Analysis
-
max time kernel
1796s -
max time network
1738s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-06-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
Resource
win10v2004-20220414-en
General
-
Target
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
-
Size
206KB
-
MD5
f08c3b7ace25f1ce76bebd3429762ef8
-
SHA1
8a6585bafa9ed8341051c062b149242b727fd8b0
-
SHA256
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30
-
SHA512
aff55b078294628e4b992a423ce80b32c288eca28b160d4e6e23f6dd01cb2d48c26a8a45db9d8a14e21a73506d7e1b1cafdbe072192193181de38be62acb4dc6
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Downloads MZ/PE file
-
Executes dropped EXE 27 IoCs
Processes:
msedgerecovery.exeMicrosoftEdgeUpdateSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.163.19.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_103.0.1264.37.exesetup.exesetup.exeMicrosoftEdgeUpdate.exepid process 3716 msedgerecovery.exe 2800 MicrosoftEdgeUpdateSetup.exe 4792 MicrosoftEdgeUpdate.exe 4292 MicrosoftEdgeUpdate.exe 4020 MicrosoftEdgeUpdate.exe 4508 MicrosoftEdgeUpdateComRegisterShell64.exe 2020 MicrosoftEdgeUpdateComRegisterShell64.exe 2624 MicrosoftEdgeUpdateComRegisterShell64.exe 2864 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 4284 MicrosoftEdgeUpdate.exe 2616 MicrosoftEdgeUpdate.exe 3108 MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe 4908 MicrosoftEdgeUpdate.exe 1880 MicrosoftEdgeUpdate.exe 4976 MicrosoftEdgeUpdate.exe 1996 MicrosoftEdgeUpdate.exe 1752 MicrosoftEdgeUpdateComRegisterShell64.exe 4056 MicrosoftEdgeUpdateComRegisterShell64.exe 984 MicrosoftEdgeUpdateComRegisterShell64.exe 4456 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 3476 MicrosoftEdgeUpdate.exe 1748 MicrosoftEdge_X64_103.0.1264.37.exe 1612 setup.exe 3244 setup.exe 4724 MicrosoftEdgeUpdate.exe -
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\FormatRequest.tiff c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe File opened for modification \??\c:\Users\Admin\Pictures\ExportInstall.tiff c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\notification_helper.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\notification_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\BHO\\ie_to_edge_bho_64.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Loads dropped DLL 32 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe 4792 MicrosoftEdgeUpdate.exe 4292 MicrosoftEdgeUpdate.exe 4020 MicrosoftEdgeUpdate.exe 4508 MicrosoftEdgeUpdateComRegisterShell64.exe 4020 MicrosoftEdgeUpdate.exe 2020 MicrosoftEdgeUpdateComRegisterShell64.exe 4020 MicrosoftEdgeUpdate.exe 2624 MicrosoftEdgeUpdateComRegisterShell64.exe 4020 MicrosoftEdgeUpdate.exe 2864 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 4284 MicrosoftEdgeUpdate.exe 4284 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 2616 MicrosoftEdgeUpdate.exe 4908 MicrosoftEdgeUpdate.exe 1880 MicrosoftEdgeUpdate.exe 4976 MicrosoftEdgeUpdate.exe 1996 MicrosoftEdgeUpdate.exe 1752 MicrosoftEdgeUpdateComRegisterShell64.exe 1996 MicrosoftEdgeUpdate.exe 4056 MicrosoftEdgeUpdateComRegisterShell64.exe 1996 MicrosoftEdgeUpdate.exe 984 MicrosoftEdgeUpdateComRegisterShell64.exe 1996 MicrosoftEdgeUpdate.exe 4456 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 3476 MicrosoftEdgeUpdate.exe 3476 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 4724 MicrosoftEdgeUpdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msedge.exesetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
setup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe -
Drops file in System32 directory 1 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HOWDO_text.bmp" c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exedescription pid process target process PID 3636 set thread context of 1332 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe -
Drops file in Program Files directory 64 IoCs
Processes:
setup.exeMicrosoftEdgeUpdateSetup_X86_1.3.163.19.exeMicrosoftEdge_X64_103.0.1264.37.exeMicrosoftEdgeUpdateSetup.exeelevation_service.exedescription ioc process File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\msedge.exe.sig setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\resources.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\vccorlib140.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\VisualElements\LogoDev.png setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\EDGEMITMP_F67AE.tmp\SETUP.EX_ MicrosoftEdge_X64_103.0.1264.37.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\fr-CA.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\gu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ar.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ml.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\hi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Installer\msedge_7z.data setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\MLModels\autofill_labeling_features_email.txt setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\fil.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_sr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ta.