c1c19f943bbc0bc6cf01c919ad5b2c44f22fcf7299e8e09588e78bbf4bf1f1ae

Analysis

max time kernel
151s
max time network
153s
platform
windows11_x64
resource
win11
submitted
29-10-2021 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88480 549d1468444 d81858d905 76369d92 864489d4 699165 3d8601 387d0 8548586 d66880 d780915d63 6d465 20d84680d847 443.pdf
Size

92KB
MD5

de4c77ed293d24aa54eb6830e849ba36
SHA1

00f2c1d0a70b334fd57a4b329b2582e08c3a7aaf
SHA256

c1c19f943bbc0bc6cf01c919ad5b2c44f22fcf7299e8e09588e78bbf4bf1f1ae
SHA512

ad35d737eac465b297f5a6717059dda52ad383da524feddd0b63c0d7c913902e7dbeecca575b3e6eefff0cf8fe0bb4808cc45d9de66e6adb6a769a343434d679

Score

10^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Executes dropped EXE 6 IoCs

Processes:

msedgerecovery.exeMicrosoftEdgeUpdateSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

pid	process
2796	msedgerecovery.exe
2920	MicrosoftEdgeUpdateSetup.exe
3452	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdateComRegisterShell64.exe
4408	MicrosoftEdgeUpdateComRegisterShell64.exe
4548	MicrosoftEdgeUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 14 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
3452	MicrosoftEdgeUpdate.exe
1160	MicrosoftEdgeUpdate.exe
4608	MicrosoftEdgeUpdate.exe
1472	MicrosoftEdgeUpdateComRegisterShell64.exe
4608	MicrosoftEdgeUpdate.exe
4408	MicrosoftEdgeUpdateComRegisterShell64.exe
4608	MicrosoftEdgeUpdate.exe
4548	MicrosoftEdgeUpdateComRegisterShell64.exe
4608	MicrosoftEdgeUpdate.exe
2372	MicrosoftEdgeUpdate.exe
1868	MicrosoftEdgeUpdate.exe
1000	MicrosoftEdgeUpdate.exe
1512	MicrosoftEdgeUpdate.exe
2956	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 64 IoCs

Processes:

elevation_service.exeMicrosoftEdgeUpdateSetup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\msedgerecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\recovery-component-inner.crx	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_is.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\msedgerecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdate.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_el.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_et.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_lt.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_es.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_it.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_or.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ko.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_th.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_km.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\psuser.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\psuser_arm64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_id.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABD63202-F52F-4225-9C85-19DD88589B66}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABD63202-F52F-4225-9C85-19DD88589B66}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.151.27\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.151.27\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B532B342-0E34-448B-9EDF-1D55C04041F8}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
1560	msedge.exe
1560	msedge.exe
1860	msedge.exe
1860	msedge.exe
1780	identity_helper.exe
1780	identity_helper.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
3452	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdate.exe
1000	MicrosoftEdgeUpdate.exe
1000	MicrosoftEdgeUpdate.exe
2956	MicrosoftEdgeUpdate.exe
2956	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

svchost.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	pid	process
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeTcbPrivilege	4528	svchost.exe
Token: SeDebugPrivilege	3452	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3452	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1000	MicrosoftEdgeUpdate.exe
Token: 33	1868	MicrosoftEdgeUpdate.exe
Token: SeIncBasePriorityPrivilege	1868	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2956	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msedge.exe

pid process

1860 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exemsedge.exe

description	pid	process	target process
PID 3164 wrote to memory of 1860	3164	cmd.exe	msedge.exe
PID 3164 wrote to memory of 1860	3164	cmd.exe	msedge.exe
PID 1860 wrote to memory of 2608	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2608	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1464	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1560	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 1560	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe
PID 1860 wrote to memory of 2860	1860	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\88480 549d1468444 d81858d905 76369d92 864489d4 699165 3d8601 387d0 8548586 d66880 d780915d63 6d465 20d84680d847 443.pdf"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\88480 549d1468444 d81858d905 76369d92 864489d4 699165 3d8601 387d0 8548586 d66880 d780915d63 6d465 20d84680d847 443.pdf
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffd418746f8,0x7ffd41874708,0x7ffd41874718
3⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
3⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2020 /prefetch:8
3⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
3⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
3⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
3⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5064 /prefetch:6
3⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
3⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
3⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
3⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
3⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
3⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
3⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
3⤵
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=216 /prefetch:1
3⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
3⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
3⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:8
3⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
3⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:8
3⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
3⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3860 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2740958711339742718,17726715225177451925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3496 /prefetch:8
3⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:4260

