16552f7d9187c65cfa6228789e2dc31a495afe4e3e02e1a4dbab24bebbfe8cdd

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2022, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Evon/Evon.exe
Size

6.2MB
MD5

fdcc18579ccd9a2fc9d798bbb01f4de1
SHA1

740b8cf0833091b77caa303eeb6234bcaf847bd2
SHA256

70aa18a64869364d04da5facb74f8d950791758820fec3336edcc7293949b45c
SHA512

1b55575086057e0466c03751ae204faffd0a9d4518e19f9bc5daa88a1f7dcb5461f05ad45c611e72de15836729b1f449a14e684ee28d8ae3846f40684421bca7
SSDEEP

98304:VFmsG+4eOpS9qWNgNgCp6aGBwHCcmmxVA5/xDnLx0yu+5Tp6z:nDGw9fm2CnPhATd0yHq

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
2372	webviewruntime.exe
4276	MicrosoftEdgeUpdate.exe
4868	MicrosoftEdgeUpdate.exe
1924	MicrosoftEdgeUpdate.exe
4268	MicrosoftEdgeUpdateComRegisterShell64.exe
4400	identity_helper.exe
4540	MicrosoftEdgeUpdateComRegisterShell64.exe
1100	MicrosoftEdgeUpdate.exe
1868	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe
1572	DllHost.exe
5276	MicrosoftEdgeWebview_X86_96.0.1054.34.exe
5300	setup.exe
5392	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	identity_helper.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ThreadingModel = "Both"	identity_helper.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	identity_helper.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}\InProcServer32	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Evon.exe