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\MicrosoftEdgeUpdateCore.exe MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_nb.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\recovery-component-inner.crx elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_helper.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Trust Protection Lists\Sigma\Social setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\fi.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\ka.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\psmachine.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_bn.dll MicrosoftEdgeUpdateSetup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Trust Protection Lists\Sigma\Fingerprinting setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\MEIPreload\manifest.json setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_da.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_or.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\lv.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Trust Protection Lists\Mu\TransparentAdvertisers setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Trust Protection Lists\Sigma\Social setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\BHO\ie_to_edge_bho.dll setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_pt-PT.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_th.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\psuser_arm64.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\fil.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_ja.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\az.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\msedge_proxy.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\hu.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ro.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_sk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\MicrosoftEdgeUpdateOnDemand.exe MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\MLModels\nexturl.ort setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\mr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ka.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\kok.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\or.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\el.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ka.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_bs.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\is.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_lv.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File created C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\msedgeupdateres_ur.dll MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\mr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\edge_feedback\mf_trace.wprp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\es-419.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdate.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_mk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Edge.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\concrt140.dll setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies Control Panel 2 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\WallpaperStyle = "0" c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\TileWallpaper = "0" c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe -
Processes:
setup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\Application setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\PROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine.dll" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\open setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BD46F44-1DCE-4F65-94B8-0BD4BC20D6D7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\Application setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}" MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 4428 msedge.exe 4428 msedge.exe 3796 msedge.exe 3796 msedge.exe 4352 identity_helper.exe 4352 identity_helper.exe 4792 MicrosoftEdgeUpdate.exe 4792 MicrosoftEdgeUpdate.exe 4792 MicrosoftEdgeUpdate.exe 4792 MicrosoftEdgeUpdate.exe 4792 MicrosoftEdgeUpdate.exe 4792 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 4536 MicrosoftEdgeUpdate.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 4284 MicrosoftEdgeUpdate.exe 4284 MicrosoftEdgeUpdate.exe 1880 MicrosoftEdgeUpdate.exe 1880 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 4840 MicrosoftEdgeUpdate.exe 3476 MicrosoftEdgeUpdate.exe 3476 MicrosoftEdgeUpdate.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exepid process 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdate.exedescription pid process Token: SeDebugPrivilege 4792 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4792 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4536 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4284 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 1880 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 4840 MicrosoftEdgeUpdate.exe Token: 33 1612 setup.exe Token: SeIncBasePriorityPrivilege 1612 setup.exe Token: SeDebugPrivilege 3476 MicrosoftEdgeUpdate.