locky | 0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537

Analysis

max time kernel
1781s
max time network
1749s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-06-2022 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Size

249KB
MD5

1cc0cca4d5d49aba352f4cc93aed3f6f
SHA1

e7db8694074d1a2c7ac097eff4c085debe389d73
SHA256

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
SHA512

fa127310e53e2bb80f6ea27574e2a28eddd180df0ce00fe49d53f4ba508550f5100943a4db8ac1a786468acada99fe0b1476b73417d8fa4d0349eb62a390a29e

Score

10^/10

locky adware discovery persistence ransomware stealer suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
Downloads MZ/PE file

Executes dropped EXE 27 IoCs

Processes:

msedgerecovery.exeMicrosoftEdgeUpdateSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.163.19.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_103.0.1264.37.exesetup.exesetup.exeMicrosoftEdgeUpdate.exe

pid	process
1124	msedgerecovery.exe
3184	MicrosoftEdgeUpdateSetup.exe
4356	MicrosoftEdgeUpdate.exe
4272	MicrosoftEdgeUpdate.exe
4236	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdateComRegisterShell64.exe
760	MicrosoftEdgeUpdateComRegisterShell64.exe
2632	MicrosoftEdgeUpdateComRegisterShell64.exe
2952	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4584	MicrosoftEdgeUpdate.exe
1164	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
4364	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
3832	MicrosoftEdgeUpdate.exe
4384	MicrosoftEdgeUpdate.exe
4336	MicrosoftEdgeUpdateComRegisterShell64.exe
528	MicrosoftEdgeUpdateComRegisterShell64.exe
2844	MicrosoftEdgeUpdateComRegisterShell64.exe
2248	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3568	MicrosoftEdgeUpdate.exe
4568	MicrosoftEdge_X64_103.0.1264.37.exe
4276	setup.exe
4604	setup.exe
1404	MicrosoftEdgeUpdate.exe

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\UnblockRepair.tiff	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Loads dropped DLL 32 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
4356	MicrosoftEdgeUpdate.exe
4272	MicrosoftEdgeUpdate.exe
4236	MicrosoftEdgeUpdate.exe
4124	MicrosoftEdgeUpdateComRegisterShell64.exe
4236	MicrosoftEdgeUpdate.exe
760	MicrosoftEdgeUpdateComRegisterShell64.exe
4236	MicrosoftEdgeUpdate.exe
2632	MicrosoftEdgeUpdateComRegisterShell64.exe
4236	MicrosoftEdgeUpdate.exe
2952	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4584	MicrosoftEdgeUpdate.exe
4364	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
3832	MicrosoftEdgeUpdate.exe
4384	MicrosoftEdgeUpdate.exe
4336	MicrosoftEdgeUpdateComRegisterShell64.exe
4384	MicrosoftEdgeUpdate.exe
528	MicrosoftEdgeUpdateComRegisterShell64.exe
4384	MicrosoftEdgeUpdate.exe
2844	MicrosoftEdgeUpdateComRegisterShell64.exe
4384	MicrosoftEdgeUpdate.exe
2248	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3568	MicrosoftEdgeUpdate.exe
3568	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exesetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe

Drops file in System32 directory 1 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_WHAT_is.bmp"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	pid	process	target process
PID 2416 set thread context of 924	2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exeMicrosoftEdgeUpdateSetup.exeMicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\de.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\BHO\ie_to_edge_bho.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\mip_protection_sdk.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ga.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\cy.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\new_delegatedWebFeatures.sccd	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\psuser_arm64.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_es.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_helper.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\msedge_pwa_launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\BHO\ie_to_edge_bho_64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\MLModels\autofill_labeling_features_email.txt	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_af.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\psuser.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\MLModels\autofill_labeling_features.txt	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\psuser.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_km.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_proxy\dev.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\fa.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_da.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\identity_proxy\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\it.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\Notifications\SoftLandingAssetDark.gif	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\de.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\103.0.1264.37\Locales\uk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\103.0.1264.37\WidevineCdm\manifest.json	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\WallpaperStyle = "0"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\TileWallpaper = "0"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\103.0.1264.37\\BHO"	setup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ = "IElevator"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.163.19\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\AppUserModelId = "MSEdge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{475CBF15-C58F-4756-B626-88E2BB50B2FC}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{475CBF15-C58F-4756-B626-88E2BB50B2FC}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win64	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
1260	msedge.exe
1260	msedge.exe
1516	msedge.exe
1516	msedge.exe
4148	identity_helper.exe
4148	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4356	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
4356	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
3644	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3780	MicrosoftEdgeUpdate.exe
3568	MicrosoftEdgeUpdate.exe
3568	MicrosoftEdgeUpdate.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

pid process

2416 0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe

pid	process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdate.exe

description	pid	process
Token: SeDebugPrivilege	4356	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4356	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4276	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4580	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3644	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3780	MicrosoftEdgeUpdate.exe
Token: 33	4276	setup.exe
Token: SeIncBasePriorityPrivilege	4276	setup.exe
Token: SeDebugPrivilege	3568	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