Loads dropped DLL 16 IoCs

pid	Process
4276	MicrosoftEdgeUpdate.exe
4868	MicrosoftEdgeUpdate.exe
1924	MicrosoftEdgeUpdate.exe
4268	MicrosoftEdgeUpdateComRegisterShell64.exe
1924	MicrosoftEdgeUpdate.exe
4400	identity_helper.exe
1924	MicrosoftEdgeUpdate.exe
4540	MicrosoftEdgeUpdateComRegisterShell64.exe
1924	MicrosoftEdgeUpdate.exe
1100	MicrosoftEdgeUpdate.exe
1868	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe
1868	MicrosoftEdgeUpdate.exe
1572	DllHost.exe
5392	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\ga.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\vk_swiftshader.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\oneauth.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\da.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\nacl_irt_x86_32.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\pwahelper.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\eventlog_provider.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\bn-IN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\icudtl.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\vccorlib140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Installer\msedge_7z.data	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\EdgeUpdate.dat	webviewruntime.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\cookie_exporter.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\oneds.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Mu\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\sr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Edge.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\nacl_irt_x86_32.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\Mu\Entities	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_tr.dll	webviewruntime.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\vk_swiftshader_icd.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_mi.dll	webviewruntime.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\Mu\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\96.0.1054.34\MicrosoftEdgeWebview_X86_96.0.1054.34.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\concrt140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\gl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\wns_push_client.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline\{80BEACD7-91B9-4639-A0E3-0B805F20028C}\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\MicrosoftEdge_X86_96.0.1054.34.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\swiftshader\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\onramp.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\identity_proxy\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\pa.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ru.dll	webviewruntime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_mt.dll	webviewruntime.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\sq.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\dual_engine_adapter_x64.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\Sigma\Analytics	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ms.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source5300_1831744205\msedge_7z.data	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\en-GB.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\gd.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\hr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\nacl_irt_x86_32.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\ca.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\uk.pak	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lastrun = "0"	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4A02D72-2A34-41DB-B37F-05DFDB27E933}	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	identity_helper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	identity_helper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	identity_helper.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
3824	msedge.exe
3824	msedge.exe
444	msedge.exe
444	msedge.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe
1404	MicrosoftEdgeUpdate.exe
1572	DllHost.exe
1572	DllHost.exe
4400	identity_helper.exe
4400	identity_helper.exe
5392	MicrosoftEdgeUpdate.exe
5392	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	Evon.exe
Token: SeDebugPrivilege	4276	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1404	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1572	DllHost.exe
Token: 33	5276	MicrosoftEdgeWebview_X86_96.0.1054.34.exe
Token: SeIncBasePriorityPrivilege	5276	MicrosoftEdgeWebview_X86_96.0.1054.34.exe
Token: SeDebugPrivilege	5392	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2372	4856	Evon.exe	86
PID 4856 wrote to memory of 2372	4856	Evon.exe	86
PID 4856 wrote to memory of 2372	4856	Evon.exe	86
PID 4856 wrote to memory of 3824	4856	Evon.exe	91
PID 4856 wrote to memory of 3824	4856	Evon.exe	91
PID 3824 wrote to memory of 3532	3824	msedge.exe	92
PID 3824 wrote to memory of 3532	3824	msedge.exe	92
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 3544	3824	msedge.exe	95
PID 3824 wrote to memory of 5088	3824	msedge.exe	96
PID 3824 wrote to memory of 5088	3824	msedge.exe	96
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97
PID 3824 wrote to memory of 2984	3824	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Evon\Evon.exe
"C:\Users\Admin\AppData\Local\Temp\Evon\Evon.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\Evon\webviewruntime.exe
  "C:\Users\Admin\AppData\Local\Temp\Evon\webviewruntime.exe" /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2372
- - C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=True"
    3⤵
    - Executes dropped EXE
    - Sets file execution options in registry
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4868
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:1924
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:4540
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTMuNTMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTMuNTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUYwNDEzNjQtQTk0NS00ODc3LTkyQjItRjY2RUVGOEQ0RThBfSIgdXNlcmlkPSJ7MTk3RUIxRkItNUI0Qi00OTY2LThDNTYtNTA0Qzg5RDQ4QURBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGREMyMUE0QS0yMEY4LTQ0QkMtOUYzMS1BM0ZGQjlERkEzRkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDttNDZLNUs1ejF2dmtOTEhyNGMxeC9oQ2plN1pRTGRxS3laNU53Z3pWM0E4PSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTY1LjIxIiBuZXh0dmVyc2lvbj0iMS4zLjE1My41MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyMjUzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1100
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=True" /installsource offline /sessionid "{1F041364-A945-4877-92B2-F66EEF8D4E8A}" /offlinedir "{80BEACD7-91B9-4639-A0E3-0B805F20028C}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/YpXFb3xUqz
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffecf2d46f8,0x7ffecf2d4708,0x7ffecf2d4718
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ff722745460,0x7ff722745470,0x7ff722745480
      4⤵
      PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3344 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2156,7223004897234747334,7601879254109685442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3324 /prefetch:8
    3⤵
    PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTMuNTMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTMuNTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUYwNDEzNjQtQTk0NS00ODc3LTkyQjItRjY2RUVGOEQ0RThBfSIgdXNlcmlkPSJ7MTk3RUIxRkItNUI0Qi00OTY2LThDNTYtNTA0Qzg5RDQ4QURBfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NEVEMzFBNzItODdEMC00MUNELTlDRUUtMDY2RDZCQzNENkFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODkuMC40Mzg5LjExNCIgbmV4dHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjU0IiBpbnN0YWxsZGF0ZT0iLTQiIGluc3RhbGxkYXRldGltZT0iMTY2MDMzMjU0NCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{55E3D7AB-88FB-43DF-9A50-68A571AEAD19}\MicrosoftEdgeWebview_X86_96.0.1054.34.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{55E3D7AB-88FB-43DF-9A50-68A571AEAD19}\MicrosoftEdgeWebview_X86_96.0.1054.34.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5276
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{55E3D7AB-88FB-43DF-9A50-68A571AEAD19}\EDGEMITMP_E6C35.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{55E3D7AB-88FB-43DF-9A50-68A571AEAD19}\EDGEMITMP_E6C35.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{55E3D7AB-88FB-43DF-9A50-68A571AEAD19}\EDGEMITMP_E6C35.tmp\MSEDGE.PACKED.7Z" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:5300
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTMuNTMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTMuNTMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUYwNDEzNjQtQTk0NS00ODc3LTkyQjItRjY2RUVGOEQ0RThBfSIgdXNlcmlkPSJ7MTk3RUIxRkItNUI0Qi00OTY2LThDNTYtNTA0Qzg5RDQ4QURBfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NENCQzc1OEQtRUY0RS00ODA4LUIzNUMtRkJENzIxNTZDODE3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iOTYuMC4xMDU0LjM0IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NjA4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVkPSIxMDM0MzIxMDQiIHRvdGFsPSIxMDM0MzIxMDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjIyNTk4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
160KB

MD5
ffb6702956d281b3a6ba56038072584b

SHA1
0b6e2cbee6e297d8afbd0503ff00b53e30dcfa0b

SHA256
8bca492fb1f5dddca9722dd18dad4a7ee75599644f06eb46bf281bbeec4ac1aa

SHA512
402556c91f0537badc3fb7f75ed39c460838bf43ed64dfabd0a588ec6da9681e15f909e4fd5af66c9ed3c4e100a726423443f685b13dcf4e492d52ef19c1a771

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdate.exe

Filesize
209KB

MD5
a40025702cce661c4fb1e77c449d7be1

SHA1
214a5af47d68293ba1670852718e67213feeac4f

SHA256
025df5c7a2b0afa43d54fc53a0a21f2ddf6df03db03a5032ee7ac0360e284185

SHA512
6a6c9e4d40a2afdafc65cad26a1448c44e4a488d16d1856235f575c47603aa5615ab062736d7988fe6e882aa4fa1b943649a28c9e74dc926151023cfa21a02d3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdate.exe

