Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 16:30
Static task
static1
Behavioral task
behavioral1
Sample
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe
Resource
win10v2004-20220901-en
General
-
Target
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe
-
Size
149KB
-
MD5
6701afef3227aa7daa28f8a416981a2f
-
SHA1
fea537b3cee11bcc2b3eb5eb68636124b2c8b985
-
SHA256
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c
-
SHA512
eb3d60095245e11f545c85763fd9cb24dc0eaab72feb463f29b4393b307b541fae8525401b893c31aef5355a8ee440d95544983b606e1377adbab8b89b020535
-
SSDEEP
3072:rNCFuCMZ69PLIA9oeWzPybSDljAc11koaAL9a3UhoG:rgFuzZ690Blza2BAc1KDAL9a3Qo
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-133-0x00000000005D0000-0x00000000005D9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
resource yara_rule behavioral1/memory/2200-315-0x0000000000400000-0x000000000052A000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
41CD.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 41CD.exe -
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 2 IoCs
Processes:
MicrosoftEdgeUpdate.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
41CD.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 41CD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 41CD.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
59AD.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 59AD.exe -
Executes dropped EXE 17 IoCs
Processes:
3151.exe41CD.exe478A.exe52A7.exe59AD.exe59AD.exe59AD.exemsedgerecovery.exeMicrosoftEdgeUpdateSetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 1088 3151.exe 5048 41CD.exe 1292 478A.exe 2820 52A7.exe 2424 59AD.exe 1572 59AD.exe 2200 59AD.exe 1572 msedgerecovery.exe 2424 MicrosoftEdgeUpdateSetup.exe 2744 MicrosoftEdgeUpdate.exe 4552 MicrosoftEdgeUpdate.exe 2796 MicrosoftEdgeUpdate.exe 440 MicrosoftEdgeUpdateComRegisterShell64.exe 4756 MicrosoftEdgeUpdateComRegisterShell64.exe 3420 MicrosoftEdgeUpdateComRegisterShell64.exe 2012 MicrosoftEdgeUpdate.exe 4484 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 11 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exepid process 2744 MicrosoftEdgeUpdate.exe 4552 MicrosoftEdgeUpdate.exe 2796 MicrosoftEdgeUpdate.exe 440 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 4756 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 3420 MicrosoftEdgeUpdateComRegisterShell64.exe 2796 MicrosoftEdgeUpdate.exe 2012 MicrosoftEdgeUpdate.exe 4484 MicrosoftEdgeUpdate.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/5048-236-0x00000000005A0000-0x0000000000DD4000-memory.dmp agile_net -
Registers COM server for autorun 1 TTPs 33 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\41CD.exe themida C:\Users\Admin\AppData\Local\Temp\41CD.exe themida behavioral1/memory/5048-236-0x00000000005A0000-0x0000000000DD4000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Processes:
41CD.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 41CD.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
478A.exe59AD.exedescription pid process target process PID 1292 set thread context of 1620 1292 478A.exe AppLaunch.exe PID 2424 set thread context of 2200 2424 59AD.exe 59AD.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MicrosoftEdgeUpdateSetup.exeelevation_service.exesetup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdateCore.exe MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_fa.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_zh-TW.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_af.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_iw.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_lt.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_lb.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_uk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_cy.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_tt.dll MicrosoftEdgeUpdateSetup.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdateSetup.exe MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_te.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_vi.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bs.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_mr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_cs.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_lv.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bn-IN.