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\msedgerecovery.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.62 --sessionid={f5c29d33-4e5b-48ec-b506-911bae0fd008} --system
2⤵
- Executes dropped EXE
PID:2796

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2920

C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
5⤵
- Loads dropped DLL
- Modifies registry class
PID:1160

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
5⤵
- Loads dropped DLL
- Modifies registry class
PID:4608

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1472

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4408

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4548

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTEuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEUyMzBFNTAtM0U1OS00Qjc4LTlENkItOUU4OTJBRkExNzNDfSIgdXNlcmlkPSJ7NkYyRUEwQjItRjM0MS00Q0YzLTkxNTQtRjlCMDhGNjUwMzZFfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0EyQUI5RUZCLTI3M0MtNENCMS05QjUwLTRENkFEOEU5MjVCOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjAiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuMTAwIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE1MS4yNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMDQ4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
3⤵
- Loads dropped DLL
PID:1512

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Loads dropped DLL
PID:2372

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe
MD5
4488f766299c7fefe2a7038e3d0b7e6a

SHA1
04ec94e21ff2c4eb6c144f6c6241642c05f182b3

SHA256
8874fb15d446396d1740a3ed90a4643de9ba982d6fdfd61282d75e81efcc415b

SHA512
4a70adc8cfbef86745a7061bba71fb75fac0741db64bc27207e4b3d1855fbba710d024018bd31a31e01135efe425271bdd6be71261242b43df0b8e0e0fcf96d3

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\MicrosoftEdgeUpdateSetup.exe
MD5
4488f766299c7fefe2a7038e3d0b7e6a

SHA1
04ec94e21ff2c4eb6c144f6c6241642c05f182b3

SHA256
8874fb15d446396d1740a3ed90a4643de9ba982d6fdfd61282d75e81efcc415b

SHA512
4a70adc8cfbef86745a7061bba71fb75fac0741db64bc27207e4b3d1855fbba710d024018bd31a31e01135efe425271bdd6be71261242b43df0b8e0e0fcf96d3

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4260_917844406\msedgerecovery.exe
MD5
6de69804e275844266117f3f3016af57

SHA1
684e1f5f5d2d9c49c491ca2f6e5dd86e4489c812

SHA256
70928f78c5c52c98ff43f66b6d3b0ee0cb0e0460f0799007c970857539d5ba1c

SHA512
f172c0cd760c17dd04f7b08a90ad921f92e600e21f1aeb25f4338905f829a6a1077bde92b5183d7adf56b48ef772e05a1262498038e1fd5b9682afd18e42e9d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\EdgeUpdate.dat
MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeComRegisterShellARM64.exe
MD5
e7ddb7d2103fd518652eca1328f21510

SHA1
36bf5749f398a586ec1481cc42a3a6f5deb3754b

SHA256
8666d49f5af22615eacbb8b389098c2e7276e6040c937aba970a1dd46fefa7d5

SHA512
66c44138de7053a38ed25a01d5c03b08b2d91b2845b54efe6e0be79f843fbd07a81aa0796965e8de027cfb3f9ba362fd34694535f5a72d8c0dd56ea5488b97f7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdate.exe
MD5
3c2ec71dbec0629c92ee081fa5523190

SHA1
c34429bccfa61fc4d2bfc7be42227017fcefd4a9

SHA256
d357502511352995e9523c746131f8ed38457c38a77381c03dda1a1968abce42

SHA512
2a50c2c3b1391b0450cea7dd02b96046fed3e5467cc0e317b4950514fff46ed07a64fd48a917ebc1d86247f30d274bab9efafed2d4e05fc485d55e9c254bd448

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdate.exe
MD5
3c2ec71dbec0629c92ee081fa5523190

SHA1
c34429bccfa61fc4d2bfc7be42227017fcefd4a9

SHA256
d357502511352995e9523c746131f8ed38457c38a77381c03dda1a1968abce42

SHA512
2a50c2c3b1391b0450cea7dd02b96046fed3e5467cc0e317b4950514fff46ed07a64fd48a917ebc1d86247f30d274bab9efafed2d4e05fc485d55e9c254bd448