Filesize
209KB

MD5
a40025702cce661c4fb1e77c449d7be1

SHA1
214a5af47d68293ba1670852718e67213feeac4f

SHA256
025df5c7a2b0afa43d54fc53a0a21f2ddf6df03db03a5032ee7ac0360e284185

SHA512
6a6c9e4d40a2afdafc65cad26a1448c44e4a488d16d1856235f575c47603aa5615ab062736d7988fe6e882aa4fa1b943649a28c9e74dc926151023cfa21a02d3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
203KB

MD5
4c8680365aaf2610a945923fadd1e7da

SHA1
77f3ad34bb0f3e4861d4c644544138642e4a9e62

SHA256
860222a28c334c17bcbcbdfa258926fda0dbf64b42101e5a6ceea86c304fac57

SHA512
0dd6db0f4f26c408a241490b21fa75c8829fe11c85d0dad22888f7bbfb925a081087e535f35fade3df3950eec3cd8fcb4689cab99e86d3a404d157051c0c1c48

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
241KB

MD5
2d07dcf260df835d11c805f2e7f8c159

SHA1
25c8284b4b097da369349b39af3dabce2cc97802

SHA256
68a568252382db530607116076df3a26082efe67d216547bcc688a8b478957a6

SHA512
adfec8cc759e9fbbc51295c356eb4e90f26d9ee7d759ab5e9f740a55ab79fe14265c447ec20275ba8c8054a750087f717f27397566db1c4ee5cac2a76f513fcb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdate.dll

Filesize
2.4MB

MD5
6cfb1cd81b4c65e3a0b3e7d6d8c8cee5

SHA1
a413c36ba58cb1aae06523da8751cb2984b67c9c

SHA256
ac21842fa444ab5fe6f677565a2a6734e0c798633da9dfdc434ba5bcbae6bb22

SHA512
042466d8a606a1b1085ccdddee43cdb90607348179478d42f1fd71e89053ae7f482b9353268afab3fc3e44cc798614d6ad1364bd65040df406d5761eb8a8c307

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdate.dll

Filesize
2.4MB

MD5
6cfb1cd81b4c65e3a0b3e7d6d8c8cee5

SHA1
a413c36ba58cb1aae06523da8751cb2984b67c9c

SHA256
ac21842fa444ab5fe6f677565a2a6734e0c798633da9dfdc434ba5bcbae6bb22

SHA512
042466d8a606a1b1085ccdddee43cdb90607348179478d42f1fd71e89053ae7f482b9353268afab3fc3e44cc798614d6ad1364bd65040df406d5761eb8a8c307

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_af.dll

Filesize
27KB

MD5
96b7c2e7488555b0ea74a55a6eb08fc7

SHA1
5fba1ef4332f00a9ac1e0a95dd92719d11e931bf

SHA256
ead92721fee00699e3878a51c2432a6de4f1de55405d07e486d7458ccadd57a6

SHA512
9c4f68b6c6f029ae2ffd33bb40bb4f12a59872613006f19766a9dc2c2c7704e9b33b4b6a6ec44c02920c71bba11cbf245f93816a7659fc11394e43771cbddffd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_am.dll

Filesize
23KB

MD5
993a9ea0056417c22996d273c4cfe0d3

SHA1
2fd91e16c17f50624581b47eee47929e86e37715

SHA256
f1f2c1070f8523636107eb86c53dd3b4ac60bbf0ccea99d8e536ee8ce6e45b85

SHA512
0fd9b9446a4296023d55a821a9b0b84c3b5fd2d2d6da231325acae1b3696fa659b44f54b1d814a271724fba24e72b79dd33994a8ce96e2fde9aa97e04a09814c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ar.dll

Filesize
25KB

MD5
ae6f01dff13f3f346d3e7fab70b94c86

SHA1
977c9797fa3500bb199bce84d26ba6b78d4c38d7

SHA256
243d3369b2379ced25bb650cfccd2723c3caaaa1cd35bb557dbffac861e6717b

SHA512
8dbdf32315d4e276199b5fdeb9ec4364da0d0d5dd851f07228fc5d21ce6f9764e3983f0221119f294a4e76c11fa72368f2df9e9684bc274cbe7adea5c020e9f4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_as.dll

Filesize
27KB

MD5
d060a6b214167b36b600084a1fce6d7b

SHA1
2060742691912bb7ef7b76f5e7a6f14efb310291

SHA256
1a9d6e3afa58a2fbb63e6489ae1ab1fea3d8976771d61a128457b80d3e0a64cf

SHA512
e96d9652d35d67860d9857785e2d798dbd28c34b508734e6e804a6352ced6d0dbe89aeeb95f1254e7fe690a6c13dd08e61044315153f813aaff1bb2a3a1cd23f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_az.dll