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_da.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\psmachine_arm64.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ca.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ru.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ca-Es-VALENCIA.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_fr-CA.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bg.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_quz.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_sr-Latn-RS.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\msedgerecovery.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_es.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_et.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ml.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_az.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_mk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\psuser_64.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ko.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_kok.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_or.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_hr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_nb.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\psuser.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\EdgeUpdate.dat MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_el.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_en-GB.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_es-419.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_is.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_zh-CN.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ka.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\MicrosoftEdgeUpdateSetup.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\psuser_arm64.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ms.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_gd.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_sr-Cyrl-BA.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\recovery-component-inner.crx elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_fr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_sr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_tr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_as.dll MicrosoftEdgeUpdateSetup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230217163158.pma setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ja.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_nl.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ro.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_kk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_mi.dll MicrosoftEdgeUpdateSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Processes:
52A7.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityModeType = "843436559" 52A7.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class" MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exepid process 1712 b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe 1712 b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exeexplorer.exepid process 1712 b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe 3004 3004 3004 3004 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3004 3004 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 1664 powershell.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
msedge.exepid process 1376 msedge.exe 3004 3004 1376 msedge.exe 3004 1376 msedge.exe 3004 3004 3004 3004 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
52A7.exepid process 2820 52A7.exe 2820 52A7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
41CD.exemsedge.exeexplorer.exedescription pid process target process PID 3004 wrote to memory of 1088 3004 3151.exe PID 3004 wrote to memory of 1088 3004 3151.exe PID 3004 wrote to memory of 5048 3004 41CD.exe PID 3004 wrote to memory of 5048 3004 41CD.exe PID 3004 wrote to memory of 5048 3004 41CD.exe PID 3004 wrote to memory of 1292 3004 478A.exe PID 3004 wrote to memory of 1292 3004 478A.exe PID 3004 wrote to memory of 1292 3004 478A.exe PID 3004 wrote to memory of 2820 3004 52A7.exe PID 3004 wrote to memory of 2820 3004 52A7.exe PID 5048 wrote to memory of 1376 5048 41CD.exe msedge.exe PID 5048 wrote to memory of 1376 5048 41CD.exe msedge.exe PID 1376 wrote to memory of 3856 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3856 1376 msedge.exe msedge.exe PID 3004 wrote to memory of 2424 3004 59AD.exe PID 3004 wrote to memory of 2424 3004 59AD.exe PID 3004 wrote to memory of 2424 3004 59AD.exe PID 3004 wrote to memory of 4212 3004 explorer.exe PID 3004 wrote to memory of 4212 3004 explorer.exe PID 3004 wrote to memory of 4212 3004 explorer.exe PID 3004 wrote to memory of 4212 3004 explorer.exe PID 3004 wrote to memory of 3060 3004 explorer.exe PID 3004 wrote to memory of 3060 3004 explorer.exe PID 3004 wrote to memory of 3060 3004 explorer.exe PID 3060 wrote to memory of 1376 3060 explorer.