb3214b5
SHA1 c4b4d978f4e9de5c19fe9ea7dcc9bd539e6ef8b3
SHA512 c9f36b86f5047e9e6251110949e8a07e4046951da60466ccfb9ed4acb404ff31e2d94f517067a82506ce5ec04c7ec871c7cba3e31aa0c5621e664f1ddd3c5df5
SSDEEP 384:uP+VFXh7OyWmvIWYdsSCCdCwd0Qgv66n46b2y4GlNIFbR9zCswX5D:LOdshCUCgCr6T89z6F
TLSH
T14BD2FB4FB97C9200F655E6310FA6C6F735BA7750672446C6A34FBD68201C732B72928B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn-IN.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_bn-IN.dll
Size 29KB
SHA256 ce9c18583b3c265141743221f0f298c2dc1df0221b45c16af18773971d846b35
MD5 cc23575f6058bdcf94625e3366bdfccd
SHA1 66d4d5e6c53db72434e19bd97bde93efb7f492fe
SHA512 5646ae7bef58eeb332ef77fbe8fa6241dc5a7cb585f56ed3a576ec5210efcd793b8e7ac76f72abdbf370da180b5eb8fef9381465539c631ff45301b1c06bc255
SSDEEP 768:5MSvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHIvX9zM3:aOAGEbYozc
TLSH
T1CAD26316A750B814E6FD283C07D6CDBF1DF87241242CA4BD25E9EA0419A23FA5F2F51E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_bn.dll
Size 29KB
SHA256 3e79ec992637b503459926eaa6e9facafc970e406c87066ed44745fdfee55d5c
MD5 39d62a73d71d8431811dff5e671b6d64
SHA1 3c6c69cf939c6540409f63bbcb3d6e133843d4f6
SHA512 95ab68547fcb090fdabe3fb6fa84505b0e78aab718091d1a0fb4155a737036a69fdc57eef7171f658256b10c71483176137fa67af5ca1dfdbbf699eca81f7c13
SSDEEP 768:OvvAGEtJtVWCZsnM9/rvoaqPdQ8JBlHdw9zIvL:OHAGEbYQzcL
TLSH
T18FD27216A710B818D6FC283C07D6CDBF1DF87241242CA4BD25E9EA4419A23FA9F2F51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_bs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_bs.dll
Size 28KB
SHA256 738d040866e664d1812958a4a1aa2c4f163969edda7e48b9debe0d26174eef49
MD5 476b4593797655a09eb8e299955e7843
SHA1 98d0c95ae291e4c6ddbb6d142b0a66a0a429e76b
SHA512 7c2dc2a1dacbd668a4708541b43beb00ef5230497823501742308d41f508c09d87e791c1be876ee13bf83310c09310d3101a80680bb8b31952800045632b5708
SSDEEP 384:8F+VFXh7OyWmvIW7aDAmqRDU5NLCdJlwc/Xi+UFs47Fx2y4GlNBjcDR9zgpiGFvS:Pi6lwc/Xi+ms4JpJK9zgDvS
TLSH
T1E3D22E41A7F85259F6F77F30A5B457621D3FBDA2AE34850E2240659C0831782EFB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca-Es-VALENCIA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Size 30KB
SHA256 e9f1ba34c1319cb074fcc2d53f7e9378da1aaaf7f940d6312f35ac405d03c64f
MD5 27fdcfab17fe972fcdbbc61d3d925311
SHA1 368e2b875545004877ef6a40ea5576fde8883c8e
SHA512 d81b5a32f045b297b0d1a8414deedf4c2f2e825d014115678550f2540b063282d2ae7a52db7d3648342ca0d059456c48652505a0045b8f70d7f1ee235665644a
SSDEEP 384:k6VFXh7WpWmvIW3bkbOnGNfNFoBWk5gZA62y4GlNyjbR9z6Xv8upY:MBbkbOnMffoBWFuUqjN9zIvm
TLSH
T1ACD2D841ABE84659F6F32F707D7899525E3ABEAAAC38D10D2300950D0871F51EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ca.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ca.dll
Size 30KB
SHA256 be60c204fa44920288e7b61a1b8028df0480a91f507bee05fa5d26e8e56bf7e5
MD5 7fb95931260329652dbb0dce692d8622
SHA1 477eccb5f7ba3bd7a87785bedb42b8a3f0e3d886
SHA512 6137a549e67acbcaf1cd448bef8725d9a885d00c5966df6421ad60ab3452c1cece49d138eb776328a0605a923aa97c265cfa444d27fd879a873c25fa77fd0822
SSDEEP 384:4RhNVFXh7OyWmvIWeHEWdvDNfNFoBq1ZQtl2y4GlNMcUthXBnR9z8kKsm:KpIHEWdvpffoBqkFpCf9zbm
TLSH
T1D8D2D941ABF88645F6F72F707D7899625E3ABDAAAC38D11D2200950D0871F81EF74B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cs.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_cs.dll
Size 28KB
SHA256 d99d1cf024d00d351f7228783fa13db0893c51db0b91f937abc84b621cc7ed25
MD5 2b39f5b1eb182783293e4c360c587c6a
SHA1 4e843b4a15c6171bc0eb685bb918fda1749fb4db
SHA512 337eb86c9699ec3a472cbf4be276100b3447de200218567aa5269de27c70c478fc4503a01dcb57dee40ce72c09fdb7156edac82e022127d1683ecedac7f90a84
SSDEEP 384:XGrVFXh7OyWmvIWiTL7PGQxQFnwd/E2y4GlNhaR9z6Xv8Pn:s0TL7nmpW9zIvS
