cafbf35c0d9cf556d2c92086e0145ed092959eb725d6a8134adb9df835ad4a9d

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2022, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Star Wars Empire at War Gold Pack.exe
Size

1.8MB
MD5

bac43db85fb7279c44edb5dee47dcfeb
SHA1

426f48491e5e7146ce0e43397c7cc3513a1706e7
SHA256

cafbf35c0d9cf556d2c92086e0145ed092959eb725d6a8134adb9df835ad4a9d
SHA512

c6043fdd816e1922ef0315f0c0d4265f6d381b77061de607506623e3383464b639cb75fe00eb43fe7b3c7f1250bbaa159ece929f8cdf17c1e4974cd9fa54fb87
SSDEEP

24576:M4nXubIQGyxbPV0db268K3q6faXeoubtQo+8YzqNAh3XBQ0FPcQsY8Nl85Xab6s9:Mqe3f6lq6yXeout9+QAPcTYy2Wn

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3284	Star Wars Empire at War Gold Pack.tmp
208	Star Wars Empire at War Gold Pack.tmp
6076	msedgerecovery.exe
6104	MicrosoftEdgeUpdateSetup.exe
4276	MicrosoftEdgeUpdate.exe
5244	MicrosoftEdgeUpdate.exe
5180	MicrosoftEdgeUpdate.exe
5460	MicrosoftEdgeUpdateComRegisterShell64.exe
5476	MicrosoftEdgeUpdateComRegisterShell64.exe
5512	MicrosoftEdgeUpdateComRegisterShell64.exe
4908	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Star Wars Empire at War Gold Pack.tmp