Filesize
28KB

MD5
ef8fbcb5b232d1863f8201389113aadc

SHA1
9ee80f6f0d9cc36b0b5b312c8d0a062aaa3c655c

SHA256
d84e5be67107e893601cf5ab4f2448db392972e00772139df50dc432a9a262cb

SHA512
09935f8b769f9542ce135df8d9d9598057f72ef4ef795a6d1e95aa554cebcf9b783d233cf6250cc7c7396316034d9ad02c69f6d816ac44a5528100a0d6e35da0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_bg.dll

Filesize
28KB

MD5
40f5673b792aedfcce328502d559203d

SHA1
3e8c73e8333b32cff92997dd22907b3a0ab13cbd

SHA256
f4d9599d52dd7b1336b9f0f00195df3f51d9b4403f76ad35f6bc27066bbcf257

SHA512
8c83d624ce5745ffb107c7e67690406ccb074c2e9d0e260c0952960b8f49fb3650299abf5ea52f1e2b963387f011fe60bf24ba8957dfad50c912ba9bdf6a461d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_bn-IN.dll

Filesize
28KB

MD5
6b551185c4abb67cd6c84129c9b169a4

SHA1
68cef1ff1578f23dfaf1d4c86f9d39d37a1e92a4

SHA256
5a908e3b82b303bdb9665560ef67c3c8613f0d04bc98ceebbff313cb1a0df49e

SHA512
a27632e5c0de0d7d0d67b8ce28f7dc9c4756b5985e544f640981451b32d2471fd746cf49074c559fa19ffa8d684e445749be3751a4e72a22e68204c046f85074

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_bn.dll

Filesize
28KB

MD5
c9604aad7d1e68654d7f8c030061c7ed

SHA1
227fec1594f6f34d576e16e911014b677a631c6d

SHA256
c7f9587526477bf146c67c823e2e26afbca370db294c9f1edb0ef6570d419dd5

SHA512
71e8b5eebdae271887e22af7873d98028ce096fc0e35f3b6091f7f3a4ba5121f1a13030d8e2ba735df5dc17fe4f336e8193f1a3921b8af46ceca3b7b53155ef5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_bs.dll

Filesize
27KB

MD5
46c1c90fd9c2aff9ecbaaddf76b05947

SHA1
1eefe8b225b3b2db68cc39462a876d71b1f3eaa3

SHA256
f2ef06b1ca06ba8c5ba1cc335ecb3b64454d825d88093fcdcfd444319ce4dc86

SHA512
6c5f3a2522f62bd597a5cbeead95aa18f70ab11cf383f9f8880900c64438f1db1e89e97e62b147a24d3a804665e89cc135b86adaf599222c628626f5c2b02770

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
28KB

MD5
11b32b750c88b34c745ea1969b948a56

SHA1
f3adb0f85f2f963c6d29df65807291bd5272cd28

SHA256
c53f9d293c6cda95a2fabe165f7232b2a3506ba35e9d4e18b1ac00309e25b126

SHA512
2edf47c4bbbd429c86bf1ee4707706fbcfccc5f13b08687d6530d90a74b05b81b49704568df1045f3b98b677ca38a4c7e3efef08ec3ec86a5bd97a4a25dc5ce6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ca.dll

Filesize
28KB

MD5
1a9382add72a8b65cfdc4383febab107

SHA1
4b00e4df3f0b02e28f7e9a3a07281f798480adfa

SHA256
3b0a5335c17434a0c30fa8c52bc8af15b1c7702aea554edefb19184442fd26fb

SHA512
6b296efbf1c73c8d7a3510f5e7c2c1ac83415c3cc905398199ee5c1b70939512ccd8cfe5e8a8fb60ceb4899272dd9b4367e8c5f4c7e2f04a5754800147681032

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_cs.dll

Filesize
27KB

MD5
2bfd3ce1a1bcf3d116df5414faa5d285

SHA1
e85c3588a98ecab7c3d21a96534222bb063dae7d

SHA256
8a0367576591cf6261e3fcaf7e52e266b6c325e22d7f94441b9002f18f604461

SHA512
6c69a7271777277f9ee1c98bd680904296427c00fd67c64c567877bd50650b891ac18544143b0f4b3c2a839325d3eba63b23ad63fa7d58b2469cc0ed64a06083