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3796 msedge.exe 3796 msedge.exe 3796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exec127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exemsedge.exedescription pid process target process PID 3636 wrote to memory of 1332 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe PID 3636 wrote to memory of 1332 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe PID 3636 wrote to memory of 1332 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe PID 3636 wrote to memory of 1332 3636 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe PID 1332 wrote to memory of 3796 1332 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe msedge.exe PID 1332 wrote to memory of 3796 1332 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe msedge.exe PID 1332 wrote to memory of 3664 1332 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe cmd.exe PID 1332 wrote to memory of 3664 1332 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe cmd.exe PID 1332 wrote to memory of 3664 1332 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe cmd.exe PID 3796 wrote to memory of 3748 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3748 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 3700 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4428 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4428 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe PID 3796 wrote to memory of 4388 3796 msedge.exe msedge.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_HOWDO_text.html3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0xdc,0x100,0x9c,0x104,0x7ffd4d9846f8,0x7ffd4d984708,0x7ffd4d9847184⤵PID:3748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:24⤵PID:3700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:84⤵PID:4388
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:14⤵PID:4272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:14⤵PID:2028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5148 /prefetch:84⤵PID:4056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:84⤵PID:1244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:14⤵PID:528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:14⤵PID:1824
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:84⤵PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵PID:460
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff639f65460,0x7ff639f65470,0x7ff639f654805⤵PID:2016
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 /prefetch:84⤵PID:2032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6004 /prefetch:84⤵PID:3772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3192 /prefetch:84⤵PID:816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 /prefetch:84⤵PID:1792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5284 /prefetch:84⤵PID:2036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:84⤵PID:2916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:84⤵PID:1816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1284 /prefetch:84⤵PID:1456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,11682172061623187272,5095693429535874379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:84⤵PID:4696
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"3⤵PID:3664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3172
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:4776 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\msedgerecovery.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={46b2d332-c0db-478f-bfff-836bd7c30a2e} --system2⤵
- Executes dropped EXE
PID:3716 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\MicrosoftEdgeUpdateSetup.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2800 -
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4292 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4020 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4508 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2020 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2624 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REJCNkMwRUUtODEwRS00QzY0LTlENkEtMjA2RUJBNzlFM0M2fSIgdXNlcmlkPSJ7MURFNzFBQjctMjlDNy00RkNELUJGMzgtODhCOUFEMjMxOTQxfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0REMTEyRjQzLTNFNDUtNDYwQi04N0NBLTY1REVCNDY2NDdBNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNTcuNjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAwMCIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjVDRTMzM0QtMDA0QS00RUFBLThFODItMDBDMUJBQkE2MjRBfSIgdXNlcmlkPSJ7MURFNzFBQjctMjlDNy00RkNELUJGMzgtODhCOUFEMjMxOTQxfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0VDNjlGRkY3LTQ4MDAtNDM4QS04MTNELTI5N0I4MUI5QzMzOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI3NSIgaW5zdGFsbGRhdGU9Ii00IiBpbnN0YWxsZGF0ZXRpbWU9IjE2NDk5NjE4MjkiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E184777A-57ED-48E4-8C4F-15302A63AD01}\MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E184777A-57ED-48E4-8C4F-15302A63AD01}\MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe" /update /sessionid "{F5CE333D-004A-4EAA-8E82-00C1BABA624A}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3108 -