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
MD5
9db970fa6963695477e8a3691c5d9940

SHA1
e5b57ead1f5d0fbc3185a3761103e55b69ca03d0

SHA256
d5d69fb701c077892a587f3ecbb1010ec0846f5046b05a653a7994154420c328

SHA512
fdfabf237fbb833f76c9968e99e887a6bc732b9be13bdb3723c472251b11faacc16eb73377ee5b532d2e6faa03e103106120d80b2d4ac0cc843c4c9951b310b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\MicrosoftEdgeUpdateCore.exe
MD5
b6a524d1abeb4868b67e780ea6c2e267

SHA1
fbe541805bc0922f0a1c1eb9f09125a7f38a32a9

SHA256
113d781452ea8d2632d50a6c64c4b1728d8d158964c0ea99e6e0b23cc9861d89

SHA512
6a8df76159c0ed181e35084d75cf2edc36a0e16f93c1115d6c455b544cb2b409a447ecd1e7ae976cb2518a9cc1298df25d8ad946d4a2b89c1b3ee4b9f035c8ad

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\NOTICE.TXT
MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdate.dll
MD5
93d198acff9bb99fd6dd2f0b972a4172

SHA1
a1667b10a8536b773d0c0fc9dae19f0320f95336

SHA256
a88a49608b123e5241c4ebe8d69dfda70c0b3d87640c4d4a565c99b8ec00aa12

SHA512
b3e5fcbad61f038848dda8cbfc40664285aabce4fcbc0ede274a9d1296216a4ab3b6a3ead902f204dbeadf7d6cfabf56f50f277e18f47b399217087996c140eb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdate.dll
MD5
93d198acff9bb99fd6dd2f0b972a4172

SHA1
a1667b10a8536b773d0c0fc9dae19f0320f95336

SHA256
a88a49608b123e5241c4ebe8d69dfda70c0b3d87640c4d4a565c99b8ec00aa12

SHA512
b3e5fcbad61f038848dda8cbfc40664285aabce4fcbc0ede274a9d1296216a4ab3b6a3ead902f204dbeadf7d6cfabf56f50f277e18f47b399217087996c140eb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_af.dll
MD5
51e0f6293052a9ed32eebadb0e78dba2

SHA1
b6f109d95760e6a8da19f760b54e35316d50db47

SHA256
65f20a53718c547b675f0ebd8ce406ae2dcbe242f50fbb631e0d052befaa1a87

SHA512
d4ca2fa4b832537d9dcdb6358aee50824085c4327957cfe6465e5af7ddc8245158959ecd6b7767686033c799df4deca06716d8bfdfb55d297436cf65769d1161

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_am.dll
MD5
a6c941f474e1c7266ab500cc932ad294

SHA1
cfff3bcf205666ca3b17b65d82a7aed01888af6c

SHA256
5ad20f36db95fabbb0f8c62b94bbd532db8083e0f380191180613bd2579a5481

SHA512
a7b36bef2929df59999a9fb32a0a2cd8982d90e552ceb29730ed544ba0009192659b360d02181a894943571030b5e0f7ee63b3449be489527718de318a1eaaca

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ar.dll
MD5
ad19703ff751e308a0e64e5aa88e018d

SHA1
aec05b96d8a10a2d6f3b09691b1f2512af92948d

SHA256
13a26667a4fd42a7d9fe3b61fa5ddf959d93642b051a8ad43ef87d38619cdc82

SHA512
56f7599ec7ac2db9b6d8e7c632f1327caa97395c18f436052e7482fa9d12d65c14f84dfb9e6052529a133e36201cb76ee5cab37da5ad1bb8def1abbf885f3c5f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_as.dll
MD5
57147d7160d98f0e550abbe56f09e12e

SHA1
8463be34d9a2852f57ff18763d8ef7d2c070e544

SHA256
1ba80418686eea5fc7ece5d0d4f0dd4bcdda9df6abf5bf0e8bd941ee2972ac7b

SHA512
f1020a91b43c40eebd8f6f61dcba9588c6b4966bc5bd50fa806f3a0c55ec6f9921f44bf36915fcec541df540f40f2e6f3c073a9f1fc2b603db590887cf8b2dc9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_az.dll
MD5
033e5cfa0a2627efca17f13824ad5092