TLSH
T14CD23D41A6F84145F2FB7F3069B44AA21D3B7D96AE30C14F6640929D1C31BC1EEB8B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_cy.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_cy.dll
Size 28KB
SHA256 caaa229dd7bf7e96b54ad5eee92d1251368cafb2b4f9b39e10784be499e42d2b
MD5 4efc1846bc8bb857c4eb9e7a4995234c
SHA1 78c3dcfe3990f97bcd02d34242ac24820ccebe5c
SHA512 cd46ca3691353d255258c96d4b5ff7851a9c7ee9b47f87f77b5f77c0d274abfa58f4abf16b8064ec451c804820f99b2090cf4acb1490a7aa5d03ef5ce44e22cc
SSDEEP 384:R0mVFXh7OyWmvIW+tZEmiuTHsyi7zAaaVamjyC8oyUFxOFqdJo2y4GlNhDifX7RC:n0DWZUjxdJS5mF9zAp
TLSH
T16AD2205143F8810EF5F72F74A975A6922E36FED6A974819E2340B1191C70B82DE3473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_da.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_da.dll
Size 28KB
SHA256 711dbfd049b8982687417bf5f12a3b075bdd970e6f130d7b00bf4eb1d1b9ebdd
MD5 c39659468d87fc051458ef1d96c97469
SHA1 1ffd6dd6bc3bfcdd54e350391bcb7d976b820d75
SHA512 8375dc88e6c12265236e9f28b985275af6b9d5a703c5791b26d98825a025366b9fc833cddf6e5bd411be499de527f57a0103d753d3fb2988d6a3b9f7c73ad36e
SSDEEP 384:GxWTVFXh7OyWmvIW9m4HcyvBdIo2y4GlNGaFR9zkis:pPy4PISOaX9zA
TLSH
T1D7D2FD9167F88219F5F33F30BCB98592197ABD96AE34D61D2200A05C1C317C5EAB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_de.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_de.dll
Size 30KB
SHA256 79777bd970e596b5a20f97dbeee6b7588f979462dc07bffcf47984e81269f8a0
MD5 0e0bcb972648013b00b28db03d1650e9
SHA1 bd32c30de81ac52a43f6eaaea959680152c13748
SHA512 1c166c7d5f37d5c3fbfdcebe509801b04bdfa410655554b2b78e52015064e0b34782111a34d3344e9359e1ae6f61a3e90d2288f68c70d7665ff8a133ce379516
SSDEEP 384:3ZGVFXh7OyWmvIWfeI4FBhj3ZnsYxrPbLZ2y4GlNlMgYR9zars6e:iJetj3ZnLxTbLBygE9zMC
TLSH
T110E2D99197E88608F2F73F306D7893962E76BDD5AE34E95E2340A05C1831741EB78B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_el.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_el.dll
Size 30KB
SHA256 bce274f6fcb583595e20f49c826631cf0ce9a7d30e7d664229ab165baa60b66b
MD5 65e960f2797f3f23ca04697fe664a6fe
SHA1 8c33ec0631254aa6f1b1b64a7a3d6be05eda9a46
SHA512 2d278c0e6d15119e2d939f2622b587d6bfdcbf199895fee9b7909b5c26c0664ec454fd2a64c21057cea0612bc6140a7f723527ebbd307a12ad40970eb87773cf
SSDEEP 384:M+aVFXh7OyWmvIWonBzBUBOTG94vTZtfFkmmFK9q87Pgb32y4GlNpX4hMgYR9zaI:i2pnxdFDa14ugE9zMk
TLSH
T1BCE2218E0E6F9711EEA6ACF24473C62B5A3FF5860810DD6732F070449D1DA129ED7A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en-GB.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_en-GB.dll
Size 27KB
SHA256 f68ff514e7f8a4367a070d354e99190253aed505cc2e955661d1055d186c7cda
MD5 d5e3a0587e4b74f68857af20a46d97ae
SHA1 9ca34a4791472d3a4ae0d2cba8f394f4e76ffe79
SHA512 3b1c9e5f0e1b12d9629cd65c77f98fd2beb9c5672b76b001e96f89d72f6522a05b9ee52dc945e21ef88d2be6026b570e6df1cbf44647bf3b9b7236c3f57fc521
SSDEEP 384:iuVFXh7SCWmvIWEkagyonbe52y4GlNwhFbR9zCsz8U:zjagyoyhI99zj
TLSH
T1F8C26181A7F88119F6F73F307EB896A21D3ABD91AD34D65D2201A00D1871B51EE74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 d9d0bd1ac044deba6fb152f4bf71f29c46ef4390038d9d02ac9b3433a6b39595
MD5 c1dcb28cbf180a4f57569ca3eb3c2e80
SHA1 d151a5511c5ab763c53631cd423e82f61737806c
SHA512 206345b08b430695c4fa2076c779e2488121b609cb2fe1455984cd2f807dfef3dfa8087b4fb2fb3f2528124b3d37da50f23faf6660225d0b431f870442d135e9
SSDEEP 384:pgoQVFXh7OyWmvIW5kagyDlBlRM2y4GlNopMgYR9zars6enM:pmMagyDlp+g2gE9zMqM
TLSH
T1F5C24185A7F88119F6F73F307EB496A21D3ABD91AE34D65D2201A00D1871B41EE74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es-419.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_es-419.dll
Size 29KB