1516 msedge.exe
1516 msedge.exe

pid	process
1516	msedge.exe
1516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exemsedge.exe

description	pid	process	target process
PID 2416 wrote to memory of 924	2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 2416 wrote to memory of 924	2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 2416 wrote to memory of 924	2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 2416 wrote to memory of 924	2416	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 924 wrote to memory of 1516	924	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	msedge.exe
PID 924 wrote to memory of 1516	924	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	msedge.exe
PID 924 wrote to memory of 2028	924	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 924 wrote to memory of 2028	924	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 924 wrote to memory of 2028	924	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 1516 wrote to memory of 2168	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 2168	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 744	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 1260	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 1260	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3040	1516	msedge.exe	msedge.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
"C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
"C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_WHAT_is.html
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f36246f8,0x7ff8f3624708,0x7ff8f3624718
4⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
4⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
4⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
4⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
4⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5180 /prefetch:8
4⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 /prefetch:8
4⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
4⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
4⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
4⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6f4425460,0x7ff6f4425470,0x7ff6f4425480
5⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:8
4⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:8
4⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3220 /prefetch:8
4⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:8
4⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3260 /prefetch:8
4⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:8
4⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3244 /prefetch:8
4⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1276 /prefetch:8
4⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,6001199014958296035,12034840086193450101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
4⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
3⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\msedgerecovery.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={4468cf45-aeee-43d1-a79a-3188d82ed35c} --system
2⤵
- Executes dropped EXE
PID:1124

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\MicrosoftEdgeUpdateSetup.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3184

C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
4⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4272

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4236

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4124

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:760

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2632

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0FCODI4NDktRUMxOC00NUVFLTk4MTMtRkUwRTNEOTVCNDgyfSIgdXNlcmlkPSJ7NEJEMDg5NDUtMDhFMC00NzFELTk0MzQtM0YzM0YzMkUzQkVEfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezkzOEFDOTJDLTNBRjgtNDBCMy1BNDQxLTA2RUU4OTA2RUEwNn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNTcuNjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGluc3RhbGxfdGltZV9tcz0iODEyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEJCMjk5MjktODQ0MS00RjFDLTg1NTctOUE3RTJGOThGMTg5fSIgdXNlcmlkPSJ7NEJEMDg5NDUtMDhFMC00NzFELTk0MzQtM0YzM0YzMkUzQkVEfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezIzRTA1MTQ1LTgwQ0QtNDJFOC04MDZDLTRERURFQ0YwMTlBN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI3NSIgaW5zdGFsbGRhdGU9Ii00IiBpbnN0YWxsZGF0ZXRpbWU9IjE2NDk5NjE4MjkiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4584

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4C3D91C8-E83C-49A4-8ED5-E3A0C93722AA}\MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4C3D91C8-E83C-49A4-8ED5-E3A0C93722AA}\MicrosoftEdgeUpdateSetup_X86_1.3.163.19.exe" /update /sessionid "{8BB29929-8441-4F1C-8557-9A7E2F98F189}"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1164

C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU99F6.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{8BB29929-8441-4F1C-8557-9A7E2F98F189}"
3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3832

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4384

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4336

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:528

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.163.19\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2844

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEJCMjk5MjktODQ0MS00RjFDLTg1NTctOUE3RTJGOThGMTg5fSIgdXNlcmlkPSJ7NEJEMDg5NDUtMDhFMC00NzFELTk0MzQtM0YzM0YzMkUzQkVEfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7OTQ5MEQ2RkEtQkEzRC00OTM2LThDOEUtNkE5MDA5NUVDQjgyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE1Ny42MSIgbmV4dHZlcnNpb249IjEuMy4xNjMuMTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIyMjZSIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE2NTY0NDgwODkiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgwODQ4NjQxNTkiLz48L2FwcD48L3JlcXVlc3Q-
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEJCMjk5MjktODQ0MS00RjFDLTg1NTctOUE3RTJGOThGMTg5fSIgdXNlcmlkPSJ7NEJEMDg5NDUtMDhFMC00NzFELTk0MzQtM0YzM0YzMkUzQkVEfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0EyMERFQ0M4LTBEMzMtNDY2Mi05NTc2LTIyRTZEMjY4Qjg5Q30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNTcuNjEiIG5leHR2ZXJzaW9uPSIxLjMuMTYzLjE5IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMjI2UiIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOWQ2ODMyNzQtNDg5My00ZmZlLWJhOTItZmJiMDEzMmVmYzQzP1AxPTE2NTcwNDU2OTgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZWc0U1RjRDRrVUFPVE9QQkJtbkNwN1Z4clVzeGlNdnpiZGE3dHNacVV4bnd0R212U2szdWNWVE05dVQ2NzBhVkR1WWszeTdjMUt2TDhFOWplbnFDdEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvOWQ2ODMyNzQtNDg5My00ZmZlLWJhOTItZmJiMDEzMmVmYzQzP1AxPTE2NTcwNDU2OTgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZWc0U1RjRDRrVUFPVE9QQkJtbkNwN1Z4clVzeGlNdnpiZGE3dHNacVV4bnd0R212U2szdWNWVE05dVQ2NzBhVkR1WWszeTdjMUt2TDhFOWplbnFDdEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODMxODU2IiB0b3RhbD0iMTgzMTg1NiIgZG93bmxvYWRfdGltZV9tcz0iOTcxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9Ijc0IiByZD0iNTU4MyIgcGluZ19mcmVzaG5lc3M9IntBOTJCRDA5NC04RDRFLTQ4QzctODk5OS05RkJDNzcxNzU5OUN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzAwOTIxNDc3NDMyOTQzIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ijc0IiBhZD0iLTEiIHJkPSI1NTgzIiBwaW5nX2ZyZXNobmVzcz0ie0E4Q0NBRDg3LTVFN0MtNDg3MC04MTk1LUIzQTUxMkY0OEFFRH0iLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4364