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe PID 1376 wrote to memory of 3852 1376 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe"C:\Users\Admin\AppData\Local\Temp\b2342e0ebf939d7d7e81ff782b4539b84fed2ca4e418e965f0cb8552a860fe5c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3151.exeC:\Users\Admin\AppData\Local\Temp\3151.exe1⤵
- Executes dropped EXE
PID:1088
-
C:\Users\Admin\AppData\Local\Temp\41CD.exeC:\Users\Admin\AppData\Local\Temp\41CD.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=41CD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe940746f8,0x7ffe94074708,0x7ffe940747183⤵PID:3856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:23⤵PID:3852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:33⤵PID:1300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:83⤵PID:1452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵PID:4908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:1208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:13⤵PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:13⤵PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:13⤵PID:3772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 /prefetch:83⤵PID:4396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:13⤵PID:3056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:13⤵PID:4308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4320 /prefetch:83⤵PID:932
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:83⤵PID:4284
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4992 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff702bc5460,0x7ff702bc5470,0x7ff702bc54804⤵PID:2916
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:83⤵PID:2364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:83⤵PID:4632
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,1519324157680464452,4455195525464600594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:83⤵PID:1512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=41CD.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵PID:1732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffe940746f8,0x7ffe94074708,0x7ffe940747183⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\478A.exeC:\Users\Admin\AppData\Local\Temp\478A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1292 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\52A7.exeC:\Users\Admin\AppData\Local\Temp\52A7.exe1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
C:\Users\Admin\AppData\Local\Temp\59AD.exeC:\Users\Admin\AppData\Local\Temp\59AD.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\59AD.exeC:\Users\Admin\AppData\Local\Temp\59AD.exe2⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\59AD.exeC:\Users\Admin\AppData\Local\Temp\59AD.exe2⤵
- Executes dropped EXE
PID:2200
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4212
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4652
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1148
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5056
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3140
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4528
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4396
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:2872 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\msedgerecovery.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={a48af4c8-d888-46dc-99e2-e66552839df5} --system2⤵
- Executes dropped EXE
PID:1572 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\MicrosoftEdgeUpdateSetup.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2424 -