SHA1
9f7357fd9a06f4e59cbeb4492bbed4d364789e9f

SHA256
de0b777c86d95dc5e9d0614ac8a5dc1b559791a2fe11385d3758e6f7021d5cb4

SHA512
453508c01d40a9c6a7c4359ec991f94201be1090f663828f1f4b962734852c6ea761a75fa590669436ec0d74025d1654ec0d4dfa116d0a2f8680d54c6efb6662

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bg.dll
MD5
b5c174c65533a224015e940453ebf7bd

SHA1
e812e228587a9c8eb7ec7e5d838da264fbd3eb9a

SHA256
f9b9730b97f160b22bb9e5f96c2fe623e4cd1ec8d58b36c05e62b92b6eed29e6

SHA512
0ca1668e224130c9b9638c979d1e833ff3e4452d9007f1748d4d126a0dd99d829e8dd46dcd0606f5202534e8e483d3af5f5b300d92063a8294338f2264c58ead

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bn-IN.dll
MD5
03159478c2c5416cd03b90fdbb85f60b

SHA1
3015e5b79be506516f05366c36e885fa15675bc0

SHA256
ae58ce60a6171b2fbee56f58bfe6e38f5efe568af13355b1d3f6b6c66e5b7906

SHA512
38071382f91847641e19ed957e695f45b6b76fa4b91d90db1251dae00df07d6757a6e382098ec8afb35f04fd01c8dcbd661bf0b7a1bea1054b24fbc29a29cf6c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bn.dll
MD5
ceb156024e4c9b36bc3e217201fc2322

SHA1
e126d7953d5c49b724617e1f8b81edb64a769dfc

SHA256
ff10d60ec3ff0cd35ce090823bcb2fdd18c825d7ee6ce17655431739e219c17e

SHA512
dc74407f6b2f237479d6fde428be3fa72be3e2efe4d8dfb8e5430c119deb39ea0c9d63cde654376e7a190be0a220eaab3343df76a01059316b5b6c444479abf9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_bs.dll
MD5
32018e13551cc7fabff9b9d281d3bea8

SHA1
49796fd79c9c76e45358f21d8f9fabbb81f928db

SHA256
6eab69d9cf28d403706e0dced218b3bfdce328cfed3103812388734bae98c693

SHA512
e960f0eeb0cbd3393b575b91c953ed5bd8c9146aa8b8aa113605d646e48b4c4ba4faa8987889fc72dc2d786c8c4200867689c1cd8867c3f3dd9a249537ddae4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
MD5
37eb7b29ec5007edf219acb6779d791e

SHA1
4097b0b293e2e5c8908b8baa7bc41128ad4abaed

SHA256
e9b2d242cef0bf2f10824e9435eaa9cbe196c88c6692c0707bcb532580dafa8f

SHA512
e9a8a52b7e52e85468edc9503bc1970585c178bcf8c29c662b17bed4d4399ac0b756a67c926b79f2a409f91de3067fb39a4e7f36efd5fa7ea720b841f3d50371

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ca.dll
MD5
13de822ff2627018bdb4c30c14463dcd

SHA1
9e09b285785ec4ccd6b307176212edba410b128a

SHA256
9871893788cb63a024923941c1ad02da611e27328745eab33f73b42d62c9eaa8

SHA512
e4e0d039f6250fd0ff78e34103909eaf13c45396900107342dc8b727b03c0e58aedad3deba7958f282e74e1a3ceb840c3cd38edf4ec10a1eabd768c1325b19b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_cs.dll
MD5
dd7622f55ba5a8253f7140ed8619d71c

SHA1
0cc78f6db200f6da0d0c631e36335f9720fe4ae7

SHA256
90eaa4bf9fb360730d5d9567206f0740d77007492725973e4dfd3b934cae13f8

SHA512
aa46fb3b01045f2f04999e66ecbe17e43212287fa08f36e6197240fd4c1686411682d0a915d7d72ba105a350c22dd7b0e2690fded93742d027efe9bca37709e6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_cy.dll
MD5
7fa587fc34b1f4ccff8687202d5ceda8

SHA1
45a5c0ea96d729664401facb37bde3d764158c5e

SHA256
8dddfa9c3cb4a5f6d756b80c254e2c260cc902bc029e01708bb0828abb7ca0a6

SHA512
137d520fbeb25c8dae9717c2ec4ddff1a070af074d7586afbdaa8c069f62aeae1157cc8e1b08ba40db4729314e3beb0e6fb601f017ea7e8f885a948dfa454b03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_da.dll
MD5
d02196748b8425bc2c8140f4e83a78d2