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\MicrosoftEdge_X64_103.0.1264.37.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\MicrosoftEdge_X64_103.0.1264.37.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
2⤵
- Executes dropped EXE
PID:4568

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\EDGEMITMP_7E693.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\EDGEMITMP_7E693.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\MicrosoftEdge_X64_103.0.1264.37.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4276

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\EDGEMITMP_7E693.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BEAB8AC-04B5-4E43-AB8D-9EDB407FA494}\EDGEMITMP_7E693.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4604

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjMuMTkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDUwQzA0MjgtNDJCMi00MUU0LUE4RjYtMUNCM0E1OTk5MTVEfSIgdXNlcmlkPSJ7NEJEMDg5NDUtMDhFMC00NzFELTk0MzQtM0YzM0YzMkUzQkVEfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntEMkM2OTM3Qy0xMEZGLTQzM0EtOTFEMi0zNzQyQTg1RTczQUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTYzLjE5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMjI2UiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC4wOCI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNTY1NyIgcGluZ19mcmVzaG5lc3M9IntDOTVCMEYyMS1GNjMyLTRFMDUtQjRDMy00OUNBMzFFOUQ2RjJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTAzLjAuMTI2NC4zNyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF90aW1lPSIxMzMwMDkyMTQ3NzQzMjk0MzAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjY5MzYwMzg1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNjY5NTE2NDgyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI1NzY1ODAyNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2RkZDY1YzEyLWI3M2ItNGZhNS1iMGYyLTY3YWNkYzVmZjA0NT9QMT0xNjU3MDQ2MDYyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWZERHZmNXVEJTJmcHVmNVYyRFR2JTJmSG9ySW1BNnlXeiUyYkhWWXZPb2tpT0JqTVZiajdQWTJMd1hJbDc3SDlCY1llMDcxRk9wJTJmcUIzQ0Q0RGp1d0NRRzM2UmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMjI1NzY1ODAyNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZGRkNjVjMTItYjczYi00ZmE1LWIwZjItNjdhY2RjNWZmMDQ1P1AxPTE2NTcwNDYwNjImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9ZkREdmY1dUQlMmZwdWY1VjJEVHYlMmZIb3JJbUE2eVd6JTJiSFZZdk9va2lPQmpNVmJqN1BZMkx3WElsNzdIOUJjWWUwNzFGT3AlMmZxQjNDRDREanV3Q1FHMzZSZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjEyNDU2MzM4NCIgdG90YWw9IjEyNDU2MzM4NCIgZG93bmxvYWRfdGltZV9tcz0iNTIxMTEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIyNTc4MTQxNTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTIyNzIxOTAwMTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MDgiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyNDgyOTU0NTk0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTMyOCIgZG93bmxvYWRfdGltZV9tcz0iNTg3ODMiIGRvd25sb2FkZWQ9IjEyNDU2MzM4NCIgdG90YWw9IjEyNDU2MzM4NCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMjEwNjEiLz48cGluZyBhY3RpdmU9IjAiIHJkPSI1NjU3IiBwaW5nX2ZyZXNobmVzcz0iezU1MzFDQUQwLUVFQUQtNDVCNC1BOUU2LUMwMDAxMDY2ODA1Rn0iLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\MicrosoftEdgeUpdateSetup.exe
Filesize
1.7MB

MD5
28c0f6643449ca44ac182524106c1ef1

SHA1
1172f3442d3135931c0f9cc34f328e1715982704

SHA256
e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452

SHA512
3e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\MicrosoftEdgeUpdateSetup.exe
Filesize
1.7MB

MD5
28c0f6643449ca44ac182524106c1ef1

SHA1
1172f3442d3135931c0f9cc34f328e1715982704

SHA256
e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452

SHA512
3e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1336_1428051161\msedgerecovery.exe
Filesize
1.6MB