Loads dropped DLL 34 IoCs

pid	Process
4364	msedge.exe
3500	msedge.exe
2480	Process not Found
2404	msedge.exe
3872	msedge.exe
4524	Process not Found
4664	msedge.exe
4280	CompPkgSrv.exe
3040	Process not Found
3444	Process not Found
484	Process not Found
2480	Process not Found
4612	svchost.exe
4292	setup.exe
3436	setup.exe
5168	Process not Found
5220	Process not Found
5332	Process not Found
6028	elevation_service.exe
6136	msedge.exe
4276	MicrosoftEdgeUpdate.exe
5244	MicrosoftEdgeUpdate.exe
5180	MicrosoftEdgeUpdate.exe
5460	MicrosoftEdgeUpdateComRegisterShell64.exe
5460	MicrosoftEdgeUpdateComRegisterShell64.exe
5180	MicrosoftEdgeUpdate.exe
5476	MicrosoftEdgeUpdateComRegisterShell64.exe
5476	MicrosoftEdgeUpdateComRegisterShell64.exe
5180	MicrosoftEdgeUpdate.exe
5512	MicrosoftEdgeUpdateComRegisterShell64.exe
5512	MicrosoftEdgeUpdateComRegisterShell64.exe
5180	MicrosoftEdgeUpdate.exe
4908	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_af.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\MicrosoftEdgeUpdateSetup.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_sk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_as.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\msedgerecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_es.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\psmachine.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\psuser.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_is.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\msedgerecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\psuser_arm64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_kn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_or.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\recovery-component-inner.crx	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_km.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_te.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_da.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_ro.dll	MicrosoftEdgeUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4268	taskkill.exe
176	taskkill.exe
3412	taskkill.exe
4692	taskkill.exe
2188	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass.1\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
208	Star Wars Empire at War Gold Pack.tmp
208	Star Wars Empire at War Gold Pack.tmp
4664	msedge.exe
4664	msedge.exe
3872	msedge.exe
3872	msedge.exe
5232	identity_helper.exe
5232	identity_helper.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
6136	msedge.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
4276	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe
3652	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	176	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	4276	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4276	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3652	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
208	Star Wars Empire at War Gold Pack.tmp
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3284	3248	Star Wars Empire at War Gold Pack.exe	82
PID 3248 wrote to memory of 3284	3248	Star Wars Empire at War Gold Pack.exe	82
PID 3248 wrote to memory of 3284	3248	Star Wars Empire at War Gold Pack.exe	82
PID 3284 wrote to memory of 3552	3284	Star Wars Empire at War Gold Pack.tmp	83
PID 3284 wrote to memory of 3552	3284	Star Wars Empire at War Gold Pack.tmp	83
PID 3284 wrote to memory of 3552	3284	Star Wars Empire at War Gold Pack.tmp	83
PID 3552 wrote to memory of 208	3552	Star Wars Empire at War Gold Pack.exe	84
PID 3552 wrote to memory of 208	3552	Star Wars Empire at War Gold Pack.exe	84
PID 3552 wrote to memory of 208	3552	Star Wars Empire at War Gold Pack.exe	84
PID 208 wrote to memory of 4268	208	Star Wars Empire at War Gold Pack.tmp	85
PID 208 wrote to memory of 4268	208	Star Wars Empire at War Gold Pack.tmp	85
PID 208 wrote to memory of 176	208	Star Wars Empire at War Gold Pack.tmp	87
PID 208 wrote to memory of 176	208	Star Wars Empire at War Gold Pack.tmp	87
PID 208 wrote to memory of 3412	208	Star Wars Empire at War Gold Pack.tmp	89
PID 208 wrote to memory of 3412	208	Star Wars Empire at War Gold Pack.tmp	89
PID 208 wrote to memory of 4692	208	Star Wars Empire at War Gold Pack.tmp	91
PID 208 wrote to memory of 4692	208	Star Wars Empire at War Gold Pack.tmp	91
PID 208 wrote to memory of 2188	208	Star Wars Empire at War Gold Pack.tmp	93
PID 208 wrote to memory of 2188	208	Star Wars Empire at War Gold Pack.tmp	93
PID 208 wrote to memory of 2768	208	Star Wars Empire at War Gold Pack.tmp	95
PID 208 wrote to memory of 2768	208	Star Wars Empire at War Gold Pack.tmp	95
PID 2768 wrote to memory of 2852	2768	cmd.exe	97
PID 2768 wrote to memory of 2852	2768	cmd.exe	97
PID 2768 wrote to memory of 4468	2768	cmd.exe	98
PID 2768 wrote to memory of 4468	2768	cmd.exe	98
PID 208 wrote to memory of 3500	208	Star Wars Empire at War Gold Pack.tmp	99
PID 208 wrote to memory of 3500	208	Star Wars Empire at War Gold Pack.tmp	99
PID 3500 wrote to memory of 4364	3500	msedge.exe	100
PID 3500 wrote to memory of 4364	3500	msedge.exe	100
PID 3500 wrote to memory of 2284	3500	msedge.exe	101
PID 3500 wrote to memory of 2284	3500	msedge.exe	101
PID 2284 wrote to memory of 3872	2284	cmd.exe	103
PID 2284 wrote to memory of 3872	2284	cmd.exe	103
PID 3872 wrote to memory of 2404	3872	msedge.exe	104
PID 3872 wrote to memory of 2404	3872	msedge.exe	104
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106
PID 3872 wrote to memory of 3896	3872	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe
"C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\is-SLO0C.tmp\Star Wars Empire at War Gold Pack.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SLO0C.tmp\Star Wars Empire at War Gold Pack.tmp" /SL5="$D01EE,1078593,780800,C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe
    "C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe" /SILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\is-P312C.tmp\Star Wars Empire at War Gold Pack.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P312C.tmp\Star Wars Empire at War Gold Pack.tmp" /SL5="$E01EE,1078593,780800,C:\Users\Admin\AppData\Local\Temp\Star Wars Empire at War Gold Pack.exe" /SILENT
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill" /F /IM msedge.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill" /F /IM chrome.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:176
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill" /F /IM vivaldi.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill" /F /IM opera.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill" /F /IM brave.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-9GDE9.tmp\install.bat" install"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\system32\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /t REG_SZ /d "C:\Users\Admin\AppData\Local\WindowsApp\ext.dll" /f
        6⤵
        