C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUE6A8.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{F5CE333D-004A-4EAA-8E82-00C1BABA624A}"3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4976 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1996 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1752 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4056 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:984 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjVDRTMzM0QtMDA0QS00RUFBLThFODItMDBDMUJBQkE2MjRBfSIgdXNlcmlkPSJ7MURFNzFBQjctMjlDNy00RkNELUJGMzgtODhCOUFEMjMxOTQxfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OENBNTA5MjktN0I5OC00RERBLUI1QzUtMzU3MjE4ODlFRUM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE1Ny42MSIgbmV4dHZlcnNpb249IjEuMy4xNjMuMTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMjZSIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE2NTY0NDc4OTYiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NjI1MzY5OTMiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4456 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjVDRTMzM0QtMDA0QS00RUFBLThFODItMDBDMUJBQkE2MjRBfSIgdXNlcmlkPSJ7MURFNzFBQjctMjlDNy00RkNELUJGMzgtODhCOUFEMjMxOTQxfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezE2NzExM0RGLTk5NDctNDIxRC1BMDVGLUMwRURGQkQxNjZBM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNTcuNjEiIG5leHR2ZXJzaW9uPSIxLjMuMTYzLjE5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMjI2UiIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOWQ2ODMyNzQtNDg5My00ZmZlLWJhOTItZmJiMDEzMmVmYzQzP1AxPTE2NTcwNDU1MDMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9bEhFOEN2M0tUQzBSNE1wekpobWJGQkxVaFg3dU5oTSUyYlZJektmOWUxJTJmZ2hyM3oxU0tROTJZU0ZnSUR2dTBBT2hPZlgwMk1lSFolMmZVeFEyS0FxZGFBQVElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOWQ2ODMyNzQtNDg5My00ZmZlLWJhOTItZmJiMDEzMmVmYzQzP1AxPTE2NTcwNDU1MDMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9bEhFOEN2M0tUQzBSNE1wekpobWJGQkxVaFg3dU5oTSUyYlZJektmOWUxJTJmZ2hyM3oxU0tROTJZU0ZnSUR2dTBBT2hPZlgwMk1lSFolMmZVeFEyS0FxZGFBQVElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODMxODU2IiB0b3RhbD0iMTgzMTg1NiIgZG93bmxvYWRfdGltZV9tcz0iNTAwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ijc0IiByZD0iNTU4MyIgcGluZ19mcmVzaG5lc3M9IntBOTJCRDA5NC04RDRFLTQ4QzctODk5OS05RkJDNzcxNzU5OUN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzAwOTIxMzg1NjM3ODIwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ijc0IiBhZD0iLTEiIHJkPSI1NTgzIiBwaW5nX2ZyZXNobmVzcz0ie0E4Q0NBRDg3LTVFN0MtNDg3MC04MTk1LUIzQTUxMkY0OEFFRH0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4908
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\MicrosoftEdge_X64_103.0.1264.37.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\MicrosoftEdge_X64_103.0.1264.37.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1748 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\EDGEMITMP_F67AE.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\EDGEMITMP_F67AE.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\MicrosoftEdge_X64_103.0.1264.37.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1612 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\EDGEMITMP_F67AE.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0495C577-5EA0-4FF6-9DCD-365481CEF6FD}\EDGEMITMP_F67AE.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3244 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEE2MTU4OUYtODM3OS00RjU1LThBQkEtRUI3MEVGMDAzM0JCfSIgdXNlcmlkPSJ7MURFNzFBQjctMjlDNy00RkNELUJGMzgtODhCOUFEMjMxOTQxfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins5MDYxMzNEOC1ENkRGLTQ2RjgtQjlFNi1CRTQyMDgzRUFFNUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTYzLjE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMjI2UiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC4xOCI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNTY1NyIgcGluZ19mcmVzaG5lc3M9IntBRUI4QzY5OS1ERUE1LTQ1QTYtQTEyQS05M0NDNTI4NEZEOUF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTAzLjAuMTI2NC4zNyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzMwMDkyMTM4NTYzNzgyMDAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMTc1NjYyMzcyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMTc1OTc1NTk0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDM0NDI0NDgzMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2RkZDY1YzEyLWI3M2ItNGZhNS1iMGYyLTY3YWNkYzVmZjA0NT9QMT0xNjU3MDQ1ODI5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWZEOGtBd0dNZmR0eEdDbEc3ZXRocjdnJTJiZllaN2dPeEZib3FxSmJ0blFaYSUyYmhqeVR3eUslMmZCOVFxZUZmTlh0RDJKSklaJTJidGdVWmJMcFRTSU55RDRNc1ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDM0NDI0NDgzMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZGRkNjVjMTItYjczYi00ZmE1LWIwZjItNjdhY2RjNWZmMDQ1P1AxPTE2NTcwNDU4MjkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZkQ4a0F3R01mZHR4R0NsRzdldGhyN2clMmJmWVo3Z094RmJvcXFKYnRuUVphJTJiaGp5VHd5SyUyZkI5UXFlRmZOWHREMkpKSVolMmJ0Z1VaYkxwVFNJTnlENE1zUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjEyNDU2MzM4NCIgdG90YWw9IjEyNDU2MzM4NCIgZG93bmxvYWRfdGltZV9tcz0iMTQzMTMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNDQ0MDEwNTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNjA1MTU2MDgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MDgiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTgyODQxNTE0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTE3NCIgZG93bmxvYWRfdGltZV9tcz0iMTY3NjUiIGRvd25sb2FkZWQ9IjEyNDU2MzM4NCIgdG90YWw9IjEyNDU2MzM4NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjIyMTciLz48cGluZyBhY3RpdmU9IjAiIHJkPSI1NjU3IiBwaW5nX2ZyZXNobmVzcz0iezhDNDk4OERFLTg2OTMtNDVCNy04MEIxLTRGRDEzNDRFM0Q3Mn0iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\MicrosoftEdgeUpdateSetup.exeFilesize