SHA1
0969bb02aae0ef1af7f96aba45f3941d088f9eb7

SHA256
2dfbb4caa84b3be64aa909d4cf63ff4efa02695d6a378e358943c623dbf2a178

SHA512
53df9dac034f7a2713b7030236c9d123f4ff2eb0fe8048f5c6902459fa812572b41b7f6c01c565cd3acb38c44ffaa2ef649dcfed76d4a2ecc6a7b22c3c53da26

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_de.dll
MD5
a8a9599b126dc0e904efd055f7137c6e

SHA1
061824f41d8a4d2f8ef8bef3ef2cf32a443aa326

SHA256
d97203d6a65b7069423228c962639a9b8772588515baf875ff3f4a3f5bc78726

SHA512
e7ad1f5c7e63cf6b3f819b8b690e078d7e7be2a4bc1df6c94132e4c3e46a4cb26b509c0f28a5647a2b1749ead70d3896f4ae4c5378f3542911a97a5842d98a61

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_el.dll
MD5
e14d69cce787e19d164c3f7c0ae61332

SHA1
d19d3856cf7caa2b725e1b83e861e2cd907128c0

SHA256
e8187fea1b82843af60eae0e49ba184e05d36f112024c029fa0125c5d7067a64

SHA512
26d984b35b12fbb416d5b27eeb8784bf5200e2d2ce618c6e2974e1336cab0f62ba82296494027ce3b73e402aa43d9b66abbe19107d74376d3490f012587c1b10

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_en-GB.dll
MD5
06e1502286ac9dc94e223f186df41132

SHA1
946166c0e8e57e17caedf5df17242e91f5772e81

SHA256
1ec5c1132baaf9732b5bc30e6d870d5537e6bf3baf9516f66f4bf0c95c1e8b6e

SHA512
9c5091c95c22d87070c6a750d66feea3e42b51cf474c5ae5566d4321acf64c7ecf37687dcc3eedeeafd568c608778b2b0e06e329ebc77c24997896b755b24ca1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_en.dll
MD5
c97f93ffe9d5e3e5bbc04b168650cd00

SHA1
fb035621aed66c60271df3111eecec2d178a021c

SHA256
6c9f604468d01e0db22903555ce58fba91b3bc1168057bc3cb0d056c4c785ba9

SHA512
b6c86093fb142af4c47b478920106eae03552ada516429bbdb249e51b4caa8a7ed49c741c8bd469c853a2e36f99b5c6a79a7414e7a7848d6027351216d6b7f27

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_es-419.dll
MD5
4bcd1fee36fe6a0cdaaada40907c3d8b

SHA1
51eb3487585e51c3c263089bad695e0922264a79

SHA256
a9b4c3aa17f41e577f3d8f47e7b1b0eb57e83a67e14f3b9796a6224f0bf13a9e

SHA512
f1ce2504c051301c361ba081b41b655e2a9f6add8152f5e93867dde1d2974c7723475b935ebe815c0bfcb97b9cbcb783e9c1141786a1445e8ec44bcce2e215cc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_es.dll
MD5
f3cad4dc9b85dfadd1a2f7f23f6a115a

SHA1
e6326bae48881a877b2ea0e7abad5ea8833b8aee

SHA256
cd0b3d6c02257f25cac07adbc2e04745afa7677e1546de60e445a1e1cde7a2dc

SHA512
e870f2a49e8f33ec90cbffd783c6bdeb8259afd0bd6851bb94f471c900e6f67e12e1da16d549564da15d65e7c517bac0f983ee3395770dc7f57a31158980bff4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_et.dll
MD5
5179538542bf7b9d09fed7c6ce5f36b6

SHA1
485a7ba019a79c9edf5170c66f20093a8e244054

SHA256
46a9baf759ff770d2abf7fd7f2dda8b1f3336f3dc477889a93b25a12e839d9d2

SHA512
0b60f7c21b9421c52caa00052d1c2c3c0b4bbdb2ece783e4c9dc4b288e56c21452040ab6f0e2a024e73f6fffd4bf0c5b348975bb73e197220082e4eaf55505ef

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_eu.dll
MD5
b2a5bfeb8421a42a6d4e4bbe0af1ff9d