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_cy.dll

Filesize
27KB

MD5
3c8bbfdbd4817d02a9954307107211f1

SHA1
7cb746d9dbde0bb6a35d75ffce42bb1c3cb8ba98

SHA256
f0e0ef1f82643fea9db0f79c727f1a7e3ead52ef209162258e7c37323e3214e7

SHA512
365eb28dde451d164624ced721dc099ef290bbef5fbfc054558d9f43447fb1ae1dcfedf910260c972f12c35f7f27d05e23bd90590ebc6d3f1e70acbb5de8092c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_da.dll

Filesize
27KB

MD5
f7fd3e001cc1191ab201c1dfb25ddd6e

SHA1
064fb4e941a6c487e792240fecc186b4bf79355a

SHA256
a57e2258e5422b8d89248ce541bbaed5e47063b70a16b446af1ad210094cb64c

SHA512
0f4870ce742e2cbc39ee504906426d768829d25dda6bf31afc5bbffc0ac3b4808f7a7b98d952ea977f10d27ae3c5e1ff5d05f65c61364f851d67e68a6b8189cb

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_de.dll

Filesize
29KB

MD5
87e0d2b50a90fdcc1861f8a066403bff

SHA1
abf39bdc5e5687b798340f7b3c8fa7940966cf4a

SHA256
a5d33e98b7c72aa3d954f811541af524a5f3c4123efd196e36ac52e383e08894

SHA512
4d5434c423156e5ac5d2cd8d492940cc9564e661f39ad1dca8cd1830e04868d081f7ed0e75086dcc6dd551039f12125ceea49fab3b6959e5ed49f37d69423124

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_el.dll

Filesize
29KB

MD5
ce6442e0f9614988b2e37b649101e9a9

SHA1
8e5b9587d94874c7d1e6881c5c40f814d48460f7

SHA256
b519b9a3938807243cece58809b47036243ca81c957075a6eee65c0605383862

SHA512
bad75f04b5b16b41c23f6a1b58fae303f513f72ad37be0ee969436ab736a7bf56944cd61774d87861ea0ca128f5b48ea11e6c54f2116f1b7a674e025520c8238

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_en-GB.dll

Filesize
26KB

MD5
86766127a8e0dc547f0f64598db92691

SHA1
cfb56cec1cbb4f1685aef8699579d6035e086a2a

SHA256
a889dda8a51ce9c84ea1071512fc5e05b0fcc782fc45843feebe2470a0f7ffbf

SHA512
3131e2b9a84f315e075de9b77c576265b1043dec70ed3d40955307819935bc2d90caaf92d4b3cfb1023a40fd14402c3952121ba86f714be9ed0db049a1de54b3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_en.dll

Filesize
26KB

MD5
0be55d32cfb7eab185a7fa7fd7f8f260

SHA1
5b1c47b1bf0c82432b31f83d7d9a67df324851d2

SHA256
77c36d4a9ac2dc5ba64b69d4e8686bc79de101e0ae45da1738c9cc467ac968ce

SHA512
f1534b4763b8895b20aaede5132cf3cfb21196631287c801362879459dd8e6073ecf4715cd1aa3fa91c46fdb35255695741a10158c0b7d9fe074893938c0aa2c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_es-419.dll

Filesize
27KB

MD5
715b1e3f1879ff94374185f3c31f935d

SHA1
0448afd9435f08469a167f061c7e6470cef5f664

SHA256
98b381350573b9345545f36de57d556aaeb18e83428380427aa78398475be828

SHA512
13ca2cd2e53db6c28958dd76eea9f4989ef4a2ec1d7708bcf458ee40e668b3394b0efabd0dc48918c1ab773119afa4abfa74ccbe276a8a01855ed4041215089b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_es.dll

Filesize
27KB

MD5
8aa2eeee9867a78cd9d24a9d7efa65de

SHA1
c5a38858e63b3b95621810493c8c78d81519b963

SHA256
47dce4d04ca263d68c7b9818c9ffedd8bb194262e93f002f20af095c4420d555

SHA512
693ed6d248a1f903ed706e63c27a03ec17ca607b2f525b2e412e9efccf48bcad7dc1481aaa08f91abed09a2b63039502275e369e8a8393f6ed5799534cb80d15

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_et.dll

Filesize
26KB

MD5
4a0ded6b7238876524f1543bf9c1b08e

SHA1
53d2dc8b6fad79cc65aab1086c8b33aafc9fabec

SHA256
c11959f8f8f4b7a14b6c6019f9cad639aa674a47edcc87e7ec3864d8ff20e9aa

SHA512
7168a00f2533fa3bed484dd6fd34341972fae019e377b02aafbbcb01ac276b6d713bfdd7972d0b6b3aa03b4e59575f98a36154b20cfce2b51dd5bcfbe814ffd0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_eu.dll