1.7MB
MD528c0f6643449ca44ac182524106c1ef1
SHA11172f3442d3135931c0f9cc34f328e1715982704
SHA256e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452
SHA5123e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\MicrosoftEdgeUpdateSetup.exeFilesize
1.7MB
MD528c0f6643449ca44ac182524106c1ef1
SHA11172f3442d3135931c0f9cc34f328e1715982704
SHA256e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452
SHA5123e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4776_1254994338\msedgerecovery.exeFilesize
1.6MB
MD599c95302031a74fb25045dcc84221f82
SHA11da4c7970f008f47f22e9f16f14b08c88d07849e
SHA25658fac72920eabe2ef2aacc12dfe0dbea9a4dc10532706374d4a98034c16b765a
SHA512c951b77cc3e708fb7a36ffe2997eb77852d8652598e11daedab56de7678edbc246f0da69c3446c2b8c4e52f5b005bdfabc0fba568c1e472a32049297f06ff546
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\EdgeUpdate.datFilesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeComRegisterShellARM64.exeFilesize
171KB
MD5b2cfaa142985112fd06e092bd3f04a06
SHA1653d76cdd6f8e0317dd408c5e7aef142a944cd8d
SHA2567f80809d759619369129f12242b171dc672d0dd699ade0d814067c07aaede8d1
SHA512da9730dcdba3a14893e588533d16b526e2c599f0793285eafb6701d1795024981441f8d7259587bacdc7cbf69d56419e67007cbab32fd0e19814c5d2eab84077
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdate.exeFilesize
200KB
MD502e716344c3241e304196b5444ac4e25
SHA1a801213a0bf89b77642f6b1de77a14a6edbc02a6
SHA256d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add
SHA5121dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdate.exeFilesize
200KB
MD502e716344c3241e304196b5444ac4e25
SHA1a801213a0bf89b77642f6b1de77a14a6edbc02a6
SHA256d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add
SHA5121dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeFilesize
204KB
MD50275f8bae9e6800d29f6d326a4dedd41
SHA1c89bca78a22e0a4cac7e8e58a9a58e64c6ab6ec2
SHA2561ff7eb6b43772f6924ca7f5097a1b16f40ffbe11cd79e219c56fa409bf388469
SHA512d2363c926be2793ecb94319f4e79e7196385d80f33744bf5f737f0a2488e1555f5863225a152d05fdccb957b8368fa726253d8f4bd0763389956f035d7430ba1
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\MicrosoftEdgeUpdateCore.exeFilesize
246KB
MD509ec85b85d220fa3832f2387e51b4108
SHA1bcdfab0aefc14e6753397380538f3f521235180e
SHA256ce3e7a87c24d7f55880dbd919711ac8a32e30befa7cd8b1d21bd0037a9016138
SHA5122ddb2fe0c2ac3867d7110d5fc52c673c423853321d3a0d3151e27b5e2c1aeee9d3180000b8e43855577981834f9d6b1c25a4180cbd2b07d4d50c3d656a978a03
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\NOTICE.TXTFilesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdate.dllFilesize
2.5MB
MD568b63876016abd50d706fc52a4a311ce
SHA1f13e486d06218cacf1f3e30c02d6ad27b1f85423
SHA256a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e
SHA5127091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdate.dllFilesize
2.5MB
MD568b63876016abd50d706fc52a4a311ce
SHA1f13e486d06218cacf1f3e30c02d6ad27b1f85423
SHA256a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e
SHA5127091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_af.dllFilesize
28KB
MD553cee9e7b391b77329f6bb511ef3fa76
SHA15ebc0650d070d419e99d8b981d694ceed4bd00c0
SHA256c8fa8e9464ef77b65c671bd62dd0cbd7c7f57105dd5f6dfd067df16b4b2b77dc
SHA5122bbbffa2367723a39083397ef914d4dadc19dbcb5e721cf4b542445a4f82872c826eb9d69de2ad5a85300f37c5883bcedc5087eb18599e9ccab65feffa1043ba
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_am.dllFilesize
24KB
MD57983a34a0d846476b88f1c3d41946e73
SHA10bcfd01e64b5a56da00dd30c50dce884289e3751
SHA256471d5c299f3a1a94413ed271f907df5456b75eecd2097ea28582f13c4f068334
SHA5128cdb16a5deb6de26708389ec5a760f0d45cf8ee382958d6c713444fb04c99efd7d58594036d10a261c92595d4aea7a5dbbbe59441e54fcf06524efa7d5c8b328
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ar.dllFilesize
26KB
MD5d2366075f22f6b547283291a5fd1dcd3
SHA13002063ba12e6bc26eef6b5f3a72c9c4e966dbf4
SHA256ea525aab28041424e06d026e8e31fd8e58b8ed148cdc69a26393bf2f855d90e3
SHA512b5c6cddab52fd7d0e4f3e657220168b4fbf00aa4d899a807978e9b9514065a98008bc3e4b1822f63c25350baf746ff2ba03f78662a4ee3a1ee86f47a0a8d4e7f
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_as.dllFilesize
28KB
MD5e09e9c955952d927388da22e7b167f24
SHA1b91a0c5499b5a7be216ec2531add3cdbfa51ea49
SHA25611f80f94dbb42e5efbcfe47e6f9fd946429b969c614094966d7be23ab206e10b
SHA51273e6bfdcd7b5357246ea2a19d9f45f0ee130f3f8e1c488bbe42246472114e1d220544a215f75a1a521717005ecc47dd2f81a8b16bbae58e1f5687b271c572a3b
