Overview

overview

8

Static

static

3

NewLifeRol...up.exe

windows11-21h2-x64

8

$PLUGINSDI...up.exe

windows11-21h2-x64

6

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...st.exe

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...id.ps1

windows11-21h2-x64

6

$PLUGINSDI...86.exe

windows11-21h2-x64

4

launcher/n...er.exe

windows11-21h2-x64

6

launcher/w...QB6.js

windows11-21h2-x64

3

launcher/w...x.html

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/10/2026, 20:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe
  • Size 1.6MB
  • Sample261029-zar8jaex2x
  • SHA256 e99838c51bb3379b244654aa77e33032d42fc2b5d224c5babce432d9fd3dcb28
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 18 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MicrosoftEdgeWebview2Setup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1288
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:660
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3744
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.251.21\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:1480
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTVFNkJERDctQ0U2RC00ODEzLThCRkMtQzY0NUEwMjdENjU5fSIgdXNlcmlkPSJ7QjgxQjQxRDAtNDZFMy00M0VCLTlDN0YtRUYyMjdGODQ4QzY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0U1NzNGNkE4LTE2RDAtNDU4NC05OTU0LTUxQTAwM0U2M0E1NX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMjUxLjIxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjgyMzQ3ODM5IiBpbnN0YWxsX3RpbWVfbXM9IjEwNzgiLz48L2FwcD48L3JlcXVlc3Q-
        3⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2236
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{A5E6BDD7-CE6D-4813-8BFC-C645A027D659}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:1064
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Checks system information in the registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTVFNkJERDctQ0U2RC00ODEzLThCRkMtQzY0NUEwMjdENjU5fSIgdXNlcmlkPSJ7QjgxQjQxRDAtNDZFMy00M0VCLTlDN0YtRUYyMjdGODQ4QzY4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjEzNzA2MkMtOUIwQS00MzhDLUFDQkUtNjVFQkI2MTVGQkVEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTQwLjAuNzMzOS44MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDgiIGluc3RhbGxkYXRldGltZT0iMTc4OTE1MTgwMSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDMzNjI0MTYzOTgwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE1MzE3NDgwNyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI4ODEyOTAyNyIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4048
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC5CF6A6-92DB-49E8-8EB1-80906A310680}\MicrosoftEdge_X64_156.0.4314.50.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC5CF6A6-92DB-49E8-8EB1-80906A310680}\MicrosoftEdge_X64_156.0.4314.50.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC5CF6A6-92DB-49E8-8EB1-80906A310680}\EDGEMITMP_E4354.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC5CF6A6-92DB-49E8-8EB1-80906A310680}\EDGEMITMP_E4354.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CC5CF6A6-92DB-49E8-8EB1-80906A310680}\MicrosoftEdge_X64_156.0.4314.50.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:716
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNTEuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNTEuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTVFNkJERDctQ0U2RC00ODEzLThCRkMtQzY0NUEwMjdENjU5fSIgdXNlcmlkPSJ7QjgxQjQxRDAtNDZFMy00M0VCLTlDN0YtRUYyMjdGODQ4QzY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0U2NjIwNjc2LUU2MzMtNDhCMy04NUZGLUFEMTNCQzRBODVBOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSIxNiIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0hodkhJV3BVTlpUTW5WMlZUMWxlM2Y1WUpROU9Tb1RENk14SERsQTg5UGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1Ni4wLjQzMTQuNTAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSI0OCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzAwNDcyOTA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMwMDYyOTUxMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MjkwNjY4NDYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzZmNzM3ODk1LTRlMGQtNGYxNi05M2M5LTFkOGFjNDFjMTEwMT9QMT0xNzkzOTEwNzc5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVk3cGIxM3JKV2VDRjFncEthYmRqUFBqMGszVlI4V0NXamt2a3BUQjVWcDElMmZZWExLeDR5Y1c4VXdDSXZtTk9jVTRFSUZTNDhDbWlDeEJTYXd3akRUUnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIyMDgzNzE1MzYiIHRvdGFsPSIyMDgzNzE1MzYiIGRvd25sb2FkX3RpbWVfbXM9IjE2MDYzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTUyOTM3ODk4MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NDQ1MzU1MjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4NDIzNjk1MzIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI4NzUiIGRvd25sb2FkX3RpbWVfbXM9IjIyODI4IiBkb3dubG9hZGVkPSIyMDgzNzE1MzYiIHRvdGFsPSIyMDgzNzE1MzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjI5NzY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2324