MD5
99c95302031a74fb25045dcc84221f82

SHA1
1da4c7970f008f47f22e9f16f14b08c88d07849e

SHA256
58fac72920eabe2ef2aacc12dfe0dbea9a4dc10532706374d4a98034c16b765a

SHA512
c951b77cc3e708fb7a36ffe2997eb77852d8652598e11daedab56de7678edbc246f0da69c3446c2b8c4e52f5b005bdfabc0fba568c1e472a32049297f06ff546

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\EdgeUpdate.dat
Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeComRegisterShellARM64.exe
Filesize
171KB

MD5
b2cfaa142985112fd06e092bd3f04a06

SHA1
653d76cdd6f8e0317dd408c5e7aef142a944cd8d

SHA256
7f80809d759619369129f12242b171dc672d0dd699ade0d814067c07aaede8d1

SHA512
da9730dcdba3a14893e588533d16b526e2c599f0793285eafb6701d1795024981441f8d7259587bacdc7cbf69d56419e67007cbab32fd0e19814c5d2eab84077

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdate.exe
Filesize
200KB

MD5
02e716344c3241e304196b5444ac4e25

SHA1
a801213a0bf89b77642f6b1de77a14a6edbc02a6

SHA256
d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add

SHA512
1dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdate.exe
Filesize
200KB

MD5
02e716344c3241e304196b5444ac4e25

SHA1
a801213a0bf89b77642f6b1de77a14a6edbc02a6

SHA256
d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add

SHA512
1dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
Filesize
204KB

MD5
0275f8bae9e6800d29f6d326a4dedd41

SHA1
c89bca78a22e0a4cac7e8e58a9a58e64c6ab6ec2

SHA256
1ff7eb6b43772f6924ca7f5097a1b16f40ffbe11cd79e219c56fa409bf388469

SHA512
d2363c926be2793ecb94319f4e79e7196385d80f33744bf5f737f0a2488e1555f5863225a152d05fdccb957b8368fa726253d8f4bd0763389956f035d7430ba1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\MicrosoftEdgeUpdateCore.exe
Filesize
246KB

MD5
09ec85b85d220fa3832f2387e51b4108

SHA1
bcdfab0aefc14e6753397380538f3f521235180e

SHA256
ce3e7a87c24d7f55880dbd919711ac8a32e30befa7cd8b1d21bd0037a9016138

SHA512
2ddb2fe0c2ac3867d7110d5fc52c673c423853321d3a0d3151e27b5e2c1aeee9d3180000b8e43855577981834f9d6b1c25a4180cbd2b07d4d50c3d656a978a03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\NOTICE.TXT
Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdate.dll
Filesize
2.5MB

MD5
68b63876016abd50d706fc52a4a311ce

SHA1
f13e486d06218cacf1f3e30c02d6ad27b1f85423

SHA256
a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e

SHA512
7091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdate.dll
Filesize
2.5MB

MD5
68b63876016abd50d706fc52a4a311ce

SHA1
f13e486d06218cacf1f3e30c02d6ad27b1f85423

SHA256
a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e

SHA512
7091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_af.dll
Filesize
28KB

MD5
53cee9e7b391b77329f6bb511ef3fa76

SHA1
5ebc0650d070d419e99d8b981d694ceed4bd00c0

SHA256
c8fa8e9464ef77b65c671bd62dd0cbd7c7f57105dd5f6dfd067df16b4b2b77dc

SHA512
2bbbffa2367723a39083397ef914d4dadc19dbcb5e721cf4b542445a4f82872c826eb9d69de2ad5a85300f37c5883bcedc5087eb18599e9ccab65feffa1043ba

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_am.dll
Filesize
24KB

MD5
7983a34a0d846476b88f1c3d41946e73

SHA1
0bcfd01e64b5a56da00dd30c50dce884289e3751

SHA256
471d5c299f3a1a94413ed271f907df5456b75eecd2097ea28582f13c4f068334

SHA512
8cdb16a5deb6de26708389ec5a760f0d45cf8ee382958d6c713444fb04c99efd7d58594036d10a261c92595d4aea7a5dbbbe59441e54fcf06524efa7d5c8b328

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_ar.dll
Filesize
26KB

MD5
d2366075f22f6b547283291a5fd1dcd3

SHA1
3002063ba12e6bc26eef6b5f3a72c9c4e966dbf4

SHA256
ea525aab28041424e06d026e8e31fd8e58b8ed148cdc69a26393bf2f855d90e3

SHA512
b5c6cddab52fd7d0e4f3e657220168b4fbf00aa4d899a807978e9b9514065a98008bc3e4b1822f63c25350baf746ff2ba03f78662a4ee3a1ee86f47a0a8d4e7f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_as.dll
Filesize
28KB

MD5
e09e9c955952d927388da22e7b167f24

SHA1
b91a0c5499b5a7be216ec2531add3cdbfa51ea49

SHA256
11f80f94dbb42e5efbcfe47e6f9fd946429b969c614094966d7be23ab206e10b

SHA512
73e6bfdcd7b5357246ea2a19d9f45f0ee130f3f8e1c488bbe42246472114e1d220544a215f75a1a521717005ecc47dd2f81a8b16bbae58e1f5687b271c572a3b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_az.dll
Filesize
29KB