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_az.dllFilesize
29KB
MD544ff2e251a8f08c1c82fd1c276856ad9
SHA186f24bb3b1ccb0f17c6ce6da5f0a19d77683c6b0
SHA2567daa97f3bca0bf401bad880f03b1376cfd5dfb305287811eda7f65d9199fb53a
SHA51281dc61e2410ec314cedd744ef81a200764057afb7a038da7cf5b7861cb4960aeed0b7cfb7a10e97b0ee1821c512f013a42634020f86aa0688d17de86762cd494
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_bg.dllFilesize
29KB
MD5c0af898f97a104d6649e6fa9a71acc15
SHA1dc8b5f6865b0d3e168f7ef781c927ed872cefad2
SHA256686289d2c5eb42009dc68019de3fa5c311bc37636fcf428f51c8192062c2c1a5
SHA51225b822fe686fb89fee2eb7d01e2de406142713798da98651606abf4aa68d631d09b654b7ac71df83f6c639800daf7004bf3766b8c8c7468a85978495127159a9
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_bn-IN.dllFilesize
29KB
MD5a51cd3e21d94611a399147f63665ebed
SHA164dd626916343410a547a06fd7b48906f72b78a4
SHA2568a0872efa10942f6dee725092b32d2bd074d798110a3a990ae5b6c8b30c3310b
SHA512214223bf1711fd1a27cde00ba056ae897ff17c195b62e6d140d749e7dfc603584944163158eafc5ef66d523e81096c0791ef78ad36f56ac83336f89f9136e1f5
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_bn.dllFilesize
29KB
MD54cac1f99c27ee7c6720a5612cfeb20ef
SHA1dd27e3358279fca9c14a9f0c161ee093bcadd825
SHA2569008377200f8cc9d3ac62d88baad58cb4554d73d52105c8b304227ae05cc3424
SHA5121769e62033b7576a2413c9bdfd1ab519c48edfa3e14ee62c83491b380fc9ec62a0260fff5cb481cb5aff3f23121baa6265a002fd1825661349261e1686b12b7d
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_bs.dllFilesize
28KB
MD5cf18296527bad3ee720412ae71d12e86
SHA19a45c48e6d39156681282479cfd3d2b60980d159
SHA256658a04651a83851ecb6520ef958a3e1d6cf1dcbf0f1d1eec59f25741b92ed300
SHA5121cc9a53445efeb88e9d8f2b6097e5dc498489edc87b539bc023e556b638d3d476f7f83adb3003b4900d742a7ccd47da21979141f3e07df3d98e52ee7d49d6d8f
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ca-Es-VALENCIA.dllFilesize
29KB
MD5a7d153624a53642437a5fdcfb90cf5ab
SHA1ce20204b8966bbb9f5bfe71b2d8b378cbc39bd58
SHA2566d3daa6c91efa623ac9ebfaa8e59e7f554b528b6887707f80ee91aef68c92de7
SHA51245f04693e4d05afe5bc645b2d129365f87381862c8ecafd821d87f9425796b3f421a079f1405bf9128e4b4c3e0f144626470153f663595ba6bcbfe74cfbcf0c6
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ca.dllFilesize
30KB
MD5faa9b8a39400cd92b4b96a7903b21cdc
SHA10f1a96ba3f8ef4cc5ae8bf347dc9735a7cbc9123
SHA256432f9ed510cf9e74227ea61da17a02568870e501687bb21c115fc2b21d824ff9
SHA512ecd03b669b6aa8cbedfc38b446877b8b25646ceda7954023e004c612d0b7977f303bf27890e792a90afe4babe7503c36fa0f920bed4564c25445b84545f175f2
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_cs.dllFilesize
28KB
MD5ba75b3be4bcbec567eadbc56076432e4
SHA1e17a67a2831aa2e9ab6c7f59052c0b0baf6d3a4e
SHA2561f933c0ab6daee1581a60300c476bdff6865f68b7305fb9b32a737f6d6b8fca1
SHA51261f6e102354a285746848fdfba871137e36e759c292937d8182315e631c0f8d3d163eb1081f7f17000e88c9417defa4fcec416ee8cb6daa930a276751ff4025b
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_cy.dllFilesize
28KB
MD577e5904f1ffb344502a466ae27511f7a
SHA19cee96bd6df0f0984405e8fe95bb720ec9b916c1
SHA256e46aededa1d007bf8fe641d0ddd6abf889bafefcc029c91b59196eb55ba7ee92
SHA5120160e9317645b6ad38b359d7b9c4ec54899052503d1bb5914f4bf7bf90f2c7c521b11e01adfa9910b2b3189189362ed912db34a9824ea464cd18ee0938641cd3
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_da.dllFilesize
28KB
MD5d0c21bcf54df2cd71cb5df9d8aa3aeb3
SHA16c78e1817d9def3d0ed20fdcd201a8ac2afb3af9
SHA256bc56ddc6f0509cacde23da7a6773c7803d38e06eedacc8c63b6c9d87be1c7513
SHA512421b30b84a196c14b659100fe66764af1661a3e1a5cfe7b3eaef781a5e691d725251963f02e6afc4f93692ff42a6a22ade5aecd36b5d1e734ce686a175b7f5bf
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_de.dllFilesize
30KB
MD51ade464c5ead694b76726a094962b85a
SHA122afa85a58e6a4872a92f34fb847fa50dcc59a0e
SHA2568d3ead21598744d6c19ba15812e8a05e95316e5000b04d96863b1b7d7918f564
SHA5120f003bf35b7ca2262789533e0e1f4b20d17f8bce5885f88d79356a745a03e7a85f6868d00e04139be0b0990ed79c7b84e8e135c937d36b641acbb2c608e5a430
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_el.dllFilesize
30KB
MD57947d858efe2c8bdedf1b6ece07f2f0c
SHA13c5bd7afb2872a1c35db316180182b61498647f5
SHA25637f66ca033654488e732710f2928a781834380011da81f6dc61356ea65ff3cd8
SHA512b4416197b5a34a971543a40d5af7de8b5d166dc40b00888f8a12a812472ed5c10172f6f340d8ca022bc6ded6d9e3114c9de6f3ca5df7fd151fa27677a005b6ca
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_en-GB.dllFilesize
27KB
MD5604d7950ad651e06b518e72034a691d5
SHA1ae4bfb658b0ed616dc47d5e9f41611f3b00ab5de
SHA2563d88879839db205fb1428717a85e8610b932e3b6e451e16e176e71850ffc4d88
SHA512df3f11d4686a16e2f8fc95b65d2e97639216fd75d72c4a91c5b1019602937bc177b75e5448961d7efa7341bb6630aab01b5dd41a2c701c88d201d3037d0ccb41
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_en.dllFilesize
27KB
MD5a864d97ab266aba9972155acc2afabc3
SHA1ac3bda7b69af04cc796c24980996de2db7a31dd4
SHA256db2dc77075ef42d4f36b9ab3f11817610464f8538f1264cf0373705af91676f8
SHA512a2f747f9f304fbbbaa1a5d071499925f4524170efbc5a3f9ce0d2e5d38eeee74ee6f18d460689eeb41e988c8d16169e84e44dd906d8989e93808574466eb1ca6
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_es-419.dllFilesize