SHA256 082e05b63b814280f3ab152acbb282488d0eaf3879f99823ec9acc354d7b5f35
MD5 5084ac14c4fd00412d0cbcafd6ac9785
SHA1 a57519b9fd61044ee7ebb1aaa70c667d4ce47938
SHA512 71f3aecdc8c85c84f9bfd401223df7f72cbd917be09764a4cca873716df52cc5177394e9732681d2d094b55164cce783f0ae2f87329a60e30bc7f0f09f4ecff8
SSDEEP 384:J2gZVFXh7myWmvIWiadyUr4aS2y4GlNBcUthXBnR9z8kSTK:TfdrHcOCf9zMK
TLSH
T1DAD2E94097F8924AF6F33F34A97856665D3ABD92AC38950D1210A55D0C70F81EF78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_es.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_es.dll
Size 28KB
SHA256 4eb24fc2140ccf53b30798d9ea217a056daaeae2e8927cdacec373666a7461fe
MD5 35b56a61b76fabe09391ca5be13443f8
SHA1 200e13fd949a9b44b17ce49012668bf88cd45612
SHA512 207ff495696851fb1b1d555a073235cfee92a921a3485ff4c458b0f2259a2fe2e83485ddb1e9c2a95c0b379f60947d205cf578cb5a785e032f70519e6f90a2af
SSDEEP 384:8zpVFXh7OyWmvIWIt3MjNIL2y4GlN+cUthXBnR9z8kcw:sat3MjNIDDCf9zH
TLSH
T1EED2E94097F8924AF6F37F34A97856625D3ABE92AC38954D1210A51D0C70F81EF78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_et.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_et.dll
Size 28KB
SHA256 3117508ded5c55f475a9c162caeab98f2f338dd30b457c5b0d7374ca9bba545b
MD5 d27b214766c9706594011585657cc339
SHA1 62329811d315595427aa3c84d36afec50ffc3996
SHA512 363b2b76193fce9644af7976f58cae7196ec0c8062dc0addc649839a96b32868d211a1b773063b4c9ce8ca3a9f82e532f0faeae6aad5b4f4eb94a03ba8f2e705
SSDEEP 384:4SlVFXh7OyWmvIW5Vc0dEyjELtX7giw1LmbVdMTwAiDi92y4GlN9FbR9zCszc:Lv5jELBgr1LwdfAwUJ9z2
TLSH
T158D21C92A7E89109F2F77F30BDB496521E377E93AD70E11D2600A11C1C70781EAB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_eu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_eu.dll
Size 28KB
SHA256 c4d2050a4ccf4f91ede81c32228bb9db2886bf7a846db2139a46380c61146625
MD5 7cda7f1724380d6124415f53879b8b16
SHA1 c8a43a8327ce0080300d3ab365a31c25cdd945d2
SHA512 bb53629fbd19645485235830ec052972b3e288d7539df54e9825a7cee540dc60cc4fbe1b640637e95d5882d46e9e0785863a00cad5d95383b5abeac00e89dc63
SSDEEP 384:rcZVFXh7OyWmvIWvcLpNrX52FOX3z14O62y4GlNZR9z6Xv8IP:wiR0FOT14LL9zIvT
TLSH
T19AD2309B97E89158F7F76F31A9B885DA1A77BDA26935C52D1200911C0C32381EE34F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fa.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_fa.dll
Size 27KB
SHA256 a168c185b5c4cf91e4cb57fd4e8ac1a90a99f95d29244459b75e549445d889be
MD5 562673a1985c57305f0d5af4caab0e46
SHA1 405f97e23cd387ec5df2d7a1c960c556acf928b9
SHA512 fc8ca7e87267c9a6d61c5bbad8996aa2d7182fc5fda043821fcaecf6644b59ae4daf48eb206794d0d1a099666fb9057752bf6b15b25937076ce08e54fd9e9a27
SSDEEP 384:Ko0PBbOyWmvIWMXlQEqt0A0Q6Gf+2y4GlNT0R9z6Xv8ec:A/r2Cw09zIvbc
TLSH
T18ED2710A8DA6C870F5636A34C50BD973303262DD6D4189361FE5A93C19822F9EF6F52E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_fi.dll
Size 28KB
SHA256 3ba4513a495e34674a98928a53f43f3063b022d567fe950b371def7b5dabedfd
MD5 7fb386746ed773e64b3049d16c714dfb
SHA1 a90d24fe1818eb08312bb983330fa6d2c4391219
SHA512 a80afea582c68d0c87e6d6b90892abdfce83aa82e9a29c3ed914665933b3afa4b821c21e48c129afe88ffd9117451c86cbf11b954853bfdad09c26644d5e8178
SSDEEP 384:ET5WVFXh7OyWmvIWWJWHJWEFIxnyELZWEYXsN6ZKFl+EoOh0vFqT2y4GlNQyOifD:yEoJOJOUjy7ouF9zA6D
TLSH
T13DD20F8157F8C229F6F76F306DB886125A377ED36EB4D21E1A00A51C1C21781EA75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fil.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_fil.dll
Size 29KB
SHA256 77facbe0991dba1939bf8a19bca52d3e6fc008794a78a527920ff77366901c5b
MD5 da0707483250e696db230397f180a8a2
SHA1 38de9acc74ec13b1b1ac7991ac34ad97d49e6d10
SHA512 c362b1beb30ce5532fdd097db38362d436f150c84de53e7ceca506ac25a9cbf296ef28afcb271fd8d2c8b8b5cead324b482b08e5be165032c7aefca4779d2435