Filesize
27KB

MD5
75419454882991170ed13b9590edec87

SHA1
942ad256bc23b134a34dcf70d510d09c8cb1d8ed

SHA256
01b2b710cf2d8c41120f265c97456d64b81fc5de557c263e3a41069019784c5d

SHA512
040dc9cec4e0b8d08fa27c5159c589ee45a9b7d763bce8e7e409d6b3152f0642dbc1b8cf55c8392f5efb502c6fe14e82f2458daa0fa5600fb12e55500042f96c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_fa.dll

Filesize
26KB

MD5
3af6730f373e7a1355ec9cab1eebec28

SHA1
58b7c7c0818622208d0a9124d2da8f65d0d2a35f

SHA256
6726b22df72da907dde5bd897835bb747c2df4235859d20ffc6ecf1594b72bea

SHA512
a138cef9c76c224471692042a95fecf61e97fdd26d9e5d468698454436e1ca4fc68c15a6d7b346a901b0bb187f27b5dc6388b7da8a53268439e8f45719c6a6b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_fi.dll

Filesize
27KB

MD5
c67e2f456859e3b747e49ca40d303a96

SHA1
82a1fc90adeea44453859a7a3dc445a64b71ca80

SHA256
328ddbaeee9fea6d2aee8d2bbd286af178b2a088cce24c9c774afbf035f6bfd5

SHA512
ea381f0ad307b8ff7c8e89a3c9b09a1ae88bea3cf7bfa0d9f09b28a732a7fca09f7bc6dd60f8f950fad8e8bca5a0c12909c844d2fa25b1524ce4767af53b0457

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_fil.dll

Filesize
28KB

MD5
e6ab658d70f9cc88657d6d18c59312ed

SHA1
1049ae82bd6786b4cb458141067d49f99c6d8a2e

SHA256
f9dabd8dedfa0f6c80dad7b86ec7ceb5bbad6b461d67534db9428ab59cee3fd7

SHA512
ffec0ab77b6b6e2751d6a0ba2d26d5739603895e3ab7fb390f899ff8ec743894a5def906910979ac805485cbecb2da2a6ae02e50905631084e580dbbcd23dc76

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_fr-CA.dll

Filesize
29KB

MD5
125fd51b300c821536548cbfe72bbf84

SHA1
b4b3b84870f08120da8ec88900b28fc8eab3c2e7

SHA256
486e193ec46ce4d8f9f925d73564e9a3b68d39f3c2f9c00302fd8fd4c6810711

SHA512
57f310589a034bcacb42d91cc0c7a53f128b3804ea50fa2b461cfc322c824dbece5d67c67f4ade66177d687af8595efeb8283fc7925b3d644612f5998c5bd48e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_fr.dll

Filesize
29KB

MD5
a1723bf780c3af8bae9e01f525884dd5

SHA1
b827f0f52e002ece363da5f44b20e55199617af7

SHA256
7edde6ac3346e654b66a0621c30626f8d1720608b4c107e78b1c6e42595b14d8

SHA512
26147ad565d8694a244b923ce907ff0d9d26dda7cc7bb3d2e755f91bdaa9455b75bbac959ee4481ca009967b849223400efc6d72ed9106bf684c2bfeead2cd71

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ga.dll

Filesize
27KB

MD5
564024e243e97f89d3acb6eca15c81ae

SHA1
42f0898d40f8782ce9c4b848baabd3c97b760a22

SHA256
015f5318a47dcfb6db4cfa41394118d0b6a6a09cb972fbbff7549e144c445816

SHA512
487d5f737e79bd40c73dbd75ec8cd57b90884ab18d1659a79e7c2ed657fd2f96045a65276397850108315adaeb2a70e2acd5a2dfd1f61437fe5d69cd0f51d183

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_gd.dll

Filesize
29KB

MD5
81d4b648b3c3de7833fed0dfe0cad957

SHA1
a073986a290ba878a0f4b605af27c5f551a01a2d

SHA256
55b107edd473adc897edb619006b867c1cb3e32f6b29631315a46764a95e96ec

SHA512
125eab74e8f760095914a4a9285aa645375896b7b2d7f957f317b289a4cea512d4f8b64c65832ff9bc1541f2b3d91b9233d6278e20a07f97acbef04429371085

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_gl.dll

Filesize
27KB

MD5
a8ce04e1e7cbaa613443c12c16104b8f

SHA1
d990a50a58449eeb7a0439f831b60848acf15034

SHA256
db1e17395400cb402a1d75ac51351af2b5100794dfa2cc11befc5cf6bd87505c

SHA512
a126b03a6c913621e89448bc53be25bf0e29e2743cfa015933b0d0180da421941b359f9fb2fb525e122a4924a78e51abd450e3459a9bcaaf8ccd7c301d5d9609