29KB
MD55549e5687c3a753e186f301cf13ed6f8
SHA1c06ce0554859b534c3fc591a80f1e7a2d25f52f7
SHA2567cc3eaa3160d69b542419a235c64d899b9b4086cd572ae69d701a7b247d1c077
SHA5121866f569cd4b3b796f5b1f160058d9b37907a3b5726139e95953e1cf76a63e0c80f88182c41bf31ccc823c3b13b74cc22fbc639eaa5e8ab469a01deaf94ce6e0
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_es.dllFilesize
28KB
MD5e78bc59cfed1c26cee4d76bad5f80516
SHA12c60386beb9eeb1e00d9400b041c88b8e6ebf293
SHA25660b55896071089fd8e8f31df0f22929909408d67a09e1aeed54376e597683a7f
SHA512e071aedf19275c844c0949980e462d35dd6987c0510b2f5cad5b53d5a75a605342e773e12b4ccba122c5e5d4a1448dc5c804336197eb0e59ec9b39c3983dddcc
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_et.dllFilesize
28KB
MD574169fbf0de252eccbf01e7d5ea3a56d
SHA1902a2405089c99bba5f5438026386ce9416d4f6b
SHA256453aa79b55c137eb3c95738de475b9fc9383ef07923a80f0365f6e53bfc78476
SHA512a8c0864cbc807368959452fc540165d7a67ff5f4e6315dbc1f5230b6a049f33988b991cc65503e6eb92f4f5326ea7c0460969377cbc9efae9f70021efe3b1cde
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_eu.dllFilesize
28KB
MD5bbfc5f09aab008784d415a6de3cf239c
SHA18e0d6d2e6c9363e2edb6e1fc681fe353f0652da2
SHA256cc0f547674915e21c070cf3fab6fb00ee0926790db71b9d37b78e20aad370d24
SHA5126ae45de266fb6b8dd2f946260b6ab2968e9a091cc74a27587453e40e859a8fe0046945f3e582a6eb5afa24deed8d80235ceb57be006a35e3efaac0067ce43124
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fa.dllFilesize
27KB
MD504889ddabdb2373e3384c9211d606e8f
SHA13862aee6bdd9ce36f604aa91ef40c0f8cd3ff30d
SHA256c43d5644b2e241b4867b78e19d103b28a77e3ba5a21ed683a1e67df95c92cbdb
SHA512a74b55913123d63c392a9653930b548dd7e3ac2b5deec4ac26efa92e42573d996b03de27d16b244e0cf8fc2a3c00dd9329956f75225a1c2b0ad9d9dc6f947325
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fi.dllFilesize
28KB
MD5236b8e50cae45f545b8cd39b72c56447
SHA15bcdd006e6699cd7f6e8b3c15e13abc83532457f
SHA256a0ada887431cf3749871e78ee632a026ca837f0716305b470375f7d25fa5e69a
SHA512c9ac74fcab02635e9b98c236bf4cec2a0349f5159f329aee3c4a080fc82e3acfd9c92d5e3489bbab527df48acb65c71abe6aa1fdaf40002bb48bcb3c53738458
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fil.dllFilesize
29KB
MD5e70514683320c06ebe56cb93b6bb8312
SHA11eec4a1f5a1c05dc24a1db2ceac197767dd28b1d
SHA25604e85f77193990dc0a2f6f46347159de7199a89a943508df79e1d5894cd66f13
SHA5123aeed7719137372083d4ea93d0748d66e7174cc38f205e801ef8ece72de87775ea9e4cafffea0bb75f1ed80a9a8b620ae18f3e45485722ee530b51802e0c6fd2
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fr-CA.dllFilesize
30KB
MD5ca8102591eff12328e8415981c690873
SHA131bf4e36faddd93abdf9abd4df4627846696d6fb
SHA256857dbfc185d3b917e8c8db77f6154545c2c970502c08f6d0e09606291a6eb4ca
SHA512eae9a17e6f9ddac303e90b29d0de98228f6338cc2b5e5452ea211a1c696331b38200efe91c8d569e2109bef30baf2b85dedcfcdcab9a159e3453555e9788076e
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_fr.dllFilesize
30KB
MD5bcc5a525c21a765abee63d7e27f5b856
SHA1f04b95f5342c3d0051b27220f51a2f4fe26c7968
SHA25605a04132aef3eb2de8807b0c4926d559f2d169de29c55b1b290ce0438710624b
SHA51296b593b0385fd7a6115197e9ebf39966ac83ed69f40524b5a5d37e10a43d25d7cd320e9b64e75941db3e6efe5c22e0db25d900a573089039fddc219e011f326a
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_ga.dllFilesize
28KB
MD57c8af529514df4e5b0679119c38c76d7
SHA1abfd9b4c8a9f42a891a5dcc0b010e14ca5baecef
SHA2563132a0a8fbf6e6453ee6e702e9a6fb762381f51c047521d149679e87e90cae47
SHA5129de4324b52ca8de158a909114f898b9485b3625fa1ca515123174711f7329ca8db1ce1ad12128729c2fa616dd1fa3f74103052b90429ef19833c062a25304243
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_gd.dllFilesize
30KB
MD56744d58930e8a6feff6c8864f4c2fade
SHA120950eb138278e843722b4d76abce45b79be39ea
SHA256f3d2ef4a2606e662430f4f1370b9201c0d0995bae89cbddb320b48d80dec6359
SHA512589229880266a01d9c36424163747c3346945aed6d1057ac55b4bc234de9f5ece347844658303db02859a47149477eb6ada0209564f2d693f3cb5ca13fa15470
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_gl.dllFilesize
28KB
MD5611de7bffd3fdac3a9235c2a5edb4a4b
SHA1bba11ee77f7b211cd2a545ba4b6b75e8aba0db92
SHA256cbd7bd241306efa0015ac8da0b8131efc46c0e2708f14eb9e3375b5de1259463
SHA51242a205c3ece65b80c4ca26b09876ee377c76f20d5f709dd8c1e4366e17cc9c89ee411752465b413e6eaf8439fc20f0233c8d17add94a040bd6ff061606eac206
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_gu.dllFilesize
28KB
MD5f7fe21fb053273b5c066c98247e37742
SHA18c32ef5bde19194b7f08f6a4991992dec50b3de3
SHA256e0ea5e8b21a6b240e89f6267ef86f358d6a64262f38451eea4728e55d05d5438
SHA512b2951c0347cd2276da3da2c5d02f895324479290e75707d4a3a499c412a4be8d339dc52b4b5416e75f2a5c66fd9e363f490a6391dd6ec150cadd935ebb6d2f2e
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_hi.dllFilesize
28KB
MD5b6d61617811d9e4cc5d0966eb001012e
SHA128460e7a0bfd48ce0b262e477bde36500fafe276
SHA2564f007cdf835ffb101af0fb10ff7a9a267672c5f111af01ed0167ef0b401bab29
SHA512aceec3064b2848128ab18ea2bcb8631d34789e8c12b6df18ee29d18878297ce940e40a09a572734da14345031419d7d5e50c0f085b53c901ec6e1ab695783f96
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_hr.dllFilesize
29KB
MD55af49e7e2dcae87eb3e94d5ab7ec13de