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "576" "820" "816" "824" "0" "0" "0" "0" "0" "0" "0" "0"
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:1660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        msedge_7z.data
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Installer\msedge_7z.data
        • Size 6KB
        • SHA256 f3157d72be4f1dbdc58704bfccebe82464edd5245733c609caa6f903f63dc217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\156.0.4314.50\Installer\setup.exe
        • Size 6.3MB
        • SHA256 e07ecb40b038b9b2f69493b3e8bf70709e19c3257b41af8fd7c792df6e9e354c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CopilotUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\CopilotUpdate.exe
        • Size 22KB
        • SHA256 137de6fb352032b6a5d447ed3497f677724f47ee17e52516541806eac6376ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EdgeUpdate.dat
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\EdgeUpdate.dat
        • Size 12KB
        • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeComRegisterShellARM64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 194KB
        • SHA256 8d1b8e0b504643fd744e882298b782a8c7c9a2b197e708336b167b54931e5623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeUpdate.exe
        • Size 202KB
        • SHA256 be9bf296139a19ffff6c780c7486eef5fcaa12c185bd1d8fe5d493573e4a2dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 227KB
        • SHA256 af295b62410e5e6f84855035ef3868fb43203a66450049fb318edaba22d727a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdateCore.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\MicrosoftEdgeUpdateCore.exe
        • Size 274KB
        • SHA256 c1ea19172cc7b1d053709b574486d984888b7bb32bc1d76218f888358923c447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NOTICE.TXT
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\NOTICE.TXT
        • Size 4KB
        • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdate.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdate.dll
        • Size 2.3MB
        • SHA256 7c0e84c153ec87af29bc17c6e112c7bea070b4c43743681312aa378fa219cd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_af.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_af.dll
        • Size 29KB
        • SHA256 68ddd6bf2aaf60597cda3fad2a9a5645e8c678effaad1f60230094483b1378f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_am.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_am.dll
        • Size 24KB
        • SHA256 de2655bb84b68b6926eaa94dc4072940bafe3bad85831093c01e46d36e967470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ar.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ar.dll
        • Size 26KB
        • SHA256 250a0f420b8bd977240a5918d25630557a879a5dd55ed7ec4f5221b8b525ae14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_as.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_as.dll
        • Size 28KB
        • SHA256 873e0e06bd27ab3839e85509617c1388b66d5e7365cb9b66b17f8b165a3d4f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_az.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_az.dll
        • Size 29KB
        • SHA256 92ee27c984b4e3fd562959a3b042387c9397bdab2214d20e922dae8911ed4e35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_bg.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_bg.dll
        • Size 29KB
        • SHA256 144c97ca3f8acf7bf5c4409aaa4af2ca8cad4696a29485ad909ff2bdb323bde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_bn-IN.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_bn-IN.dll
        • Size 29KB
        • SHA256 3301cf22c7cb06a3f1b335c3d2c6539e6e1cd64dc2ef070cfbc849e13b7cbe6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_bn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_bn.dll
        • Size 29KB
        • SHA256 01f9e324761c636190cafe5526397b26692f23c8b7d8d225772ef8619370ad9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_bs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_bs.dll
        • Size 28KB
        • SHA256 f601d3e213cf3775e4a969ac7a898acd462a27e5f6ea5f0bd36d2b9a59c9080d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ca-Es-VALENCIA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        • Size 30KB
        • SHA256 ed286a4457e643c3f412a75b3cd8267b31bb2aa46c24b9f255ca7cd2600142cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ca.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ca.dll
        • Size 30KB
        • SHA256 fa35258a5247037eded3978674ecda177f48a4e725ef8c5d309fe913e7eb0526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_cs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_cs.dll
        • Size 28KB
        • SHA256 0b0138d0d0cb9c357031956371540f853c04fb40c6b84b7a5c282482f908aab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_cy.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_cy.dll