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4552 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2796 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:440 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4756 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3420 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDZBRkU4RTQtMzE2NC00MDg1LUExMEMtRjEyQzRDMjAwRjM2fSIgdXNlcmlkPSJ7RDhBNDA1RkUtQTlEQS00REY3LUFDNEYtRDEzMjE1N0FCQjE4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezUyODFCODNFLTZDMzUtNDQzMS05NTlELTk4M0FDOTFDQTRFN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7bTQ2SzVLNXoxdnZrTkxIcjRjMXgvaENqZTdaUUxkcUt5WjVOd2d6VjNBOD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTYwNTI2MDE4OCIgaW5zdGFsbF90aW1lX21zPSIxMDAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\MicrosoftEdgeUpdateSetup.exeFilesize
1.5MB
MD5f70962a7883fefe8defa224c1ffdadfa
SHA1efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da
SHA2563e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4
SHA512678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\MicrosoftEdgeUpdateSetup.exeFilesize
1.5MB
MD5f70962a7883fefe8defa224c1ffdadfa
SHA1efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da
SHA2563e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4
SHA512678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761
-
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir2872_976638330\msedgerecovery.exeFilesize
1.1MB
MD53b2bd3e2b22afa49576723c819a1185b
SHA141a1590e22600c717acd9e376b9020b3021dada6
SHA256b2900c435244e948491cfab330b570b4326d1879c5c2be2aa35ce8bd49446d05
SHA512a411b00da74a6c90d0a60a0d9a024a430c2c7483416dc95634bd62c5c29b9c9d1fd3310911f2da85df66aac08e9026df4aad00c083781ca22802b0236652d1d5
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\EdgeUpdate.datFilesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeComRegisterShellARM64.exeFilesize
172KB
MD5b462ad181104b32ec56a6a1e1aa25622
SHA1c26dbc70359be470fb63d50e12528e473749d9f7
SHA2565b95e7e42a2df4c8cb8a1dfc9e71f81831ffc128408ad1a37f83ab76dcdf1afb
SHA5125f6b37f4e88b617ca68762706423e38da4eccb820e82635eda3ed269efeb92ae3285e0b1285978f35dd8df004c801ebbca2f7c061ae055070bdbcba88c474e70
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdate.exeFilesize
200KB
MD57bcf03ae20f6b4aab6efda45f6a0fa01
SHA16f1a63a994568c7cac224c6f44d41d19fe24a2e4
SHA25623387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6
SHA512615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdate.exeFilesize
200KB
MD57bcf03ae20f6b4aab6efda45f6a0fa01
SHA16f1a63a994568c7cac224c6f44d41d19fe24a2e4
SHA25623387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6
SHA512615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeFilesize
205KB
MD5fccf8ebd72efacc9566b7849d59512aa
SHA12d0cc03e7912578d1c0a01e1d338290a0d1c157e
SHA256a6a3b7b77ec3fcbdd07b516457fcc7368282ed84e04792316d2ceeeb3b6c84fb
SHA5126e0b2e27ae19c3100b789b8b22eb307072a902878d92cea426ac02c07c8338934b49c57012a858e01816617ec6c41ef39b7a390e63c8975e56c4504faa8b6b3a
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\MicrosoftEdgeUpdateCore.exeFilesize
250KB
MD5524a95f05f4c0def70fa61a5f0717e9c
SHA16ee3b87e60e865d21bc1b5e434fea12fe262c315
SHA256e17a7d9e0dcb1a3d6a21009f8d9b41fe1986312d79ffc6728c6c3f500dd6434f
SHA512cc5e21ce182489416c906fb3f16e808554b739908916682cef6afe11a748b02382bfb93d1359cdc0794c2fb4b6f3cb9d9c677215a904be79d4b1df573de99089
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\NOTICE.TXTFilesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdate.dllFilesize
2.0MB
MD55f4cdf4268be23a984ee0b2feaad3dd3
SHA1cc5aabfc567971d7d2b7a0a206925a59de79dad5
SHA256bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92
SHA51241803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdate.dllFilesize
2.0MB
MD55f4cdf4268be23a984ee0b2feaad3dd3
SHA1cc5aabfc567971d7d2b7a0a206925a59de79dad5
SHA256bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92
SHA51241803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_af.dllFilesize
28KB
MD5c7872f08802f693ed9fc16ea960789f6
SHA1b0b8e4dfbe1dc76e4903216948374e1356d33e53
SHA256de5d1223ffd38be89cd576b0de036760f8a84c231eb97f1d7f74dfcf4b41fb19
SHA512339520bea363a1ea34e75755c70f4b1f6a189e7084ca9d5c6189d769965ae1fd0b093b948dffe3d256dd82591bdb2b3627ed20e747a2505377babc34eb94a0e6
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_am.dllFilesize
24KB
MD56dee4281b2d0dc43c8eac5afde5dc5b2
SHA135584539f94fa4a91229b8d810f1d5c0207d9ef8
SHA256b0fc60e07fa8fcfa0a174f1f5fc3a303d5498669eba846d51731494e9f86e46e