SHA1eebde505c3ca36dd4570c285fc45221d9a2f1b89
SHA2567ebe5be4955f5efe9c16c7c86c33fc52b7ffb79ec78ab656362c49cce52e6e5b
SHA5124daf7795bd4bc8c85f3352acb4b3bacbf9a6ab03432d02929eb8c17008e0c028e7d92bf4ae504d61bc5b6dbf7cd08246db421411fe53a13c5e6249809e9e4622
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_hu.dllFilesize
29KB
MD5f08d89f07d6fca78c885131e2b065685
SHA1bfd4e1527dd7e33732e60e0b2ab2804ea077e104
SHA256a8dd0875938fdf9671dc05da56b6ac5ede2f03a62b05ebce0c3b40293588214c
SHA512ac6f8bd81334fa60c1d136947b9d845823ffd122ef8aaf1a0d8dd8c349a940910298e43530c4cb7c56bb8a4edf02818be7d688147607179d3c87751187f7f29b
-
C:\Program Files (x86)\Microsoft\Temp\EUB75B.tmp\msedgeupdateres_id.dllFilesize
27KB
MD526a6a569fec7eb9face5cdb5d2280819
SHA1cd5d58bf7db0f50253f146edaedf90da94dc7c37
SHA256e36e9d602cf58161c1fb37e3f101c9ff0e42a862b8d5626b7fba68612bd17ef3
SHA512fc21aecb49419a605a6681de05bff5b948ebf14c7f028fb65c00465a77f5e1a9ddec2f5af86154e76d45de75faced65c15c740951f55ddff033e757bc7cc4b0c
-
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logFilesize
3KB
MD5648425fa238c5d500944f4ecde1fc4fb
SHA127e75460e9ccf543d791a129aff7051c58e33103
SHA256818fe28c2450e57ce6d82f601e97875e3f4fa3268e5ed298c2d8f73697d43d14
SHA512788f77feea4b7342143ff21a203bc28392f6083f0110cf4a5d7f5786c4c04ef75bcd289f0c759227cf96175a741b30f3e965a36b140cb78cb10c26ddebe45f73
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.157.61\recovery-component-inner.crxFilesize
2.4MB
MD5f28893c3053a372b69b27fba5719ff9f
SHA173c737a6f1191ab05944ad5075c8fa01a5fbc93e
SHA256f1b2f319099c84789057212d87f3d213a5d7e5a2c08f1b79fac1ffd159bdff85
SHA512105d4c2a9c6d20d4ecc2d890613e1920926e5de9dc016d9e397521d5af20a234b58fe77d281df32891569da9a1d2f1ae62b05d32aeb6590636b9fa097906c416
-
C:\Users\Admin\AppData\Local\Temp\nsd7769.tmp\System.dllFilesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
C:\Users\Admin\Desktop\_HOWDO_text.htmlFilesize
8KB
MD5761effc66d1ac5fe827ca003b61be51b
SHA17b28500017c7611d2a70ad07a61a2b6e8e3bb23c
SHA2566dd98cd83fed553d6f80b4cf497ee53f8ac6ac6b48f186e7bca88ebe9325c39a
SHA512cbc92d6b499be52123b8e4fe611b45e7db11281c3c7bd3fbcfa4f18d0bee615cdf7037cd97edeaacaf1596bb07ac57719027457b379b69ef67554fb97e2e2204
-
\??\pipe\LOCAL\crashpad_3796_PQGAEDOABATMDCADMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/460-159-0x0000000000000000-mapping.dmp
-
memory/528-156-0x0000000000000000-mapping.dmp
-
memory/816-167-0x0000000000000000-mapping.dmp
-
memory/984-236-0x0000000000000000-mapping.dmp
-
memory/1244-154-0x0000000000000000-mapping.dmp
-
memory/1332-138-0x0000000001FA0000-0x0000000001FC7000-memory.dmpFilesize
156KB
-
memory/1332-132-0x0000000000000000-mapping.dmp
-
memory/1332-134-0x00000000001D0000-0x00000000001F7000-memory.dmpFilesize
156KB
-
memory/1332-135-0x0000000001FA0000-0x0000000001FC7000-memory.dmpFilesize
156KB
-
memory/1376-228-0x0000000000000000-mapping.dmp
-
memory/1456-247-0x0000000000000000-mapping.dmp
-
memory/1612-251-0x0000000000000000-mapping.dmp
-
memory/1748-250-0x0000000000000000-mapping.dmp
-
memory/1752-234-0x0000000000000000-mapping.dmp
-
memory/1792-239-0x0000000000000000-mapping.dmp
-
memory/1816-245-0x0000000000000000-mapping.dmp
-
memory/1824-158-0x0000000000000000-mapping.dmp
-
memory/1880-231-0x0000000000000000-mapping.dmp
-
memory/1996-233-0x0000000000000000-mapping.dmp
-
memory/2016-160-0x0000000000000000-mapping.dmp
-
memory/2020-223-0x0000000000000000-mapping.dmp
-
memory/2028-149-0x0000000000000000-mapping.dmp
-
memory/2032-163-0x0000000000000000-mapping.dmp
-
memory/2036-241-0x0000000000000000-mapping.dmp
-
memory/2616-227-0x0000000000000000-mapping.dmp
-
memory/2624-224-0x0000000000000000-mapping.dmp
-
memory/2800-171-0x0000000000000000-mapping.dmp
-
memory/2864-225-0x0000000000000000-mapping.dmp
-
memory/2916-243-0x0000000000000000-mapping.dmp
-
memory/3108-229-0x0000000000000000-mapping.dmp
-
memory/3244-252-0x0000000000000000-mapping.dmp
-
memory/3636-131-0x0000000003010000-0x0000000003037000-memory.dmpFilesize
156KB
-
memory/3636-133-0x0000000003010000-0x0000000003037000-memory.dmpFilesize
156KB
-
memory/3664-137-0x0000000000000000-mapping.dmp
-
memory/3700-141-0x0000000000000000-mapping.dmp
-
memory/3716-169-0x0000000000000000-mapping.dmp
-
memory/3748-139-0x0000000000000000-mapping.dmp
-
memory/3772-165-0x0000000000000000-mapping.dmp
-
memory/3796-136-0x0000000000000000-mapping.dmp
-
memory/4020-221-0x0000000000000000-mapping.dmp
-
memory/4056-152-0x0000000000000000-mapping.dmp
-
memory/4056-235-0x0000000000000000-mapping.dmp
-
memory/4272-147-0x0000000000000000-mapping.dmp
-
memory/4292-220-0x0000000000000000-mapping.dmp
-
memory/4352-161-0x0000000000000000-mapping.dmp
-
memory/4388-144-0x0000000000000000-mapping.dmp
-
memory/4428-142-0x0000000000000000-mapping.dmp
-
memory/4456-237-0x0000000000000000-mapping.dmp
-
memory/4508-222-0x0000000000000000-mapping.dmp
-
memory/4536-226-0x0000000000000000-mapping.dmp
-
memory/4696-249-0x0000000000000000-mapping.dmp
-
memory/4724-253-0x0000000000000000-mapping.dmp
-
memory/4792-174-0x0000000000000000-mapping.dmp
-
memory/4908-230-0x0000000000000000-mapping.dmp
-
memory/4976-232-0x0000000000000000-mapping.dmp