MD5
44ff2e251a8f08c1c82fd1c276856ad9

SHA1
86f24bb3b1ccb0f17c6ce6da5f0a19d77683c6b0

SHA256
7daa97f3bca0bf401bad880f03b1376cfd5dfb305287811eda7f65d9199fb53a

SHA512
81dc61e2410ec314cedd744ef81a200764057afb7a038da7cf5b7861cb4960aeed0b7cfb7a10e97b0ee1821c512f013a42634020f86aa0688d17de86762cd494

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_bg.dll
Filesize
29KB

MD5
c0af898f97a104d6649e6fa9a71acc15

SHA1
dc8b5f6865b0d3e168f7ef781c927ed872cefad2

SHA256
686289d2c5eb42009dc68019de3fa5c311bc37636fcf428f51c8192062c2c1a5

SHA512
25b822fe686fb89fee2eb7d01e2de406142713798da98651606abf4aa68d631d09b654b7ac71df83f6c639800daf7004bf3766b8c8c7468a85978495127159a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_bn-IN.dll
Filesize
29KB

MD5
a51cd3e21d94611a399147f63665ebed

SHA1
64dd626916343410a547a06fd7b48906f72b78a4

SHA256
8a0872efa10942f6dee725092b32d2bd074d798110a3a990ae5b6c8b30c3310b

SHA512
214223bf1711fd1a27cde00ba056ae897ff17c195b62e6d140d749e7dfc603584944163158eafc5ef66d523e81096c0791ef78ad36f56ac83336f89f9136e1f5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_bn.dll
Filesize
29KB

MD5
4cac1f99c27ee7c6720a5612cfeb20ef

SHA1
dd27e3358279fca9c14a9f0c161ee093bcadd825

SHA256
9008377200f8cc9d3ac62d88baad58cb4554d73d52105c8b304227ae05cc3424

SHA512
1769e62033b7576a2413c9bdfd1ab519c48edfa3e14ee62c83491b380fc9ec62a0260fff5cb481cb5aff3f23121baa6265a002fd1825661349261e1686b12b7d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_bs.dll
Filesize
28KB

MD5
cf18296527bad3ee720412ae71d12e86

SHA1
9a45c48e6d39156681282479cfd3d2b60980d159

SHA256
658a04651a83851ecb6520ef958a3e1d6cf1dcbf0f1d1eec59f25741b92ed300

SHA512
1cc9a53445efeb88e9d8f2b6097e5dc498489edc87b539bc023e556b638d3d476f7f83adb3003b4900d742a7ccd47da21979141f3e07df3d98e52ee7d49d6d8f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
Filesize
29KB

MD5
a7d153624a53642437a5fdcfb90cf5ab

SHA1
ce20204b8966bbb9f5bfe71b2d8b378cbc39bd58

SHA256
6d3daa6c91efa623ac9ebfaa8e59e7f554b528b6887707f80ee91aef68c92de7

SHA512
45f04693e4d05afe5bc645b2d129365f87381862c8ecafd821d87f9425796b3f421a079f1405bf9128e4b4c3e0f144626470153f663595ba6bcbfe74cfbcf0c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_ca.dll
Filesize
30KB

MD5
faa9b8a39400cd92b4b96a7903b21cdc

SHA1
0f1a96ba3f8ef4cc5ae8bf347dc9735a7cbc9123

SHA256
432f9ed510cf9e74227ea61da17a02568870e501687bb21c115fc2b21d824ff9

SHA512
ecd03b669b6aa8cbedfc38b446877b8b25646ceda7954023e004c612d0b7977f303bf27890e792a90afe4babe7503c36fa0f920bed4564c25445b84545f175f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_cs.dll
Filesize
28KB

MD5
ba75b3be4bcbec567eadbc56076432e4

SHA1
e17a67a2831aa2e9ab6c7f59052c0b0baf6d3a4e

SHA256
1f933c0ab6daee1581a60300c476bdff6865f68b7305fb9b32a737f6d6b8fca1

SHA512
61f6e102354a285746848fdfba871137e36e759c292937d8182315e631c0f8d3d163eb1081f7f17000e88c9417defa4fcec416ee8cb6daa930a276751ff4025b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_cy.dll
Filesize
28KB

MD5
77e5904f1ffb344502a466ae27511f7a

SHA1
9cee96bd6df0f0984405e8fe95bb720ec9b916c1

SHA256
e46aededa1d007bf8fe641d0ddd6abf889bafefcc029c91b59196eb55ba7ee92

SHA512
0160e9317645b6ad38b359d7b9c4ec54899052503d1bb5914f4bf7bf90f2c7c521b11e01adfa9910b2b3189189362ed912db34a9824ea464cd18ee0938641cd3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_da.dll
Filesize
28KB