        PID:2852
      - C:\Windows\system32\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "LoadAppInit_DLLs" /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smashbrowser.com/welcome2.php
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0xd4,0x100,0xf8,0x104,0x7ff9859346f8,0x7ff985934708,0x7ff985934718
        6⤵
        Loads dropped DLL
        
        PID:4364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\WindowsApp\msedge.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\Admin\AppData\Local\WindowsApp\googledoc" --single-argument https://smashbrowser.com/welcome2.php
        7⤵
        Loads dropped DLL
        Adds Run key to start application
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9859346f8,0x7ff985934708,0x7ff985934718
        8⤵
        Loads dropped DLL
        
        PID:2404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
        8⤵
        
        PID:3896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
        8⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
        8⤵
        
        PID:5096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
        8⤵
        
        PID:1500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
        8⤵
        
        PID:4108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
        8⤵
        
        PID:4720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 /prefetch:8
        8⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
        8⤵
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
        8⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
        8⤵
        
        PID:1096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        8⤵
        
        PID:5088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
        8⤵
        
        PID:8
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
        8⤵
        
        PID:1440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6544 /prefetch:8
        8⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
        8⤵
        
        PID:3132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
        8⤵
        
        PID:2248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
        8⤵
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        8⤵
        Loads dropped DLL
        
        PID:4292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff75c5f5460,0x7ff75c5f5470,0x7ff75c5f5480
        9⤵
        Loads dropped DLL
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
        8⤵
        
        PID:5812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:8
        8⤵
        
        PID:5884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1340 /prefetch:8
        8⤵
        
        PID:5980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12217760546464926868,17846312385086420692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
        8⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:6136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Loads dropped DLL
PID:4280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
- Loads dropped DLL
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:6028
- C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\msedgerecovery.exe
  "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={a0b82706-50b0-487a-9d2b-9cdd38f54346} --system
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\MicrosoftEdgeUpdateSetup.exe
    "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:6104
  - - C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
      4⤵
      Executes dropped EXE
      Sets file execution options in registry
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4276
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5180
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:5476
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:5512
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:5460
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDAwMzRCNjUtQkQ4Qi00REE1LUFBNkQtRTdCODAzNzRERjlBfSIgdXNlcmlkPSJ7OTJGNkE3MTQtMDQ3MC00OEY2LUExOTEtRjJFNTFEQ0NEN0ExfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezE0RTNERDczLTNFNzAtNDBGRS04N0U0LTQyQTZCMEE0MUY2Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7bTQ2SzVLNXoxdnZrTkxIcjRjMXgvaENqZTdaUUxkcUt5WjVOd2d6VjNBOD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3NDQxOTg4NSIgaW5zdGFsbF90aW1lX21zPSI3MzEiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4908
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3652

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\MicrosoftEdgeUpdateSetup.exe

Filesize
1.5MB

MD5
f70962a7883fefe8defa224c1ffdadfa

SHA1
efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da

SHA256
3e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4

SHA512
678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\MicrosoftEdgeUpdateSetup.exe

Filesize
1.5MB

MD5
f70962a7883fefe8defa224c1ffdadfa

SHA1
efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da

SHA256
3e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4

SHA512
678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir6028_153820368\msedgerecovery.exe

Filesize
1.1MB

MD5
3b2bd3e2b22afa49576723c819a1185b

SHA1
41a1590e22600c717acd9e376b9020b3021dada6

SHA256
b2900c435244e948491cfab330b570b4326d1879c5c2be2aa35ce8bd49446d05

SHA512
a411b00da74a6c90d0a60a0d9a024a430c2c7483416dc95634bd62c5c29b9c9d1fd3310911f2da85df66aac08e9026df4aad00c083781ca22802b0236652d1d5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
7bcf03ae20f6b4aab6efda45f6a0fa01

SHA1
6f1a63a994568c7cac224c6f44d41d19fe24a2e4

SHA256
23387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6

SHA512
615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
7bcf03ae20f6b4aab6efda45f6a0fa01