SHA512de6a54e08c1a7c2a77a26f9de11a8e25b30f3d275fd4b72fb068ec3a5c0fd2072cc02a33b4581ba0dd565963bb834c5da831013d9ffb4386d0fc59935c184079
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ar.dllFilesize
26KB
MD5c5e0d596829abbf221a7e2fcc3f37059
SHA12a55fc6e9110d0bc5d735bd98e56241e416dd5eb
SHA2569e3a04823e12f15954f1082ec019e29e1821d03db69fbaf9c906be28c8cf4fcf
SHA512518a004482c590d87e104be80dcb12455379ac855a53bdfb94023041fac16e4806e4c78f28716f179031d62b21912cdf4be8b43b2a13747acc8e9a745dd6333b
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_as.dllFilesize
28KB
MD5f344ea79294c175a3233be3c7bd4f7ab
SHA142f4d616f0b48828b629ffb384249edc76fea3a9
SHA25636551c9271d084f31facbd342a0a0b5e530a2070e7de34c42ef2987633134b99
SHA512dac1c65916fbca857dc8b5a0a3ef9c6abd5090e2c99ada98809d6cf04d09d4b9d63256e4a57754960476896ea46027cfb06bbb3ae68df573b207ca267d4efe94
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_az.dllFilesize
29KB
MD534c97ccc6da86fa0fc6aca8102115683
SHA123c30d6f41bbfccb40d5209d70999384f3d59893
SHA256205be42f8590a17ce1a0da594c818f84ef8cc19f8f54cd74acd16ddf7df11684
SHA5127100e92fd948b75f7d134e813a836ce9691e6994f989b6d53255b17e3fca5be55cf69c50ef01e625a8f85a764bfafcf49bc5f82d229bf44168bf89b953c1642c
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bg.dllFilesize
29KB
MD583976f605267f63c512741c90085ef37
SHA1e1907443ecf114b1b2d4b5fb622ca6fcba0d6b2c
SHA2568e7bc240557c0f4058fb3380d01584eb5b9ad69ac5fd2f7a56bf2293dafd6069
SHA512d5713af38add972fc04c1b1b7aca033532c50c31e8d1e3c0e889d69c94ff2d2ecdec95edabf4717a4bc649f2d68a5b1a77dac0355bf493eefe2cf86b7b53ba84
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bn-IN.dllFilesize
29KB
MD5055acbbed4580bb0c2b15ad8407f34c5
SHA1cf7c3539d97090b33ea5cb7d4880dd1b28c259f3
SHA256edb350193ce5ee7984cd11d446ee5848879e6447b08a6e9353a8310a1574bce7
SHA51211e9e78b28e868781b355de473c157f4fbf1b8f30e3cae6f19aa895a456e7876827ff859ee4bc65215b73ed27eac67c139a1cfc887adee0f7fa1c2c446962311
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bn.dllFilesize
29KB
MD589d1459c67621ae933ea973c36c86830
SHA17793109fad9c7d6e267046be6f188262d6655736
SHA256faa59f14007729085711f504f3580b5d1f289d9d6b8a57ecaa6b7980d9b3b9e8
SHA51295e333c1d28ba10df6e95e7bcf80fd1cd3fb7e32aa72b1749a4983c762fa227915d49547c5be114a471072d21a5f9c87c24bd6f45e8a711cbecc1074a3cefd7b
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_bs.dllFilesize
28KB
MD5a2ae01f60764eb9717c2e843bdd40c43
SHA1f611b0f880d1dc52a5ff996b5106c8c0bdd7cf68
SHA2569542302df51fad8c1095f6068378608b8edc89a633b30d26cae0e0fcb4515da3
SHA512e12d3634bd8738865ea210775d78e53c5a30e74dca39655882c2464d1f9a1ac4a96a7608e57a92ff3b7b6a77750ab24ff12df59e5006b18c1f83cc270760bad5
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ca-Es-VALENCIA.dllFilesize
29KB
MD597fe80b8bc29698d3dd3912878d8a785
SHA1580f290f32bf083f9485e06165fcc751ae181be0
SHA256c382b8fe1abc83ebe97e66a3d4737ab66a7210a59fc0d18f9fc8b6735771b247
SHA51208f56d8759721b0241d60a532e9634bc98aebcb7e7c251630adc1c93d28d40158a6f3bafc32f19cf9aa27ad5ba6e42f58bc2c8361e1ff97aa2ddf05c0147d248
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_ca.dllFilesize
30KB
MD52293c9a1af6be53ef61f8fc168e181d7
SHA1f37155a592bcb1cbaeb67509b36797087d228b8b
SHA2560b00898937e1f40415a42a8aa4dcf4ea396c40083abfe04fd141edcdd1d35600
SHA512ac4c27db8296283292d06e0d152434f18a227c4d68294ef52ca473736458724df374f20ce88d214486d7027696d081203e92fb98c682e531071b9ae6d9703d22
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_cs.dllFilesize
28KB
MD5b09754ee0b3048dc68584bfe0f631ea1
SHA187a2426414fdd52fc39679f6958379482ca3dde4
SHA2569dcf2f8fba4c3bf4b194e3b27e5ef572e573a638d5c71e3ae4a154ddb62a91a7
SHA5125d0d9b653184a41cff580683c16b4f67514bfa04987ee650c1d9ade4b12f5eb125fe44aa6e1a5e689423f62e755c460fc4886eac08c0e72fbd64fd9573212d4c
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_cy.dllFilesize
28KB
MD57df1f9bf10766cba6f2b6d48e4dae8e3
SHA10008dbaa46d83ffe8d4a9d536a61a5109d74ca8d
SHA25618827570bad9f879f6853438bcd0e379518531bafbfac2bb626dc1cc13711596
SHA512bd8ee85d664c1480240e89c05d3639b5650aecb056263b75d7d37168bf6b6dada04145f42075e5ef0841efa9417880e8f9697e4ca71f20eaecfebd98e6b61f1c
-
C:\Program Files (x86)\Microsoft\Temp\EUD7CD.tmp\msedgeupdateres_en.dllFilesize
27KB
MD5ca88ea1e6a8ee2379ea2c8459c2b99e5
SHA1dcf468473aa7ece0f106ab34bd7ae633097153d4
SHA2561e61386dff70de6dabc71ec5d13f8d77ae7e1ac7350f6cc7977603415f29c46a
SHA512d51e59ceb1e99f771ae7f45c986f77f9471e120b27f777056fb12e3b6add87e2540b838cf86ff5fcb76794f4eb5d922c72410204baa5ca3635f4f6157efc20b0