MD5
d0c21bcf54df2cd71cb5df9d8aa3aeb3

SHA1
6c78e1817d9def3d0ed20fdcd201a8ac2afb3af9

SHA256
bc56ddc6f0509cacde23da7a6773c7803d38e06eedacc8c63b6c9d87be1c7513

SHA512
421b30b84a196c14b659100fe66764af1661a3e1a5cfe7b3eaef781a5e691d725251963f02e6afc4f93692ff42a6a22ade5aecd36b5d1e734ce686a175b7f5bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_de.dll
Filesize
30KB

MD5
1ade464c5ead694b76726a094962b85a

SHA1
22afa85a58e6a4872a92f34fb847fa50dcc59a0e

SHA256
8d3ead21598744d6c19ba15812e8a05e95316e5000b04d96863b1b7d7918f564

SHA512
0f003bf35b7ca2262789533e0e1f4b20d17f8bce5885f88d79356a745a03e7a85f6868d00e04139be0b0990ed79c7b84e8e135c937d36b641acbb2c608e5a430

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_el.dll
Filesize
30KB

MD5
7947d858efe2c8bdedf1b6ece07f2f0c

SHA1
3c5bd7afb2872a1c35db316180182b61498647f5

SHA256
37f66ca033654488e732710f2928a781834380011da81f6dc61356ea65ff3cd8

SHA512
b4416197b5a34a971543a40d5af7de8b5d166dc40b00888f8a12a812472ed5c10172f6f340d8ca022bc6ded6d9e3114c9de6f3ca5df7fd151fa27677a005b6ca

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_en-GB.dll
Filesize
27KB

MD5
604d7950ad651e06b518e72034a691d5

SHA1
ae4bfb658b0ed616dc47d5e9f41611f3b00ab5de

SHA256
3d88879839db205fb1428717a85e8610b932e3b6e451e16e176e71850ffc4d88

SHA512
df3f11d4686a16e2f8fc95b65d2e97639216fd75d72c4a91c5b1019602937bc177b75e5448961d7efa7341bb6630aab01b5dd41a2c701c88d201d3037d0ccb41

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_en.dll
Filesize
27KB

MD5
a864d97ab266aba9972155acc2afabc3

SHA1
ac3bda7b69af04cc796c24980996de2db7a31dd4

SHA256
db2dc77075ef42d4f36b9ab3f11817610464f8538f1264cf0373705af91676f8

SHA512
a2f747f9f304fbbbaa1a5d071499925f4524170efbc5a3f9ce0d2e5d38eeee74ee6f18d460689eeb41e988c8d16169e84e44dd906d8989e93808574466eb1ca6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_es-419.dll
Filesize
29KB

MD5
5549e5687c3a753e186f301cf13ed6f8

SHA1
c06ce0554859b534c3fc591a80f1e7a2d25f52f7

SHA256
7cc3eaa3160d69b542419a235c64d899b9b4086cd572ae69d701a7b247d1c077

SHA512
1866f569cd4b3b796f5b1f160058d9b37907a3b5726139e95953e1cf76a63e0c80f88182c41bf31ccc823c3b13b74cc22fbc639eaa5e8ab469a01deaf94ce6e0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_es.dll
Filesize
28KB

MD5
e78bc59cfed1c26cee4d76bad5f80516

SHA1
2c60386beb9eeb1e00d9400b041c88b8e6ebf293

SHA256
60b55896071089fd8e8f31df0f22929909408d67a09e1aeed54376e597683a7f

SHA512
e071aedf19275c844c0949980e462d35dd6987c0510b2f5cad5b53d5a75a605342e773e12b4ccba122c5e5d4a1448dc5c804336197eb0e59ec9b39c3983dddcc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_et.dll
Filesize
28KB

MD5
74169fbf0de252eccbf01e7d5ea3a56d

SHA1
902a2405089c99bba5f5438026386ce9416d4f6b

SHA256
453aa79b55c137eb3c95738de475b9fc9383ef07923a80f0365f6e53bfc78476

SHA512
a8c0864cbc807368959452fc540165d7a67ff5f4e6315dbc1f5230b6a049f33988b991cc65503e6eb92f4f5326ea7c0460969377cbc9efae9f70021efe3b1cde

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_eu.dll
Filesize
28KB

MD5
bbfc5f09aab008784d415a6de3cf239c

SHA1
8e0d6d2e6c9363e2edb6e1fc681fe353f0652da2

SHA256
cc0f547674915e21c070cf3fab6fb00ee0926790db71b9d37b78e20aad370d24

SHA512
6ae45de266fb6b8dd2f946260b6ab2968e9a091cc74a27587453e40e859a8fe0046945f3e582a6eb5afa24deed8d80235ceb57be006a35e3efaac0067ce43124

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_fa.dll
Filesize
27KB

MD5
04889ddabdb2373e3384c9211d606e8f

SHA1
3862aee6bdd9ce36f604aa91ef40c0f8cd3ff30d

SHA256
c43d5644b2e241b4867b78e19d103b28a77e3ba5a21ed683a1e67df95c92cbdb

SHA512
a74b55913123d63c392a9653930b548dd7e3ac2b5deec4ac26efa92e42573d996b03de27d16b244e0cf8fc2a3c00dd9329956f75225a1c2b0ad9d9dc6f947325