SHA1
6f1a63a994568c7cac224c6f44d41d19fe24a2e4

SHA256
23387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6

SHA512
615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
205KB

MD5
fccf8ebd72efacc9566b7849d59512aa

SHA1
2d0cc03e7912578d1c0a01e1d338290a0d1c157e

SHA256
a6a3b7b77ec3fcbdd07b516457fcc7368282ed84e04792316d2ceeeb3b6c84fb

SHA512
6e0b2e27ae19c3100b789b8b22eb307072a902878d92cea426ac02c07c8338934b49c57012a858e01816617ec6c41ef39b7a390e63c8975e56c4504faa8b6b3a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
250KB

MD5
524a95f05f4c0def70fa61a5f0717e9c

SHA1
6ee3b87e60e865d21bc1b5e434fea12fe262c315

SHA256
e17a7d9e0dcb1a3d6a21009f8d9b41fe1986312d79ffc6728c6c3f500dd6434f

SHA512
cc5e21ce182489416c906fb3f16e808554b739908916682cef6afe11a748b02382bfb93d1359cdc0794c2fb4b6f3cb9d9c677215a904be79d4b1df573de99089

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
5f4cdf4268be23a984ee0b2feaad3dd3

SHA1
cc5aabfc567971d7d2b7a0a206925a59de79dad5

SHA256
bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92

SHA512
41803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
5f4cdf4268be23a984ee0b2feaad3dd3

SHA1
cc5aabfc567971d7d2b7a0a206925a59de79dad5

SHA256
bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92

SHA512
41803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUE431.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
ca88ea1e6a8ee2379ea2c8459c2b99e5

SHA1
dcf468473aa7ece0f106ab34bd7ae633097153d4

SHA256
1e61386dff70de6dabc71ec5d13f8d77ae7e1ac7350f6cc7977603415f29c46a

SHA512
d51e59ceb1e99f771ae7f45c986f77f9471e120b27f777056fb12e3b6add87e2540b838cf86ff5fcb76794f4eb5d922c72410204baa5ca3635f4f6157efc20b0

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
117KB

MD5
1792aab7695061cff94d17270a30e0b0

SHA1
03eb071bb04e83e2bfe8405b8d342e065e7cc7d3

SHA256
22406abff79368d9672044e777dfef4df8ddc3d3288676c28a7dd5c6bfde70e4

SHA512
c6a2a6333079a281309cd91ffd8ffed9947fa5024bb9c970cd636e6910dae924695857e814974853a2b62065f43c2c4d0fca2fb4be7a6d819c649e2bc788c5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.169.31\recovery-component-inner.crx

Filesize
1.9MB

MD5
dcb0ab396e869708ca1ca663c6697b50

SHA1
83d2d79250a470d8c140259688ee35e6019c60f0

SHA256
083c44f154565469a742fe081b09ab19eb5f2a986936dbcef55ddd21f79e6beb

SHA512
e598653b4e6fa16f7ca3a96b44cc279fb010555102c3b661a88e44f6750242e43293a54af25c187445a6f65f7979d556285c16a0294530978f97327f8c1bdd68

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9GDE9.tmp\install.bat

Filesize
335B

MD5
bfffeea4a5bc13062b6c4108cc8e90e0

SHA1
d6582a2e4d1e1f79bc40c3432343ae63f12886cb

SHA256
6ab2311de65c8ec6fa42c01b9cbe8443b16304076e51b005b87aea95e50b5be2

SHA512
9e6db3da7f20baf83c43e1ba9e0bb259aaaf157ad6d126376af69433bab9c88b1fbac7818e72465fb9984b16de5ce071c03e40918fd48816e6384d1255ed78de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P312C.tmp\Star Wars Empire at War Gold Pack.tmp

Filesize
2.9MB

MD5
4193a1ba05847842590be08bec38cc72

SHA1
6a294d185949a7f8655805484fe6f6b522a8077a

SHA256
2aded9b00081dd6bcb376f99af5d5462a70c567682c425e5ca9734506058c686

SHA512
53acb9b81a9cb0c8b3cd1e0e44f602378c1faa6e1356c4cbcd3a5c625e5e18af892bb9181e1cb3423b7548b542d23a523484483bab25c872a94372e6493f0465