-
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logFilesize
116KB
MD546e4df5f429115137146904b04e3aa64
SHA10179c094f5012d6b10702001d937cb9213bb2bd9
SHA256dcae11b749211cc2c357e5d940d636ce1455368baaa190ba693f2594a65a930e
SHA512d31f359f6dbbccf58d0600e346b4d03c516dc88cbe8b42d51c2c16d67d1a9eafb97519dfed8790ff57419f8dde705ea04f9eda312a7943d6c488f7b51e15c4a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\59AD.exe.logFilesize
1KB
MD59e39b702ddcbdc603ad47b9d318dce62
SHA131709fbc20df043f4699fc3b288ce9bccd666b94
SHA256b91057818a6617ee8e0c725d144403d30226b04d8181fed08cf0e5d634ee6388
SHA512bab6b606b18f68e775d5a4fc2033adb1f228f66fe7103fe49a58dc7349227769df14d53b665615c7a9fb0cf2bbf679d5aa1ff2e97b0200d0a3603f8aebb9f533
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5248831967cd174eeb5bb5eba173da6a5
SHA181c9c24d106aeb26f4ae1dcd0866ec7ed6d81d99
SHA2563752c2ea4a6ba3d1a5b7545246c430a37cc79c8fdd60c82b4d0200ce083cf9c3
SHA51207cd5594939f896098976a4fec9dd1005fa031637697187f9a038b65ecb46d9d9d5fab3e51f7eade64c369e8a885c0c8e9b76efc71e3ed3c4e613c623b09425d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5d7672ef268f7808d7f0e125a423aac1b
SHA17e47f066ace8bd31b44fe44600592aee1392cd11
SHA256b027bfa8fe369f5af3bd665234514fffe44b504a5360b6a58d5ffe75876c603b
SHA5121c752fbf8e7a0281a8cd9c21a1f49a07ca1284fa08a0da35ad29ab15303dba89dc8e24e8db4f593639f058b3f1600053c180e1a26b5fd5498c68157a7967c955
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.169.31\recovery-component-inner.crxFilesize
1.9MB
MD5dcb0ab396e869708ca1ca663c6697b50
SHA183d2d79250a470d8c140259688ee35e6019c60f0
SHA256083c44f154565469a742fe081b09ab19eb5f2a986936dbcef55ddd21f79e6beb
SHA512e598653b4e6fa16f7ca3a96b44cc279fb010555102c3b661a88e44f6750242e43293a54af25c187445a6f65f7979d556285c16a0294530978f97327f8c1bdd68
-
C:\Users\Admin\AppData\Local\Temp\3151.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\3151.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\41CD.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\41CD.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\478A.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\478A.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\52A7.exeFilesize
6.4MB
MD53e9adb4d8dbec6eddee3065caf5911f6
SHA131c7111c8044afdf5c6ddb1e55244acfd06229d3
SHA256215426d36754e9d391ae8ccabb74de1489fb8c18a127fec02a5be4e45462a7a5
SHA512b62f413092028a3bdbc4ee7f6a085e881f51ed68c28d2950d1665cb4ecb1170f173a6003660b3c0d6629cc85f6f4b0e28dedd42c839ebbb29343b46a4f474ff9
-
C:\Users\Admin\AppData\Local\Temp\52A7.exeFilesize
6.4MB
MD53e9adb4d8dbec6eddee3065caf5911f6
SHA131c7111c8044afdf5c6ddb1e55244acfd06229d3
SHA256215426d36754e9d391ae8ccabb74de1489fb8c18a127fec02a5be4e45462a7a5
SHA512b62f413092028a3bdbc4ee7f6a085e881f51ed68c28d2950d1665cb4ecb1170f173a6003660b3c0d6629cc85f6f4b0e28dedd42c839ebbb29343b46a4f474ff9
-
C:\Users\Admin\AppData\Local\Temp\59AD.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\59AD.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\59AD.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\59AD.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD50c4d4a69a85d1d9e7335748e982b654e
SHA191c4350417ec1fcb6280bcce36f101b58df8267a
SHA256f40dfba5e6998636430d7ba636c0f4dc4d894e1f2299e5932b2be74f32406fb2
SHA51242eb1be0678ed0c1b253fc1e4ea62f4366c01789c9565b79b68f882e83f1b7c7193b14dd87347acde10bfb1e1387991b84ab5b28cccb9d968f69bfd913bf9d2e
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD557397c8dffad4d4fa2d0168c42fe49f6
SHA16573cbd0de963ece703fb0cd5f76b2f545a44bb4
SHA256150893ac49a5d2fad8bf15ba3958773eefb0456f46076fca37907da148476b40
SHA512a390295024fac209ba44dcc50d6f3ff606010af860b7d6256850aaece46d88a22198011dbc068ecb4825150536d34c2474444ddfa7ef4cee9a34f4147dc6bd5a
-
\??\pipe\LOCAL\crashpad_1376_MAQLUAZRBACPRCTSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/440-355-0x0000000000000000-mapping.dmp
-
memory/796-235-0x0000000000000000-mapping.dmp
-
memory/932-290-0x0000000000000000-mapping.dmp
-
memory/1036-239-0x00000000008D0000-0x00000000008DC000-memory.dmpFilesize
48KB
-
memory/1036-229-0x0000000000000000-mapping.dmp
-
memory/1036-237-0x00000000008E0000-0x00000000008E6000-memory.dmpFilesize
24KB
-
memory/1088-180-0x0000000000BD0000-0x0000000000BD8000-memory.dmpFilesize
32KB
-
memory/1088-182-0x00007FFE93650000-0x00007FFE94111000-memory.dmpFilesize