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_gu.dll

Filesize
27KB

MD5
876cfa7452ebd6908e9190603f34969d

SHA1
5cdbc3e4a8c7ed9c615f64f1a72a64bdc4c33f38

SHA256
ecbe933cf5548e47eeda04b843eaf7bc1259777bf7de79c99b6a9365fed5a679

SHA512
a5cbccb0b78c56c12f9121c4a64d110d4ffa41ae42e5581146978497cbc0ffe4d97640676e08a6b7317fcb216e3e18649306ef53e1f6892201f320b4fe5bccfc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_hi.dll

Filesize
27KB

MD5
72e08ac0ccaf23b9c8930a2f3095231e

SHA1
ed5e67be12f2abde36d03b4d91c65fe65b62350d

SHA256
dbf1f92547a16d44694195efb846d92fe1c9d458de86fc193558cdf6ad7f11d8

SHA512
c72097cd918ac1d1742e6fb6fe966cac4fcb4b96ae39e116314383e65424c64e5ee3340b07295c1a98b1c0797b4ba8f8387e7e0d27c9fef077b2b69726311bfa

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_hr.dll

Filesize
27KB

MD5
a48f1bd9e421ee374265cd83c0e39ae7

SHA1
ddbaaa64964b0c8025fc896fa6d6728609454148

SHA256
7b9086fba930dfa5bdd3a0ab94475107055dc9f997fbf46178eeddb1e4dd8ed5

SHA512
b889e66e9d116363c8cff9bcbcf9d863940566ebc6e083b1684ce869ea7d88a5d228670e70c57578b7f8c246e0f1a3b3e65ef49dec0f28013c63c883d8d57a6f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_hu.dll

Filesize
28KB

MD5
08f00bd737b4f654d1d870d54aa0c198

SHA1
0b180855b7d2e92454a0c1b46f01f4e823821ac6

SHA256
2ea9127fb8afd1e3e87df4684d13bbbf4605ff4e7458ee0f24e6a9a7e0405199

SHA512
1183942479b485eb1564b3c49adcdef1105906058f3176d7dc7499ce64a91d6ce79a3a618b9ae209503fc4100d8ef7b1c536c902363b12d91d9c2a0a957865a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_id.dll

Filesize
26KB

MD5
19caa80ec5f7a53e4b2c66f6d35b4fec

SHA1
37df0974fe6e7d0c1d8f5fb80056cfc6947a653d

SHA256
e4c243a191c8f51f8b7041aae4d87f1b1773c5ce6cb20072c8e3d6a8223fdefb

SHA512
229da3a1f4d61a8a26689624132e75039d0d629be3befbb2a46266cda51009af8cfbb35cad11a49bdedc429ce4f7f758cb9431567fa2040ee0809b1aef4ee566

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_is.dll

Filesize
26KB

MD5
191a76357b0f12e7005d4fb46352bbb5

SHA1
3fd863ad41f9987ad699d49e9250fdaddf0e8fef

SHA256
cec511e41f8a4ab4cd4e0725d5cf31002be354eddc04895b9e315be0f057c374

SHA512
a6b6f79b4acc024ae84001c819e30a68f3018b6623c8048f0b7ac26c58fd440734b48cef364a3f3bf384dc18f1304ac4569dcbc1cca1dbb6eb7b69a312acc9c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_it.dll

Filesize
28KB

MD5
9db6d19ca5d0d0c863b7e0a45b0ac00d

SHA1
9e9da9a7b39fec72d768593ac2ac9bdfe5a6f079

SHA256
d7ea9892539b7241909a5c3bc5a63ba931952214ef522165f7af5f2d23db87c5

SHA512
e739b0dfa656b3c75f8f8f1590d6598a1bd2950c36d5427562a3eeef46727cd9bce7d1451db8f5a85a84487706bf23a9665349165e76abcc0d8d7a79965861c5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_iw.dll

Filesize
24KB

MD5
7f5a85ad4477bdaeb9428e1d3f0b5629

SHA1
1f271fa75357cb9313a4b7ebf4d58156b92e99af

SHA256
bdfe716ff03f56f2098487e391ab63fe62097ab9799ee62065b2f18218997d1f

SHA512
89567e8c883f8714cfbe6bb513b08a0d8b1be8a9560b860e742914fe6fc3624d47a7fbe676e8160fff72a612b58a6d07255929723109b5a991060a38f3069ed2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ja.dll

Filesize
23KB

MD5
aeaadb1ccd676c123ddf8d8d7f873a16

SHA1
6cd053d475bafcf20def50c8ac0cbfc41e9d7ff2

SHA256
9fbd2d1ac98516a07c45f22fbafb376bd60a13e3c74d89bd0ae4ac380d6e4199

SHA512
27a9b1317d92468fac19c3f8a616dd6e27ae684e43880f9bc14cb15bac587d0254b4424e98371ab40e26a08f1d2825c4cdbaa177cfb63f074b001db0bd59b83c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_ka.dll