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_fi.dll
Filesize
28KB

MD5
236b8e50cae45f545b8cd39b72c56447

SHA1
5bcdd006e6699cd7f6e8b3c15e13abc83532457f

SHA256
a0ada887431cf3749871e78ee632a026ca837f0716305b470375f7d25fa5e69a

SHA512
c9ac74fcab02635e9b98c236bf4cec2a0349f5159f329aee3c4a080fc82e3acfd9c92d5e3489bbab527df48acb65c71abe6aa1fdaf40002bb48bcb3c53738458

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_fil.dll
Filesize
29KB

MD5
e70514683320c06ebe56cb93b6bb8312

SHA1
1eec4a1f5a1c05dc24a1db2ceac197767dd28b1d

SHA256
04e85f77193990dc0a2f6f46347159de7199a89a943508df79e1d5894cd66f13

SHA512
3aeed7719137372083d4ea93d0748d66e7174cc38f205e801ef8ece72de87775ea9e4cafffea0bb75f1ed80a9a8b620ae18f3e45485722ee530b51802e0c6fd2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_fr-CA.dll
Filesize
30KB

MD5
ca8102591eff12328e8415981c690873

SHA1
31bf4e36faddd93abdf9abd4df4627846696d6fb

SHA256
857dbfc185d3b917e8c8db77f6154545c2c970502c08f6d0e09606291a6eb4ca

SHA512
eae9a17e6f9ddac303e90b29d0de98228f6338cc2b5e5452ea211a1c696331b38200efe91c8d569e2109bef30baf2b85dedcfcdcab9a159e3453555e9788076e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_fr.dll
Filesize
30KB

MD5
bcc5a525c21a765abee63d7e27f5b856

SHA1
f04b95f5342c3d0051b27220f51a2f4fe26c7968

SHA256
05a04132aef3eb2de8807b0c4926d559f2d169de29c55b1b290ce0438710624b

SHA512
96b593b0385fd7a6115197e9ebf39966ac83ed69f40524b5a5d37e10a43d25d7cd320e9b64e75941db3e6efe5c22e0db25d900a573089039fddc219e011f326a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_ga.dll
Filesize
28KB

MD5
7c8af529514df4e5b0679119c38c76d7

SHA1
abfd9b4c8a9f42a891a5dcc0b010e14ca5baecef

SHA256
3132a0a8fbf6e6453ee6e702e9a6fb762381f51c047521d149679e87e90cae47

SHA512
9de4324b52ca8de158a909114f898b9485b3625fa1ca515123174711f7329ca8db1ce1ad12128729c2fa616dd1fa3f74103052b90429ef19833c062a25304243

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_gd.dll
Filesize
30KB

MD5
6744d58930e8a6feff6c8864f4c2fade

SHA1
20950eb138278e843722b4d76abce45b79be39ea

SHA256
f3d2ef4a2606e662430f4f1370b9201c0d0995bae89cbddb320b48d80dec6359

SHA512
589229880266a01d9c36424163747c3346945aed6d1057ac55b4bc234de9f5ece347844658303db02859a47149477eb6ada0209564f2d693f3cb5ca13fa15470

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_gl.dll
Filesize
28KB

MD5
611de7bffd3fdac3a9235c2a5edb4a4b

SHA1
bba11ee77f7b211cd2a545ba4b6b75e8aba0db92

SHA256
cbd7bd241306efa0015ac8da0b8131efc46c0e2708f14eb9e3375b5de1259463

SHA512
42a205c3ece65b80c4ca26b09876ee377c76f20d5f709dd8c1e4366e17cc9c89ee411752465b413e6eaf8439fc20f0233c8d17add94a040bd6ff061606eac206

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6960.tmp\msedgeupdateres_gu.dll
Filesize
28KB

MD5
f7fe21fb053273b5c066c98247e37742

SHA1
8c32ef5bde19194b7f08f6a4991992dec50b3de3

SHA256
e0ea5e8b21a6b240e89f6267ef86f358d6a64262f38451eea4728e55d05d5438

SHA512
b2951c0347cd2276da3da2c5d02f895324479290e75707d4a3a499c412a4be8d339dc52b4b5416e75f2a5c66fd9e363f490a6391dd6ec150cadd935ebb6d2f2e

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
3KB

MD5
1e95b82a16e46f8c914f307575a4fdcc

SHA1
6a3f2e7f8cdd017fb720faf85a04a262c510c30b

SHA256
8a331455214582783a68232a5a82d680e48ee0e28cba6265d95a0de71813785d

SHA512
4f0e6ca104d7571ec3fc324c42789a4f45ad48f527762c10815ceecff1cce74758037a2c64ad02e72a785b0a772db0125e33054e82fe7f443c08194c4479d3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.157.61\recovery-component-inner.crx
Filesize
2.4MB