10.8MB
-
memory/1088-177-0x0000000000000000-mapping.dmp
-
memory/1148-240-0x0000000000000000-mapping.dmp
-
memory/1148-253-0x0000000000920000-0x0000000000947000-memory.dmpFilesize
156KB
-
memory/1148-250-0x0000000000950000-0x0000000000972000-memory.dmpFilesize
136KB
-
memory/1208-232-0x0000000000000000-mapping.dmp
-
memory/1292-192-0x0000000000000000-mapping.dmp
-
memory/1300-244-0x00000260CB100000-0x00000260CB10F000-memory.dmpFilesize
60KB
-
memory/1300-216-0x0000000000000000-mapping.dmp
-
memory/1376-224-0x000001F066A10000-0x000001F066A1F000-memory.dmpFilesize
60KB
-
memory/1376-198-0x0000000000000000-mapping.dmp
-
memory/1452-248-0x00000232D54A0000-0x00000232D54AF000-memory.dmpFilesize
60KB
-
memory/1452-222-0x0000000000000000-mapping.dmp
-
memory/1512-321-0x0000000000000000-mapping.dmp
-
memory/1572-312-0x0000000000000000-mapping.dmp
-
memory/1572-323-0x0000000000000000-mapping.dmp
-
memory/1620-291-0x0000000006010000-0x0000000006060000-memory.dmpFilesize
320KB
-
memory/1620-258-0x0000000000000000-mapping.dmp
-
memory/1620-271-0x0000000004E60000-0x0000000004E9C000-memory.dmpFilesize
240KB
-
memory/1620-259-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1620-270-0x0000000004F30000-0x000000000503A000-memory.dmpFilesize
1.0MB
-
memory/1620-269-0x0000000004E00000-0x0000000004E12000-memory.dmpFilesize
72KB
-
memory/1620-268-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/1664-273-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/1664-272-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/1664-256-0x00000000049F0000-0x0000000004A26000-memory.dmpFilesize
216KB
-
memory/1664-279-0x0000000005F80000-0x0000000005F9E000-memory.dmpFilesize
120KB
-
memory/1664-283-0x0000000007590000-0x0000000007C0A000-memory.dmpFilesize
6.5MB
-
memory/1664-284-0x0000000006470000-0x000000000648A000-memory.dmpFilesize
104KB
-
memory/1664-241-0x0000000000000000-mapping.dmp
-
memory/1664-264-0x0000000005060000-0x0000000005688000-memory.dmpFilesize
6.2MB
-
memory/1712-134-0x0000000000400000-0x0000000000556000-memory.dmpFilesize
1.3MB
-
memory/1712-132-0x0000000000661000-0x0000000000674000-memory.dmpFilesize
76KB
-
memory/1712-133-0x00000000005D0000-0x00000000005D9000-memory.dmpFilesize
36KB
-
memory/1712-135-0x0000000000400000-0x0000000000556000-memory.dmpFilesize
1.3MB
-
memory/1732-230-0x0000000000000000-mapping.dmp
-
memory/2012-358-0x0000000000000000-mapping.dmp
-
memory/2200-315-0x0000000000400000-0x000000000052A000-memory.dmpFilesize
1.2MB
-
memory/2200-314-0x0000000000000000-mapping.dmp
-
memory/2364-304-0x0000000000000000-mapping.dmp
-
memory/2396-226-0x0000000000E20000-0x0000000000E29000-memory.dmpFilesize
36KB
-
memory/2396-233-0x0000000000E30000-0x0000000000E35000-memory.dmpFilesize
20KB
-
memory/2396-223-0x0000000000000000-mapping.dmp
-
memory/2424-209-0x0000000005430000-0x00000000059D4000-memory.dmpFilesize
5.6MB
-
memory/2424-325-0x0000000000000000-mapping.dmp
-
memory/2424-200-0x0000000000000000-mapping.dmp
-
memory/2424-204-0x0000000000410000-0x00000000005A0000-memory.dmpFilesize
1.6MB
-
memory/2424-212-0x0000000004F60000-0x0000000004FF2000-memory.dmpFilesize
584KB
-
memory/2424-217-0x0000000005A30000-0x0000000005A52000-memory.dmpFilesize
136KB
-
memory/2744-328-0x0000000000000000-mapping.dmp
-
memory/2796-354-0x0000000000000000-mapping.dmp
-
memory/2820-195-0x0000000000000000-mapping.dmp
-
memory/2916-305-0x0000000000000000-mapping.dmp
-
memory/2992-243-0x0000000000000000-mapping.dmp
-
memory/3004-141-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-169-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-183-0x0000000007C60000-0x0000000007C70000-memory.dmpFilesize
64KB
-
memory/3004-172-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-171-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-152-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-153-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-154-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-155-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-156-0x0000000002700000-0x0000000002710000-memory.dmpFilesize
64KB
-
memory/3004-136-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-207-0x0000000007C60000-0x0000000007C70000-memory.dmpFilesize
64KB
-
memory/3004-137-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-138-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-184-0x0000000007CE0000-0x0000000007CF0000-memory.dmpFilesize