SSDEEP 384:1zVFXh7OyWmvIWBsXsjbjkbkzkrJqPDLiu02y4GlNSUFbR9zCsuZ9LV:BDsXsjboIzkrJqLLTWqo9zc
TLSH
T173D2FE81A7B8451DFAFB1F306EB896911A3BFD426D38D9452240951C18323D1EFB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr-CA.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_fr-CA.dll
Size 30KB
SHA256 74e03626fcff463cf6e8147faa9ec0c999b1802bd6364570b37f8ac5e84ce8c1
MD5 54100ef96028d65955740dc98394cf98
SHA1 5ddace4d67d9adafc5c6371dbb1c492117a9ec37
SHA512 7da5a4a40c3c76f8f19863e362ccb968718ff1f32d83bd52282635d761755b228d985a3b25d892e0fd97597ad415c0e73f1040812b5ec18cafec4d7fb25b8a6f
SSDEEP 384:TOVFXh7SCWmvIW3s7otIRr0UM2y4GlNhIboR9zpS26b:0RINRrN+5w09zm
TLSH
T112D2C885A7E88215F6F77F31B8B986521E3B7D868D30D51D2200A19D1C71B81EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_fr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_fr.dll
Size 30KB
SHA256 b14511c13a8ae58ce06e05a5b925d9e204688e3854b0b7d219d5ce8ea184fa4a
MD5 81682b9a9b78135636de8fa858832b36
SHA1 32412506c3477637993e4250e366a98b2978d9ba
SHA512 7be416db6535929fd729911ff4bef6f9e02d985953ec70fd87ee113d1e8336dea2602087dbfdaa04e52ff6ff8c406bfcd5ba166a8fc0312ae52cb9e202eeb971
SSDEEP 384:3AxVFXh7OyWmvIWX8bW6408z2y4GlNSNXuifSR9zs9k:AR8n4lbWlfe9zj
TLSH
T16BD2A881A7E88205F2F73F31B8B996521E3B7D969D30D52D2200A59D1C71B81DEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ga.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ga.dll
Size 28KB
SHA256 8fa8c60fe0603dff3ccfbe911a15f24b0f7c368a1383b8e084866934fc7d17df
MD5 c7643d0a4390715d2e9bf3ae8de25195
SHA1 407afcb384e3e5ffe6790bda59c2bf6ac2fa8172
SHA512 2dc11ee9706227c3aa7680d5dc767a2a559ac335241f5362791f92371bb247ef1f45788ec8ce9560db3412f48fcb5f15110bf01d39c4d056e26514836dc5ed6e
SSDEEP 384:hrrVFXh7OyWmvIWK5vCQkcYoIoAxP7G4q2y4GlN2aT3FbR9zCsyF:FM5vTYoIoAlC4EhP9zM
TLSH
T150D2FE6053FC810AF9F72F30697486276A36BD92AE38D21D5240A68D5C35B52DE34B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gd.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_gd.dll
Size 30KB
SHA256 afcd01be91ed727304450298ed61aa36704cdaa863c7c8b2ad1bd55e3a7e3ab0
MD5 769909492ebba3890658fae041db2dd3
SHA1 a3ac7f28b771765299ecd3130524c42d661e5cdd
SHA512 53494407d6b6c94d28f885585baaf0ea671ef52f532ad013d3d5fe72751ff496f4bdf1087d68ed3f241a387c3c6cf4f454ae998da3ac3ffe2b510ed86afa204d
SSDEEP 384:98pVFXh7OyWmvIWLFYiA73DpfDfqKiXjR8x/2y4GlN2iJRR9z6Xv8BH:2NFYiA73Nbqfl8xf7Jb9zIvUH
TLSH
T126D2EA4497EC8648F9F36F3819758362AE37BC926D3886992300655D1D31F82EF39B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gl.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_gl.dll
Size 28KB
SHA256 36367f18c12dc0c8a917044491ee9aeca8daed6106a54bc00ade3be33d799f94
MD5 e33979495d20688d140093766b4004f4
SHA1 778072d2eae004d50830fc47889c00fd94c84ba7
SHA512 29f57da14b180acdf86abaebae429bc34fd7e16bc963b05e01c2f1fa8be0410de2ce85c8dbe08f61f88093477d9eb4c2db55f6f0b1f515becc86b0424c63e031
SSDEEP 384:xnyVFXh7OyWmvIWJsCCp2RK+oO2y4GlNcT1NXuifSR9zs9pJ:m/se8+oAETflfe9zE
TLSH
T1D9D21A4097F8920AF5F77F34A9B856625D3BBD92AC38954D2200A51D0C71F41EE78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_gu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_gu.dll
Size 28KB
SHA256 c80555f4839cc432827e70c6d044484cca6b9fe293a1afc92f5e20eb30992aaa
MD5 7db8dae645a827d1b66b8eb544190f60
SHA1 3385d92a23adda7a73524bcd7d714266a75216eb
SHA512 f83163fcc9c92ff470d948cda344e709fe8ba9bf76434f58ec186f7c9c83fe74425545cdbb543194d225dcbeca7bf1526e3ec56e4b26ee6c3ab77f29671e012d
SSDEEP 384:GSBVFXh7OyWmvIWNt7vdQrsojGtCAPPFZCxT3CT6xytk2y4GlN5XjR9ztbWfq:NxCrngGx19zZgq
TLSH
T1C7D275A62FA781CFD06E687082B9D533F7395194D620E1477165A3833DE3342BB2A75C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_hi.dll