SHA1
2949dacb397f669812acbd2a44d45b6fd87de110

SHA256
e9be16e58573ad3a66eac5330eeabde2e6b07d47862a78b4a4552cb04570488c

SHA512
a89ba89ce32116fd085bd11a2c5d164e6c37e5519a8547481eaa8e1b75837920831abe2f86b6454821c133f1a7d8c1ef3d0b7cacbcfb0570d88affdeea35c81b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fa.dll
MD5
a6e0e94a5118406a49967eff69e5f95e

SHA1
cb97b85f6c45cb1635a05e2ae678861758ffb5dd

SHA256
3757d9f64dc9050b4b4a880be38c563202f5d4e9d4bf5c6209abfd4392aba906

SHA512
11d5d98ee13b6c9da1d69b6958adfd3b078e6e4c887b056e33c59893be044ebe6fe74b3367959cc8248c2067ba54220e4333f63942da78f9cd0eef56da5222de

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fi.dll
MD5
5bcd5010264333cbfb0005678db9079c

SHA1
67049ceaee6f1021cd4cd7b2886c92aac5d6b047

SHA256
3e1325f1f1f95d9fffc554d656720e19499ad8f658b1ebbfd4e4d1623639a6fc

SHA512
f32a204d75683bf6a26a60e0ea41db3048dcbeb868955adde28b16786b6be8a91587cc8432a8d5a2de70b151d954543f0477fb56b26be5f0efbe25dff89fcbd5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fil.dll
MD5
10bcbf6c7efd39b40c4d7819103f83d3

SHA1
dc870a07ab956e2bd519424553373e53dd50ff6c

SHA256
36ee1d98a48726048f1db8a34a474bd595d42836ef3c9f45ad8fc7876f6f5782

SHA512
cd4cafc77ba66912d3fd46fecc2eed59f4b19de1564c42948d01e0e8a5d1150f71d59827179eedcbe12cf4308fb13023eba30f1590cb70dbdf4df29eb9e495ed

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fr-CA.dll
MD5
f443e9d9a090641a0108f2bac5f00332

SHA1
6e8efd1f83dc26490920f0135f36f2e91df08c8b

SHA256
ec194ff30119639d586d6bed4a57fa16cc7d1024f09313c55f54311f123bcb88

SHA512
892323d6497ab36a049f59e49de8c23e5ce880aca811c3423621585838bbdb64c0e95f62f22d9353ad3efc84383be52eab2797b8067fba66689763d0a9287f63

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_fr.dll
MD5
d60d8b7d2861cb74672a085694c4a080

SHA1
c4be46de53e224e53db055d17b3393edecdaa7bb

SHA256
ccdda5523459637f0d7b8766fd282b70c2849185dff5935dc2dce1cac89b0e80

SHA512
6836a47ab09acfbd526d0dedd46c16b7879138d2511afdb8321c615d122f3a7c51997fab1cb9407cc6ac6ad19862e25035b133f30e0e74cff50e7a0ea4b3baa3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUC758.tmp\msedgeupdateres_ga.dll
MD5
13eb51cc09c9f16c2744daee640a5cbd

SHA1
eee30a7fd1fccf3dbae9c1dfa6d77122cb05536c

SHA256
9ccb338c76156396388f1bdcdd8ab56dddd3e7d0c9e58ad0d36f749a3edb6ec8

SHA512
6fe703743bc6db042561a9d84a4dc3219fbcf4b362808979adf8e89bac7a89ba39d5d4e72137dc74ac7406a89a057001b2cfe84715a5e26a7790353c56acf748

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
MD5
88b99c7409b7fb0d4328ec75ec1d05da

SHA1
7665927c98d6df5cca9e4b76f46c591e54bd501a

SHA256
b10da482bc2d45d50565b8e63219ec20871a5c750507a5a9a568785c4e68e15f

SHA512
5116b04e51479ec7168f5559baf1272eceeba1b75aee5a724150fefe111dd4892b05b6953e37c2767dcbfb82501fbebd1ad05e2c5236f561aeaa70858af2d300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.151.27\recovery-component-inner.crx
MD5
b62629cb2f8f2566e417f8869373caab

SHA1
d4b3aeeda75d7ba557d646d3100dc30a9be13b1c

SHA256
e82878d45ab7120e9f58eabc9be08f7e25e34ed9a4728288d9275952416ad48e

SHA512
192d578f2ea77a63e784834c8af63818ae465312e60c7d7614204a3200b1f013454e66c512d73c331de74718d6f4bce13e727d3d167ee49fbb977cad964a66ad