64KB
-
memory/3004-139-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-208-0x0000000007C60000-0x0000000007C70000-memory.dmpFilesize
64KB
-
memory/3004-157-0x0000000002700000-0x0000000002710000-memory.dmpFilesize
64KB
-
memory/3004-158-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3004-142-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-144-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-159-0x0000000002700000-0x0000000002710000-memory.dmpFilesize
64KB
-
memory/3004-143-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/3004-151-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-145-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-146-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-206-0x0000000007CE0000-0x0000000007CF0000-memory.dmpFilesize
64KB
-
memory/3004-205-0x0000000007C60000-0x0000000007C70000-memory.dmpFilesize
64KB
-
memory/3004-174-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-147-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-170-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-160-0x0000000002700000-0x0000000002710000-memory.dmpFilesize
64KB
-
memory/3004-175-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-168-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-167-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-148-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-149-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-173-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-166-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-176-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-165-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-161-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-181-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-164-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-163-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-150-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3004-185-0x0000000007C60000-0x0000000007C70000-memory.dmpFilesize
64KB
-
memory/3004-162-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/3056-286-0x0000000000000000-mapping.dmp
-
memory/3060-213-0x0000000000000000-mapping.dmp
-
memory/3060-220-0x00000000009A0000-0x00000000009AF000-memory.dmpFilesize
60KB
-
memory/3060-218-0x00000000009B0000-0x00000000009B9000-memory.dmpFilesize
36KB
-
memory/3140-276-0x00000000013B0000-0x00000000013BB000-memory.dmpFilesize
44KB
-
memory/3140-274-0x00000000013C0000-0x00000000013C6000-memory.dmpFilesize
24KB
-
memory/3140-266-0x0000000000000000-mapping.dmp
-
memory/3420-357-0x0000000000000000-mapping.dmp
-
memory/3772-257-0x0000000000000000-mapping.dmp
-
memory/3852-234-0x00000161B75A0000-0x00000161B75AF000-memory.dmpFilesize
60KB
-
memory/3852-215-0x0000000000000000-mapping.dmp
-
memory/3856-225-0x000001866B7B0000-0x000001866B7BF000-memory.dmpFilesize
60KB
-
memory/3856-199-0x0000000000000000-mapping.dmp
-
memory/4212-203-0x0000000000000000-mapping.dmp
-
memory/4212-210-0x0000000000990000-0x0000000000997000-memory.dmpFilesize
28KB
-
memory/4212-211-0x0000000000980000-0x000000000098B000-memory.dmpFilesize
44KB
-
memory/4304-281-0x0000000000B10000-0x0000000000B1B000-memory.dmpFilesize
44KB
-
memory/4304-277-0x0000000000000000-mapping.dmp
-
memory/4304-282-0x0000000000B20000-0x0000000000B28000-memory.dmpFilesize
32KB
-
memory/4308-288-0x0000000000000000-mapping.dmp
-
memory/4396-254-0x0000000000000000-mapping.dmp
-
memory/4484-359-0x0000000000000000-mapping.dmp
-
memory/4528-278-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/4528-275-0x0000000000000000-mapping.dmp
-
memory/4528-280-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/4552-353-0x0000000000000000-mapping.dmp
-
memory/4632-319-0x0000000000000000-mapping.dmp
-
memory/4756-356-0x0000000000000000-mapping.dmp
-
memory/4908-228-0x0000000000000000-mapping.dmp
-
memory/4992-301-0x0000000000000000-mapping.dmp
-
memory/5044-249-0x0000000000000000-mapping.dmp
-
memory/5048-236-0x00000000005A0000-0x0000000000DD4000-memory.dmpFilesize
8.2MB
-
memory/5048-189-0x00000000005A0000-0x0000000000DD4000-memory.dmpFilesize
8.2MB
-
memory/5048-186-0x0000000000000000-mapping.dmp
-
memory/5056-252-0x0000000000000000-mapping.dmp
-
memory/5056-267-0x00000000009F0000-0x00000000009F9000-memory.dmpFilesize
36KB
-
memory/5056-265-0x0000000000C00000-0x0000000000C05000-memory.dmpFilesize
20KB