        • Size 28KB
        • SHA256 e71c60628b252cfc9067b60c0efde8bbc8d6ab3901add4c4d2acbc154c05253b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_da.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_da.dll
        • Size 28KB
        • SHA256 fd76b7fafeaadf835005fdd0119603a1513424ab9dc20e5aadbeda1240465bab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_de.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_de.dll
        • Size 30KB
        • SHA256 4a21813f377b2618c8eb74da0ed7df013d6a1a13b7099f775b455ce17f1ee3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_el.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_el.dll
        • Size 30KB
        • SHA256 fd13d0fd348c1c72bee324f4adcfce0eb95f27611808d8316777468546c9cff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_en-GB.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_en-GB.dll
        • Size 27KB
        • SHA256 18f7311556b6200b2469fec8002fce48fac226d85d92866301f525b6da082871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_en.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_en.dll
        • Size 27KB
        • SHA256 f0200764e0330b0c5365312b6e9090af11633ab981c693011e6a931e598730a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_es-419.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_es-419.dll
        • Size 29KB
        • SHA256 2f046efe6d09024d02d0c46e0f63e32031d6de789758b808be5cca779c9c9a80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_es.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_es.dll
        • Size 28KB
        • SHA256 b269554edd0c25ccde36e39a8ace44d10f84f4effe86e44b10a478f4dbdb35f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_et.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_et.dll
        • Size 28KB
        • SHA256 db3c48b240399899b44c45412b2522f09d923a1a82c6d38d02a5a934ee4dd3a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_eu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_eu.dll
        • Size 28KB
        • SHA256 7f71569f73571de1dcce7cedf3ace4f42d34d97c3ec9327d50687a4620214d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_fa.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_fa.dll
        • Size 27KB
        • SHA256 5b11e40775191a858c445f3807739df8140235d5201e801a5993f81a65ed2f74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_fi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_fi.dll
        • Size 28KB
        • SHA256 3c4e39adee14c454f87c07229bb16536f999e124f15fe32e5d937a856710165c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_fil.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_fil.dll
        • Size 29KB
        • SHA256 8d9c8a9d3bd8b11ea4ca6a3f4834788ba72269e8f80acf0155ade412a5791701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_fr-CA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_fr-CA.dll
        • Size 30KB
        • SHA256 9820369dd983fad4e811f80b1f51e4d59e509d91f9c1c41ac5ece884213004b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_fr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_fr.dll
        • Size 30KB
        • SHA256 4124b8c859e15171130cc2e4ba55ca1b9181cedc9624dbf3e795ee7dcb227bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ga.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ga.dll
        • Size 28KB
        • SHA256 f199b4bf37988ba2e1cbeb774078e0ef81da4e8f6190f594ff214afff5127b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_gd.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_gd.dll
        • Size 30KB
        • SHA256 3b1f322a96d3abb95b35e4cfd4ba18ac25c994a91fee383041e0b3fa6cc441b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_gl.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_gl.dll
        • Size 28KB
        • SHA256 a8bbf0e576487045a7dade2e2f677ad556ce9a9b5601012d55149265f1ebfca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_gu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_gu.dll
        • Size 28KB
        • SHA256 100e99ca8769123735578a2d15eaff97e5c45a06ea4455d5011f8eb730ee11c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_hi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_hi.dll
        • Size 28KB
        • SHA256 ca9a6fea6851ee05120eb06adee3cebf0eaed75a8f31699a07386170f0144e76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_hr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_hr.dll
        • Size 29KB
        • SHA256 b0db6f0d4ee2519163fc95328c4be802606da273f62ccec87c9055aefcd27b3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_hu.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_hu.dll
        • Size 29KB
        • SHA256 f2dd32414b659ae04344ec4d17341342e16cfa8521b71ca13cd7383c8566fa82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_id.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_id.dll
        • Size 28KB