Size 28KB
SHA256 8e66452fafa8ff87450196edb06172fa904985926f5072a7246f13a2078d1a0b
MD5 cbbefbb6f4f5db80fd55fe0a06e4655e
SHA1 b5f8f0fb3e7c71f1575b779421d429f50303836f
SHA512 a8f8384aeb5da3861d8e72af384b1c71f592423158560815ddaa3a215ebc94bc035b42cfdc8705c8a938e9169636f35d74e9004c21b29ab85bef0b9af2666840
SSDEEP 384:pENVFXh7OyWmvIWyQcqYmmqkKX2y4GlNbLR9z6Xv8N:GsQcqYmmqkAJ9zIvg
TLSH
T193D2840244808F18E19C6D79E43482F76CFF7425B9CD13C6AAC171F9DCCA37B9A69A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hr.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_hr.dll
Size 29KB
SHA256 248127d818eeddcfbca0c3188272e59b599f1bfebf35bd1c0827fa26999d0ccd
MD5 bf44bcba99cbd033b85c1eab2c5fa28d
SHA1 6d954e93a118d135281b3d162b8c6a2cc7bac3db
SHA512 7acc251e3248afb870f7649b291ea82d9ceb5b3f1130a3bec365da5da47f142b3aedc84157f239313da37aff514238ba4bee104cc4c88cc3bc5804215c567a03
SSDEEP 384:i3kVFXh7OyWmvIWv/fbmrsCCa9gNk8qaEa/w2y4GlNdsNXuifSR9zs9/+U:przqJva/qVUlfe9zk+U
TLSH
T181D2FC42A7F85159F1FB7F30A9B457621D3FBDA2BE34D10E224065990831781EBB8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_hu.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_hu.dll
Size 29KB
SHA256 2c03900f7c8f07e1866ec6dbb31edcae95a09a43500226e3cd94c5ce3784f8b5
MD5 de2d47a6d2d312aca57ffc7bfc0efd4b
SHA1 8e047273488f1c6d0afef2fe514240c619489fec
SHA512 7aa4ea17c6f769a6031c27e37dc23f1801314dc4541df4402ce4eb84d2d11d9bae66b2eecb0c8fa64e104ca9efc5911da60b5d077566c45c778e007fa74579a1
SSDEEP 384:2p+VFXh7OyWmvIWcYhYkZ2hUrV6S8bfkWuNxoRLbufJHwHVbNJT2y4GlNd0FR9zh:5xKkZ2hSV6S8yotbufJHw1bNJ7mX9zh
TLSH
T14FD2204152EC4546F5F79F323DB487960D39BD64AE3CE25E6280A28C1C35B81EF34B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_id.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_id.dll
Size 28KB
SHA256 9a43b1705667fc278c9466dbea1e088548da498370af1992a80e3e972600668d
MD5 069225eaea720235ce33114b5ed4fec7
SHA1 2f0d750f7f0c733e51ba866b46a17bcb5e01d868
SHA512 42f3193429ae476081fdfb08ffe3e42da206a70980daf37a0131b13a2349a3f5bd09198862c044cf4b3a3ecfda168578b77160ce40232d39a504dc4c39a79a89
SSDEEP 384:OR/DVFXh7OyWmvIWVPC8kJZT9r6T1fQCh2y4GlNemifX7R9zAkmm:Sj7BmF9zAPm
TLSH
T1A1D2DA8197E88159FAF75F306AB896921E7BFD92AD30A24D2300A91C1C317C1EE34B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_is.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_is.dll
Size 28KB
SHA256 db3af2c3770509f63703c4dddd1bdea65adb30eea5d6bcc16e48782df93172bf
MD5 bd00235686441d9f0f04fb847bf28bed
SHA1 b82c62916ef6c3ce1ad9b70dbe72b895eff581de
SHA512 444ef03153ea99e229146a674a095485b074d8a161a654e622e252255640c9332347d8be8a03dea298325c2d66b85c81e5b9449a6e209f9530239a1e343a64bd
SSDEEP 384:Hv1VFXh7OyWmvIWUz2D29UNlm5TpA40XLai+8wosSKkGIoYpO3YrPSfO2y4GlNLo:JmBkg5TpAhr+8wp0xoYpGYrPrhb09z1
TLSH
T10AD20C84E3E85109FAF75F3058F493565A2BFE979D34E60D2641A94C08363C2EE78B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_it.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_it.dll
Size 30KB
SHA256 fe051b00c2a3a1f47e0836e10272c95530611096c270797e02bb4547d3744a9c
MD5 70a24e34b06ae6d087e36ea923088bb8
SHA1 eea8f34ae94af975ab0d0222c2c4b9925f6316fa
SHA512 0c93c9ad9ddc15fc65b214c8527a90c61e8b49c170af80b99a13f459f4aae65c0bb5fd232edb7f83c3f9ed520bce9bc5711514ce4ef6563acbb6eff9d20df4b4
SSDEEP 384:nARVFXh7OyWmvIWUuu1+Jswzb2y4GlNIki+R9zs/k:001+JTzTn9z1
TLSH
T153D20B51A7F89618F2F37F34AD3896A60D3BBE82AD34D51E1241905C1831B61EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_iw.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_iw.dll
Size 25KB
SHA256 4a8c65620a1f994e985263795f79facbcfa8e2c7f5e93aad10551940e6fc6079
MD5 5dceb2896fcd47301a826c62ed72f15d
SHA1 a4eaebf232764a6e75d1eb50421a71c1bf4f7503