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SLO0C.tmp\Star Wars Empire at War Gold Pack.tmp

Filesize
2.9MB

MD5
4193a1ba05847842590be08bec38cc72

SHA1
6a294d185949a7f8655805484fe6f6b522a8077a

SHA256
2aded9b00081dd6bcb376f99af5d5462a70c567682c425e5ca9734506058c686

SHA512
53acb9b81a9cb0c8b3cd1e0e44f602378c1faa6e1356c4cbcd3a5c625e5e18af892bb9181e1cb3423b7548b542d23a523484483bab25c872a94372e6493f0465

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\ext.dll

Filesize
604KB

MD5
f47a4502345fb39e35b4b7d7fb1c8e55

SHA1
efe7798ad5c8d77f36cacdc1a65c22ca8792b09f

SHA256
e788ffef53cedbcc81fa19933a0940a5d5110a8f2abff32d0fd6050f113be4d9

SHA512
cbd76e7537e6e31ac890121c73338774e4eddeaefb5ee3ca6c7285288f5da00abc4e8e9b1949e1e6f2f633bcaaef4be918e2b84a6a0a046796ce9cbe94b72d72

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\googledoc\bg\background.js

Filesize
6KB

MD5
9e14a24dabf427581be3933a700715e6

SHA1
2f4a29e39a69944d6a954ecce21607f5ce8e2a1e

SHA256
0ade971ae68ae6d818e9837ab8c6d4d603ac0bb3d23aa78a0f5d1b91706e155e

SHA512
5292b9e01c044cbbcdbb1e3a558fba3542a577d3d54e1282282d1c13d1a10bed440d602657d25014249b74ec3f8ea1ef506c47c0c00ef01c9d7d37dd72fb3d09

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\googledoc\content\content.js

Filesize
200B

MD5
ff37aa59e917ceee50daa3cbde887227

SHA1
e08df02276b4203a59c7de2e5c935f71efa4b905

SHA256
d5e3087257045d015dd02186cba8427946b174eaaa40f180f3b017ba9d6c8837

SHA512
5c12a0eb62617e97b6fbfd5439a571c80376cd60ebfe3498f92d3a395e13534f38f43f060cba2130929c149408adde84402de1e5bf9b2641aa071acb9ee9e889

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\googledoc\img\logo\logo-16.png

Filesize
4KB

MD5
913064adaaa4c4fa2a9d011b66b33183

SHA1
99ea751ac2597a080706c690612aeeee43161fc1

SHA256
afb4ce8882ef7ae80976eba7d87f6e07fcddc8e9e84747e8d747d1e996dea8eb

SHA512
162bf69b1ad5122c6154c111816e4b87a8222e6994a72743ed5382d571d293e1467a2ed2fc6cc27789b644943cf617a56da530b6a6142680c5b2497579a632b5

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\googledoc\manifest.json

Filesize
1KB

MD5
2e476e45652fb02a6991a0090eaf5b6a

SHA1
445f5c1bf2f89824575b87149bf8d5b403fd5928

SHA256
beefb9d3af534d2fdd069dbe4b2b72b0e840f1a8bcf676d06746321a73216dd6

SHA512
47913c10c3ccffa2904f5c9d40c43f386eab4030e0eab9ebefcc54fadb07b9a0f9d7d667d8d72edfa2c925ee1b1cc0e93ce0af974db5428cc9703973093f4841

Download Submit
C:\Users\Admin\AppData\Local\WindowsApp\msedge.bat

Filesize
203B

MD5
dcdca8356ab652685979a450da51f1aa

SHA1
663dbd56ade2c6892260884ac11e3aa4e87ffc2d

SHA256
d782b36aa427c0b14ae261013283f25bc8730b1dbbc397f864bc8d37bc5b304b

SHA512
a03c885d97906c807bfef667f0f125825d8a3046091e403c5e1bfeeb4d5a6ab0471d7c8ab964f4f5c1e9e79e89423e19324c962e1d7d677e525b3f8ad59c2bbf

Download Submit
memory/3248-140-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3248-134-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3248-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3552-154-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3552-138-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download