MD5
f28893c3053a372b69b27fba5719ff9f

SHA1
73c737a6f1191ab05944ad5075c8fa01a5fbc93e

SHA256
f1b2f319099c84789057212d87f3d213a5d7e5a2c08f1b79fac1ffd159bdff85

SHA512
105d4c2a9c6d20d4ecc2d890613e1920926e5de9dc016d9e397521d5af20a234b58fe77d281df32891569da9a1d2f1ae62b05d32aeb6590636b9fa097906c416

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn7537.tmp\System.dll
Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
C:\Users\Admin\Desktop\_WHAT_is.html
Filesize
9KB

MD5
f458255f123aafac2d8db04e0d309f34

SHA1
977748e261b2775cfb37bfe5fba26e6b56e90ff9

SHA256
3be37f55ee1d94b457a8010e29e2f7311b4a1ecece6a9406f9c2561193e45a46

SHA512
cf3390a7d58cf18ce3a2c1a91fd282d6b274e3cf3c8a0fbc769fbca424d568f241edeeefd873c1b4d583c0a16152d81463cf541dab3e5edebfdb780bba2966fa

Download Submit
\??\pipe\LOCAL\crashpad_1516_HGDUTHAEIITJKGAA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/456-147-0x0000000000000000-mapping.dmp

Download
memory/528-237-0x0000000000000000-mapping.dmp

Download
memory/744-141-0x0000000000000000-mapping.dmp

Download
memory/760-226-0x0000000000000000-mapping.dmp

Download
memory/924-138-0x0000000001FB0000-0x0000000001FD7000-memory.dmp

Filesize
156KB

Download
memory/924-132-0x0000000000000000-mapping.dmp

Download
memory/924-134-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/924-135-0x0000000001FB0000-0x0000000001FD7000-memory.dmp

Filesize
156KB

Download
memory/1124-176-0x0000000000000000-mapping.dmp

Download
memory/1164-231-0x0000000000000000-mapping.dmp

Download
memory/1260-142-0x0000000000000000-mapping.dmp

Download
memory/1360-243-0x0000000000000000-mapping.dmp

Download
memory/1404-249-0x0000000000000000-mapping.dmp

Download
memory/1516-136-0x0000000000000000-mapping.dmp

Download
memory/1656-160-0x0000000000000000-mapping.dmp

Download
memory/1876-154-0x0000000000000000-mapping.dmp

Download
memory/2028-137-0x0000000000000000-mapping.dmp

Download
memory/2168-139-0x0000000000000000-mapping.dmp

Download
memory/2248-239-0x0000000000000000-mapping.dmp

Download
memory/2392-149-0x0000000000000000-mapping.dmp

Download
memory/2416-133-0x0000000003120000-0x0000000003148000-memory.dmp

Filesize
160KB

Download
memory/2416-131-0x0000000003120000-0x0000000003148000-memory.dmp

Filesize
160KB

Download
memory/2488-156-0x0000000000000000-mapping.dmp

Download
memory/2632-227-0x0000000000000000-mapping.dmp

Download
memory/2664-158-0x0000000000000000-mapping.dmp

Download
memory/2844-238-0x0000000000000000-mapping.dmp

Download
memory/2952-228-0x0000000000000000-mapping.dmp

Download
memory/3040-145-0x0000000000000000-mapping.dmp

Download
memory/3116-152-0x0000000000000000-mapping.dmp

Download
memory/3184-178-0x0000000000000000-mapping.dmp

Download
memory/3204-159-0x0000000000000000-mapping.dmp

Download
memory/3644-233-0x0000000000000000-mapping.dmp

Download
memory/3832-234-0x0000000000000000-mapping.dmp

Download
memory/4124-225-0x0000000000000000-mapping.dmp

Download
memory/4148-161-0x0000000000000000-mapping.dmp

Download
memory/4236-224-0x0000000000000000-mapping.dmp

Download
memory/4272-223-0x0000000000000000-mapping.dmp

Download
memory/4276-229-0x0000000000000000-mapping.dmp

Download
memory/4276-247-0x0000000000000000-mapping.dmp

Download
memory/4336-236-0x0000000000000000-mapping.dmp

Download
memory/4356-181-0x0000000000000000-mapping.dmp

Download
memory/4364-232-0x0000000000000000-mapping.dmp

Download
memory/4384-235-0x0000000000000000-mapping.dmp

Download
memory/4408-245-0x0000000000000000-mapping.dmp

Download
memory/4536-163-0x0000000000000000-mapping.dmp

Download
memory/4568-246-0x0000000000000000-mapping.dmp

Download
memory/4584-230-0x0000000000000000-mapping.dmp

Download
memory/4604-165-0x0000000000000000-mapping.dmp

Download
memory/4604-248-0x0000000000000000-mapping.dmp

Download
memory/4696-167-0x0000000000000000-mapping.dmp

Download
memory/4744-168-0x0000000000000000-mapping.dmp

Download
memory/4764-241-0x0000000000000000-mapping.dmp

Download
memory/4836-170-0x0000000000000000-mapping.dmp

Download
memory/4952-172-0x0000000000000000-mapping.dmp

Download
memory/5072-174-0x0000000000000000-mapping.dmp

Download