SHA512 cbef39e41701e14f4b122441eca9de3d68042d5b0888d4d101b5fe2a31faf400e362d25dde0cfeb119ef6b930f973453cc648b84d984b7b6dd0d6a5f428f42e7
SSDEEP 384:lAVu8PBbOyWmvIWXbW1x4SCJ54LGA/ExQu2y4GlNf1vtR9zlBIICE:lsJcCT/BP9zAFE
TLSH
T1CFC296415B60C1DAE925EF33821F8A2F6534EB40563876137049A9A43D6EBD2DF2D73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ja.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ja.dll
Size 24KB
SHA256 4716518b9bde91813b74107fd40405c017b6e11b1fb2183732ae2562473bf059
MD5 ab9395cfe7ffd1de14d534062481bc67
SHA1 ed3c1d7e9423c332905b737da6e154f139b35fbc
SHA512 1ce00ef8228abce09e07600c672c685f9052b4623f9a0a180230cb365c56f3663bec295e6539855a710642ee642754cb9c484bbf1811877359b901ae37c28fe8
SSDEEP 384:KHTVFXh7OyWmvIW19gu2/2x4K2y4GlN9VNXuifSR9zs9rr:0TfXV/lfe9zUr
TLSH
T198B2E6896BA4CD4FF8F26EB101B4E6A33E7DFA615A9188512540E40E24507C6EF37B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ka.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ka.dll
Size 29KB
SHA256 c4c2cde0be5e1d6c76eff541dc4701ac4375699ab6b4f91113b59557526f0a8d
MD5 00826a2acc996e87e2332f73c497d4c8
SHA1 04781f1b8963156dbc9551cbc9410a6357dccd29
SHA512 318f6670f0863623c9f2b97bd3824a3682fabedf2ceff8f6a578da76215642ff3565315331998917d0018ac0c1c03858bb06672d7ef6c06638b8a1a0fcd82364
SSDEEP 384:V0R9VFXh7OyWmvIW3odoA7s4THmES4c9Oko2y4GlNB4NXuifSR9zs90:6PWcS+lfe9zH
TLSH
T1BDD21B024393C822E15E2A7069BCCFCEB53DABC02550551BB390AE98A511BC3DB7F776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kk.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_kk.dll
Size 28KB
SHA256 5ce6dbf98371868db011eb38a1a95ac5938889a0d56653af7533462abc3170b2
MD5 fbe4a0f159ce7a7f68460aab45f8b59b
SHA1 9842773d8b931cd198165fdda4b490bb0f27e237
SHA512 6f21b111a524f11f1222b70a36c25cc68bd527bb81ef6ffa2c0505c06fc3cc08cb691d5d5c7d42c2e16fadbcd29c5fca85be207154af0ab01450340a27879d4f
SSDEEP 384:NIkVFXh7OyWmvIWE9MvPQwf2y4GlN2iFbR9zCst1I7f:FiWvPQw/J9zQf
TLSH
T123D2844FA570E601E0A4FAB04EA18AC314BAF3542B5445F7BD9FB51428A4B32FF35AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_km.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_km.dll
Size 27KB
SHA256 d1b814dec2595ef605090adc42bd9ea6327867ae8b176aa5234d4780c2ee4140
MD5 34c668fb419df76840006e75a2128b0a
SHA1 1f755433ca1e468b27ce1cfb63f763de05a5c709
SHA512 b05873248d1c8b7dad4ebb6a5a8c088b7945aeb5fa3d6e69a37fbfd9f64d9285325d3484605bb3252c708312ba3716f84455a69920f9626a6496574f6826cefe
SSDEEP 384:ha8VFXh7OyWmvIWwfJoxeUnPcS7cePBpxCNpJp2y4GlNSDaNMgYR9zars6BS:PvxdPX1PBpo/JRqDzgE9zMs
TLSH
T12AC252D41174C0BACD23D434C1B5ABBA3A36B5D79E396D072211B8660A327C6FF95ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kn.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_kn.dll
Size 29KB
SHA256 406cb42078ab4097d6c292732414d58430b1519802e51918d4e28693e0d79836
MD5 58517f9e77196b9b3715437cd350b238
SHA1 9cc79264ae00ad1e8b2844afa407a7ab8ad4b53b
SHA512 276b57909f2be24dc70362d98281c9152433e8b304a5147104c56ad5cccabf0f8ca9fd48093152180ea35dc26c502e1448fac380942a9e1021885477c62bf95d
SSDEEP 384:WBqVFXh7OyWmvIWcQd4SyQRPbwl2y4GlNjFFbR9zCsYhS:x2Q65FbZ9zqS
TLSH
T1B2D25FCAC3B7C815D4C43EFF016758BEE520AA9354E156D23206904C6691BF9AF39BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_ko.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_ko.dll
Size 23KB
SHA256 9ad5743f299ba850c65273b1130d2e59b5e54cdfa88d4ee644d338b78a7b236a
MD5 dfb6dbd73408160fafac446516faac3d
SHA1 e3dfc6fbb0e993c3b7fcee8d7e0656f100cbf4f3
SHA512 00eba510aad99ffe8f9c7b4549ebeb11b6ce21df2632a0340e138f0f26d0d78ffe081e817c1f9b5b1cb280edd31d502dc6d3e3739433bccf96223abeeffd5490
SSDEEP 384:ft3VFXh7OyWmvIW4lte7yWYDeYhHNjLUtUB1SGGgrxYQ8lJDu12y4GlNloR9zpSP:F6M+OkFzVt09zfI