Download Submit
\??\pipe\LOCAL\crashpad_1860_ZODTWDESEQCSABLL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1000-347-0x0000000000000000-mapping.dmp

Download
memory/1160-341-0x0000000000000000-mapping.dmp

Download
memory/1204-220-0x0000000000000000-mapping.dmp

Download
memory/1204-225-0x0000019EE5D80000-0x0000019EE5D82000-memory.dmp

Filesize
8KB

Download
memory/1204-224-0x0000019EE5D80000-0x0000019EE5D82000-memory.dmp

Filesize
8KB

Download
memory/1464-161-0x00000246541F0000-0x00000246541F2000-memory.dmp

Filesize
8KB

Download
memory/1464-159-0x00000246541F0000-0x00000246541F2000-memory.dmp

Filesize
8KB

Download
memory/1464-156-0x00000246541F0000-0x00000246541F2000-memory.dmp

Filesize
8KB

Download
memory/1464-162-0x00000246541F0000-0x00000246541F2000-memory.dmp

Filesize
8KB

Download
memory/1464-163-0x00000246541F0000-0x00000246541F2000-memory.dmp

Filesize
8KB

Download
memory/1464-155-0x00007FFD61620000-0x00007FFD61621000-memory.dmp

Filesize
4KB

Download
memory/1464-153-0x0000000000000000-mapping.dmp

Download
memory/1464-152-0x000002465408B000-0x000002465408C000-memory.dmp

Filesize
4KB

Download
memory/1472-343-0x0000000000000000-mapping.dmp

Download
memory/1512-348-0x0000000000000000-mapping.dmp

Download
memory/1560-158-0x0000022655B80000-0x0000022655B82000-memory.dmp

Filesize
8KB

Download
memory/1560-157-0x0000022655B80000-0x0000022655B82000-memory.dmp

Filesize
8KB

Download
memory/1560-154-0x0000000000000000-mapping.dmp

Download
memory/1780-197-0x000001C29EA10000-0x000001C29EA12000-memory.dmp

Filesize
8KB

Download
memory/1780-195-0x0000000000000000-mapping.dmp

Download
memory/1780-196-0x000001C29EA10000-0x000001C29EA12000-memory.dmp

Filesize
8KB

Download
memory/1860-147-0x0000023FD15F0000-0x0000023FD15F2000-memory.dmp

Filesize
8KB

Download
memory/1860-148-0x0000023FD15F0000-0x0000023FD15F2000-memory.dmp

Filesize
8KB

Download
memory/1860-146-0x0000000000000000-mapping.dmp

Download
memory/1868-346-0x0000000000000000-mapping.dmp

Download
memory/1976-274-0x0000000000000000-mapping.dmp

Download
memory/2072-199-0x0000000000000000-mapping.dmp

Download
memory/2072-211-0x0000023313360000-0x0000023313362000-memory.dmp

Filesize
8KB

Download
memory/2072-210-0x0000023313360000-0x0000023313362000-memory.dmp

Filesize
8KB

Download
memory/2072-203-0x0000023313360000-0x0000023313362000-memory.dmp

Filesize
8KB

Download
memory/2072-204-0x0000023313360000-0x0000023313362000-memory.dmp

Filesize
8KB

Download
memory/2184-279-0x0000000000000000-mapping.dmp

Download
memory/2224-206-0x000001FA90920000-0x000001FA90922000-memory.dmp

Filesize
8KB

Download
memory/2224-209-0x000001FA90920000-0x000001FA90922000-memory.dmp

Filesize
8KB

Download
memory/2224-202-0x0000000000000000-mapping.dmp

Download
memory/2224-208-0x000001FA90920000-0x000001FA90922000-memory.dmp

Filesize
8KB

Download
memory/2224-207-0x000001FA90920000-0x000001FA90922000-memory.dmp

Filesize
8KB

Download
memory/2608-149-0x0000000000000000-mapping.dmp

Download
memory/2608-150-0x000002E9CF7F0000-0x000002E9CF7F2000-memory.dmp

Filesize
8KB

Download
memory/2608-151-0x000002E9CF7F0000-0x000002E9CF7F2000-memory.dmp

Filesize
8KB

Download
memory/2796-297-0x0000000000000000-mapping.dmp

Download