Filesize
27KB

MD5
805259c470f35f0b8a53a1372e4ff675

SHA1
dde2c7b188d8fe942b280e902d2e84be36fddc7e

SHA256
20eb2b35a6ddd00c60ad57b0b54f681f005bee657c0eb0bce401633796298738

SHA512
a295acb08bfba6a4c5eecdb05a7a9c0cd5b36de673ceb802a4d6e38a0f96472c10beb9d280cf414bd6ae6d1ec15e792e7758afaca534d61d04aa418ddd4f108b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_kk.dll

Filesize
27KB

MD5
9bc8946302dc2053a36513837c12d592

SHA1
46a1ff8717b52a7a719f95e31198ce128eda14fc

SHA256
0350a75abb32e98f6eef9961fc03b66bc85d494199b6d7097ad96bea4205039d

SHA512
aee266117ad79935aad7ce2206b28895bc8485b2247402acc9e6fb13b00cc3f6c4ceb3700e3ff69483738df0d09b714b29222533d2597871ef26a833803961c7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE062.tmp\msedgeupdateres_km.dll

Filesize
26KB

MD5
9a64c85ad8f93ca227d50d379ec04af3

SHA1
76098a1576c9363313f0934edcdd1d2d9286c806

SHA256
977f36a42acd7f5a8d5efe6ea76d2723a164d712adf21fe3da5c9f9d413c92d0

SHA512
ff8a53298a7e9e839adb76b7049fc5b9c7a0d92eb1c02b67c7783b1306ee90bb19c631a28fb51de3bc841c6ea70d56394832871505aeeec5431dd5df58aa518c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Evon\webviewruntime.exe

Filesize
103.3MB

MD5
bd6efe632e7ba00530b04bee9a94ff68

SHA1
36586cb5a6f550279180b39484fbccd0fdff2da7

SHA256
50849cc605d9d81dc464109734b2f95c5b1430aa6cd68d11b61efebec6291e76

SHA512
877625378b84c4d43cfc0aaf852ac4b67671d0836de9216e4cf0fdebeb989aae134d513ba89c66ca69f4ab2036bd66b3db1a8afbaa91c628e481714ae3401c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Evon\webviewruntime.exe

Filesize
103.3MB

MD5
bd6efe632e7ba00530b04bee9a94ff68

SHA1
36586cb5a6f550279180b39484fbccd0fdff2da7

SHA256
50849cc605d9d81dc464109734b2f95c5b1430aa6cd68d11b61efebec6291e76

SHA512
877625378b84c4d43cfc0aaf852ac4b67671d0836de9216e4cf0fdebeb989aae134d513ba89c66ca69f4ab2036bd66b3db1a8afbaa91c628e481714ae3401c86

Download Submit
memory/4856-147-0x0000000006750000-0x000000000675E000-memory.dmp

Filesize
56KB

Download
memory/4856-160-0x00000000110D0000-0x0000000011256000-memory.dmp

Filesize
1.5MB

Download
memory/4856-142-0x000000000BEF0000-0x000000000BF0E000-memory.dmp

Filesize
120KB

Download
memory/4856-138-0x0000000009420000-0x00000000094DA000-memory.dmp

Filesize
744KB

Download
memory/4856-137-0x0000000008B70000-0x0000000008C02000-memory.dmp

Filesize
584KB

Download
memory/4856-136-0x0000000008A90000-0x0000000008A9A000-memory.dmp

Filesize
40KB

Download
memory/4856-135-0x0000000008AA0000-0x0000000008AAA000-memory.dmp

Filesize
40KB

Download
memory/4856-134-0x0000000008710000-0x000000000884E000-memory.dmp

Filesize
1.2MB

Download
memory/4856-133-0x0000000008550000-0x00000000085C6000-memory.dmp

Filesize
472KB

Download
memory/4856-145-0x0000000006D80000-0x0000000006D88000-memory.dmp

Filesize
32KB

Download
memory/4856-146-0x0000000006760000-0x0000000006798000-memory.dmp

Filesize
224KB

Download
memory/4856-141-0x000000000BD00000-0x000000000BD22000-memory.dmp

Filesize
136KB

Download
memory/4856-148-0x00000000067B0000-0x00000000067B8000-memory.dmp

Filesize
32KB

Download
memory/4856-163-0x0000000011890000-0x0000000011DBC000-memory.dmp

Filesize
5.2MB

Download
memory/4856-132-0x0000000000620000-0x0000000000C58000-memory.dmp

Filesize
6.2MB

Download
memory/4856-155-0x0000000007630000-0x0000000007642000-memory.dmp

Filesize
72KB

Download