TLSH
T121B2F75792A8C002E465BE320AE5CBE7753BA2816E139457F740F16C28563C2FF3979E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_kok.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_kok.dll
Size 28KB
SHA256 ccc032528dd59354f305735a80356c62253e6a157eb7b4bc894f793ce277db4f
MD5 ee445b91f26e4159d84b7a0216ae8df3
SHA1 64943ea4defb878ff4be0a7ce4a2b8847df7fc7e
SHA512 1b756a3ae8a3677f0480e3175689a025a8bb50953e4f4c2d1fc5ea6c658cb543245000e22d16f030863056d952304a78fd66a27aca28e8aea1ae6f81609be5fa
SSDEEP 384:KEnMVFXh7OyWmvIWDRr+hjZ+hjgOjWfoQ2y4GlNgAtR9zlBIMCngowGE:LyiMKwKdP9zApK
TLSH
T1F9D2854251808725F67CBDF8D07846B35CFE2114F6CD02863AC472E9E8C637FAA5D6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lb.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_lb.dll
Size 30KB
SHA256 9c6f92731e33b2ebee044a84ef5402593c487afd58fb631e970935a3e21874c1
MD5 269620c548737fe55c5c2255c8fd72ee
SHA1 8f02497d3cad1a19600a67533f2d57d09a9354eb
SHA512 1afdb5bb9bbe84caf1c06cbc398a06b7498454c1ee7f8b76b4d6bcaaac3f14bda59c4b7a5fbf174267c131acdfec1686f23455453db0da088a27cde99ac9ac70
SSDEEP 384:WUJVFXh7OyWmvIWose3swt/bmTRigvyOU2y4GlNNnNcDR9zgpiGFaf48zj:P+s4sSuAy2q9zgDaf/j
TLSH
T16FD22E4267F88129F2F32F30BD7496A22D77BD86AD34D95D2240625C2831B81DE78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lo.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_lo.dll
Size 27KB
SHA256 11fc669c7e04f81fd8ecdc747c2d022549394aed2477c7e1b661d4677d30f3f1
MD5 234c5e2d7db31c76032d5e722658e810
SHA1 c1102152b7695bcbaeab591ebde6882795da11db
SHA512 2e373e43e91fa58737a0b78b9c8e309c842b92659259a626e97babb7777bd774cfc89d563ebb5a3322978e3de25c9cbe56e1d568a793943a36c2959ae5948231
SSDEEP 768:tJXADgApU01duiHkJwbMQpxZZPUMAX9zW9:7QD7pU010iHkJwbMQpxZZPozW9
TLSH
T12BC2A5FCA2D0C01FE1EDA7F0D46DA9F57CB566040B03456767846874AB623C2EF78689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lt.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_lt.dll
Size 28KB
SHA256 36880f85c93ab64b269333ce3fa4d3632021d59d64ace3f9e79eedaca3c96073
MD5 c0a8d55a9897ad4bd0d80e80c8ed75ff
SHA1 b402df9b06a6fa2c276e37c33bd0a9078dda2a78
SHA512 9c69d66b6fc2caec307baee2dc644dfb8154e6531d4c09b2eb051ef6fa7e7f61090f6097e2e90a7d73c7aa618f77d69faaac3dc7236bdb5c4979e22f96f101b8
SSDEEP 384:NnwnHVFXh7OyWmvIWZrVs2BZJ1f+jmU55z6B60Kmr6YD+2y4GlN2WcUthXBnR9za:ejhrB31f+jmUnz6B60NDwWCf9za
TLSH
T147D2115593FC4149F3F76E3096F88A561A7BBEA66E34D11F2100A18D18317C2EB74B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_lv.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_lv.dll
Size 28KB
SHA256 6e424c479848067ccd0ab8fc2241f0757eb02beba8a0f8542b07e056dd531627
MD5 50a819440e9c20b000f292b496bcd0a0
SHA1 61ff242ca8ed24116e33ca545af023278bf00781
SHA512 85b39cbba855eb506f3b43de049ea07c98d78b4791ddaf0477c456903974a8d076238cfa89993e108c6ff1d28ede2c99c98052061b6fb875b6ee072614df839a
SSDEEP 384:2sypVFXh7OyWmvIWlYppSepDyvK5x/mI42y4GlNCFbR9zCsdq:g1yie9zq
TLSH
T19DD2528597EC4219F2F35F306AB48B522E3B7D926E34D14F2140A56D0971B81EFB4F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_mi.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUC8E9.tmp\msedgeupdateres_mi.dll
Size 28KB
SHA256 53cbfa2adb7da990a6658056b7c7adc15a6ad6dce2b911e95bb1215e24067640
MD5 cd7d05bcd935f1c3f4c61bd90115731b
SHA1 1a2d4bef795d6a759cbe05755f4b2d164999503f
SHA512 6b818586615d1a28edbcd171136a81f00966f12f25ab733bdb9b3148a0c7fc7fb00e6b649f58d8a2cfa5e38e4c288a4d47835f1cb9b6b4179aad7414da309fe3
SSDEEP 384:vFLVFXh7OyWmvIWRHDPvhHXBRDEWUDrF1/rzLOWsMVbwwH9hlnyxNC42y4GlNXZQ:NXRp/dvS9zgDq
TLSH
T1BFD2FB4256ED4206FAF77F3142B497522E3BFE66E938E74F2500946E15323C29E2472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TradingLauncher.exe