memory/2860-164-0x00000121D2E64000-0x00000121D2E65000-memory.dmp

Filesize
4KB

Download
memory/2860-165-0x0000000000000000-mapping.dmp

Download
memory/2860-167-0x00000121D3200000-0x00000121D3202000-memory.dmp

Filesize
8KB

Download
memory/2860-168-0x00000121D3200000-0x00000121D3202000-memory.dmp

Filesize
8KB

Download
memory/2888-262-0x0000000000000000-mapping.dmp

Download
memory/2920-299-0x0000000000000000-mapping.dmp

Download
memory/2956-349-0x0000000000000000-mapping.dmp

Download
memory/3196-234-0x0000000000000000-mapping.dmp

Download
memory/3320-193-0x000001A395F70000-0x000001A395F72000-memory.dmp

Filesize
8KB

Download
memory/3320-194-0x000001A395F70000-0x000001A395F72000-memory.dmp

Filesize
8KB

Download
memory/3320-191-0x0000000000000000-mapping.dmp

Download
memory/3452-302-0x0000000000000000-mapping.dmp

Download
memory/3716-248-0x0000000000000000-mapping.dmp

Download
memory/4064-283-0x0000000000000000-mapping.dmp

Download
memory/4068-176-0x000001471ABD0000-0x000001471ABD2000-memory.dmp

Filesize
8KB

Download
memory/4068-174-0x000001471ABD0000-0x000001471ABD2000-memory.dmp

Filesize
8KB

Download
memory/4068-188-0x000001471ABD0000-0x000001471ABD2000-memory.dmp

Filesize
8KB

Download
memory/4068-189-0x000001471ABD0000-0x000001471ABD2000-memory.dmp

Filesize
8KB

Download
memory/4068-169-0x000001471AB00000-0x000001471AB01000-memory.dmp

Filesize
4KB

Download
memory/4068-170-0x0000000000000000-mapping.dmp

Download
memory/4184-222-0x0000000000000000-mapping.dmp

Download
memory/4264-187-0x000002578E9C0000-0x000002578E9C2000-memory.dmp

Filesize
8KB

Download
memory/4264-181-0x000002578E8F3000-0x000002578E8F4000-memory.dmp

Filesize
4KB

Download
memory/4264-182-0x0000000000000000-mapping.dmp

Download
memory/4264-184-0x000002578E9C0000-0x000002578E9C2000-memory.dmp

Filesize
8KB

Download
memory/4264-185-0x000002578E9C0000-0x000002578E9C2000-memory.dmp

Filesize
8KB

Download
memory/4264-186-0x000002578E9C0000-0x000002578E9C2000-memory.dmp

Filesize
8KB

Download
memory/4268-290-0x0000000000000000-mapping.dmp

Download
memory/4312-267-0x0000000000000000-mapping.dmp

Download
memory/4384-218-0x000001986C3F0000-0x000001986C3F2000-memory.dmp

Filesize
8KB

Download
memory/4384-217-0x000001986C3F0000-0x000001986C3F2000-memory.dmp

Filesize
8KB

Download
memory/4384-216-0x000001986C3F0000-0x000001986C3F2000-memory.dmp

Filesize
8KB

Download
memory/4384-215-0x000001986C3F0000-0x000001986C3F2000-memory.dmp

Filesize
8KB

Download
memory/4384-213-0x0000000000000000-mapping.dmp

Download
memory/4408-344-0x0000000000000000-mapping.dmp

Download
memory/4500-253-0x0000000000000000-mapping.dmp

Download
memory/4504-180-0x000001CE167E0000-0x000001CE167E2000-memory.dmp

Filesize
8KB

Download
memory/4504-177-0x000001CE167E0000-0x000001CE167E2000-memory.dmp

Filesize
8KB

Download
memory/4504-173-0x0000000000000000-mapping.dmp

Download
memory/4504-178-0x000001CE167E0000-0x000001CE167E2000-memory.dmp

Filesize
8KB

Download
memory/4504-179-0x000001CE167E0000-0x000001CE167E2000-memory.dmp

Filesize
8KB

Download
memory/4548-345-0x0000000000000000-mapping.dmp

Download
memory/4608-342-0x0000000000000000-mapping.dmp

Download
memory/4624-241-0x0000000000000000-mapping.dmp

Download