        • SHA256 c355f35074987e204c6a0570881367e4989c47669398d97108e1b71f29e94c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_is.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_is.dll
        • Size 28KB
        • SHA256 7adcde3d4aaec6df0991f4165f1df02a8ce94c78e1dd3a67c46d2ea1ba4d7558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_it.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_it.dll
        • Size 30KB
        • SHA256 e3aea736a910d08a2f33c5581e732afe63495522ad39db1a5a605a609b15cc4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_iw.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_iw.dll
        • Size 25KB
        • SHA256 8ec8f9085db96a26ae18df1ccf91f8cec795274f3aa7441d6eb9645227d94b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ja.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ja.dll
        • Size 24KB
        • SHA256 f3852b7a5fee76a9d4eefd6ef4d6f6b43baf06930641d689cea1b05a356bb9ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ka.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ka.dll
        • Size 29KB
        • SHA256 2f47e7b1030a2f87ae5c30dea7b4eeb057fabf149eccb82df1daad9c4ba5a98d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_kk.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_kk.dll
        • Size 28KB
        • SHA256 60e52c87892baa20b6c4e449357586efc7fb29561fe5b33c98d1857f54196ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_km.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_km.dll
        • Size 27KB
        • SHA256 4150a0bc2a86d40821a415bae3cfd4f78c866ba79042d4a50187ea929cf3a1ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_kn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_kn.dll
        • Size 29KB
        • SHA256 8f8d9412b563a77a69649ca72c1feff04a38f2a2fc2e0612eaeb4d364ee0c9be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ko.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ko.dll
        • Size 23KB
        • SHA256 cb818ca1929cdd0f5c44d0dcda74990a1d8a0565b622cfcbcd574c18a6cdcc1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_kok.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_kok.dll
        • Size 28KB
        • SHA256 f0468f51443e6fbcd861495d7f11fccdf606dce6e7f9edbd1bfedc2be6ca0010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_lb.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_lb.dll
        • Size 30KB
        • SHA256 64c6f8843b1863a51c0bbadd074fafc03ff5b95931289bb59ce9ef16cdfffce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_lo.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_lo.dll
        • Size 27KB
        • SHA256 d50b9e13081eefb6521b78b16307d7547365fd56f81287582b929ffbeb3f9c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_lt.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_lt.dll
        • Size 28KB
        • SHA256 8241ab91915c7c5a796087074f8a4432235aaefc13140728a358cb051436becf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_lv.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_lv.dll
        • Size 28KB
        • SHA256 4507593e5b89679b0a0c193c7b6728198be229a3bce2112e6765507de906774f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_mi.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_mi.dll
        • Size 28KB
        • SHA256 195fd89d2322a69e139b6a78b5ff39b740e8b992299c489a15f418e346c257a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_mk.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_mk.dll
        • Size 29KB
        • SHA256 8794bd778883434ae77abe7b43b3ba7e1eb203452e55ee3e8c9eb003c4b85982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ml.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ml.dll
        • Size 30KB
        • SHA256 7a5967936583c190c1e293bbc1202a411ef29797160a0ce24885288c3af88816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_mr.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_mr.dll
        • Size 28KB
        • SHA256 5fa1f96755ca05e6e1d365e74ada3762afd1404c63ce31577f0ff0011ae4ccbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgeupdateres_ms.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EU59B4.tmp\msedgeupdateres_ms.dll
        • Size 28KB
        • SHA256 2c92b44bf332f4e17e9136b0e0d63ee4f569d6408fe49be902d1d6e08544ec79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdate.log
        • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        • Size 236KB
        • SHA256 86e860e65d2874f34bf6fda63ec97bda328e8fbdd7f36dd8c6d6de14f4509d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1848-305-0x0000000000FE0000-0x0000000001015000-memory.dmp
        Download

        memory/1848-306-0x00000000741C0000-0x0000000074407000-memory.dmp
        Download

        memory/1848-341-0x00000000741C0000-0x0000000074407000-memory.dmp
        Download

        memory/1848-351-0x0000000000FE0000-0x0000000001015000-memory.dmp
        Download