Path C:\Program Files\TradeBay\TradingLauncher.exe
Size 316KB
SHA256 f1f72e91dae833843f13921e11fad3cdcbdab8ae313b15744f99b4d3e91c5ee0
MD5 0ce301f32be0df6fbdc9727fa59329d2
SHA1 0682b5fb41e1bf934f624cc91e022056011ffa5d
SHA512 28960a74a1ba514171ccb8921bacedfd83492894a4ed17d057ca6afde226f1b0275c3d23e4b9b993509668c05ea69ba33429d93420285499aa01bee7278b0683
SSDEEP 6144:AscI/uKl7OAvXgWQ9FWHOJHgQuJEeKZYKThM77W05EjjwNj0bZbXb1mb4Obobfbw:vcf27OAYWQ9vhgNj0bZbXb1mb4ObobfO
TLSH
T14B643A2FB26016F5F076C2BCCB8FCA52E5737042831956FB16224D667E376A4BA3C644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 332KB
SHA256 9918c8f417295c0f97ce80500ec819e930b3d37a5749ece18f03b1c72a1cd172
MD5 22383761ca3bd8929536755f61a51cd3
SHA1 eec4bf9b82e08b414f7e0fa9efea65d421ae5a83
SHA512 ac59b09c85cd0eed970fa124411afb26195b5cceef10b338938eff20d848006b4a73da866a59b3d11664aa3da60a9570f61b48a4ac3a932c2c17a241e19559fd
SSDEEP 6144:y9AyK2fVa0a4nFQ3HQIQSyPIrI9mCDRXFw/r/2yPufzQFcEPFooFoHehZg:S
TLSH
T14D7418353BF80619BEF7DA1AE9F6DC66B93BB9662C15C50C0091164E0C72F01D970B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1792850632661_TradeBayInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KELPSYX60C.tmp\1792850632661_TradeBayInstaller.tmp
Size 4.2MB
SHA256 98cb95ba664131be7e561f7b37f7362b6b9ff8a394c2f5d5b5f26c77b58ed950
MD5 fb1b7ed9d597d6b4e3e90a49b0dd0b21
SHA1 0860ee8737f05ea4be9298c47740ca308f647b71
SHA512 a32979cf26da198e7c202ce871330d2812129bc5fce48fea9d194bb707b7e0fba65fabc4e4b141eced1fa8f5b29f59bef4a77e9521260ceeb2bbb04eafcaee2c
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jq333TY:HItJj90Z6RgKwA
TLSH
T1FF168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-W8S4NOJZFY.tmp\MicrosoftEdgeWebview2Setup.exe
Size 1.8MB
SHA256 f414de01c4680f0bb0694d1ea7803c6968f3a81bf6bad01b89bfc65dce14c2a2
MD5 851343f374301cf0beddb31a5a81bde7
SHA1 dcfa6ecf2d8f2135662fe9731cf1a3bde25b7160
SHA512 b01ddb5452645683370bf3fce211495c1ba25213e47da751b831df82337b4a4c52d9f67d19fe45cf50110d1e96110c2a80ee3d81dac772e0cbc5f0ae66863711
SSDEEP 49152:ZiGV3T3JgjEwu1LDIo5/r22ysIZrjQGRiOiwjMGp6HWXTzDS:Zik3cEwu1HIqr2JdvzRbLNzG
TLSH
T1E995222572E48031F1B31E7155F49AB21A3EBD301B7009DF27919A6E2E70ED2E639B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3988-439-0x0000000073900000-0x0000000073B7B000-memory.dmp

Download

memory/3988-411-0x00000000009B0000-0x00000000009E5000-memory.dmp

Download

memory/3988-412-0x0000000073900000-0x0000000073B7B000-memory.dmp

Download

memory/3988-477-0x00000000009B0000-0x00000000009E5000-memory.dmp

Download

memory/4568-9-0x00000000036E0000-0x00000000036E1000-memory.dmp

Download

memory/4568-408-0x00000000009B0000-0x0000000000DEC000-memory.dmp

Download

memory/4568-5-0x00000000036E0000-0x00000000036E1000-memory.dmp

Download

memory/4568-8-0x00000000009B0000-0x0000000000DEC000-memory.dmp

Download

memory/4568-479-0x00000000009B0000-0x0000000000DEC000-memory.dmp

Download

memory/4572-7-0x0000000000AD0000-0x0000000000BB0000-memory.dmp

Download

memory/4572-0-0x0000000000AD0000-0x0000000000BB0000-memory.dmp

Download

memory/4572-481-0x0000000000AD0000-0x0000000000BB0000-memory.dmp

Download