Overview

overview

9

Static

static

9

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...CK.exe

windows11-21h2-x64

9

tox tweaki...ew.exe

windows11-21h2-x64

6

tox tweaki...up.exe

windows11-21h2-x64

1

tox tweaki...8.appx

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

tox tweaki...up.exe

windows11-21h2-x64

8

tox tweaki...LG.exe

windows11-21h2-x64

1

tox tweaki...el.exe

windows11-21h2-x64

1

tox tweaki...un.exe

windows11-21h2-x64

3

Export.bat

windows11-21h2-x64

1

Import.bat

windows11-21h2-x64

1

SCEWIN_64.exe

windows11-21h2-x64

1

amifldrv64.sys

windows11-21h2-x64

1

amigendrv64.sys

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

1

tox tweaki...CL.exe

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

7

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...vc.exe

windows11-21h2-x64

1

CRU/CRU.exe

windows11-21h2-x64

3

CRU/reset-all.exe

windows11-21h2-x64

3

CRU/restart.exe

windows11-21h2-x64

5

CRU/restart64.exe

windows11-21h2-x64

5

tox tweaki...on.exe

windows11-21h2-x64

1

Export.bat

windows11-21h2-x64

3

tox tweaki...ll.exe

windows11-21h2-x64

7

tox tweaki...xp.exe

windows11-21h2-x64

8

tox tweaki...tr.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/11/2024, 14:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tox tweaking/niggers/MicrosoftEdgeSetup.exe
  • Size 1.6MB
  • Sample241108-sblntavank
  • SHA256 7531341da720162541747b3142722f9c52d9d5fe57678d8aeefa62532014f672
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 38 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1508
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3056
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:3564
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:896
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0UzMUFBNEZGLUU5MkUtNEZDOC05MUQ2LTg4MTg4MkQxREM0OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQzLjU3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iZW4iIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDcxMjYwNTY3MyIgaW5zdGFsbF90aW1lX21zPSI3MTkiLz48L2FwcD48L3JlcXVlc3Q-
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1152
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installsource taggedmi /sessionid "{DB53D2CE-64B3-429A-8978-A2BED58732DC}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1524
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzVGMzUyMDYtQzA1NC00M0M3LUJENkQtNEVFNDNCMEU4N0YzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMDMyNDEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3Mjc3NTkzNTEwOTA1NjUiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzE4NTQzMzQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4172
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2316
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3336
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1068
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:5024
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1712
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2008
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1384
          • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3048
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezhERkE3ODRDLTE3QjItNDkyMy05QTkxLTdDMzU2M0YwNkRDOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMC4wLjI4NDkuODAiIGxhbmc9ImVuIiBicmFuZD0iTTEwMCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3NzkyMzQwNTM4MzQwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3MzIxMzY5MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzMyMTM2OTA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzOTc5Mzc1NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjdjYjcyOWQtZmY5NC00ZDM0LWFhZTQtMzM4NWZhMDljNDRjP1AxPTE3MzE2ODI3MDcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RGZURlNkV3V1QjBnbWplaDF0OXc0am5tZ1ZONHh0MzloNkxLdG55JTJmYWtpbnBSYXhrOThvY0hJQ3l1VlRhZGZPUFFKaVl2OTAydlA4ak5JOExseDIlMmZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBkb3dubG9hZF90aW1lX21zPSIzMzg3NSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzk3OTM3NTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUzNjk5OTE4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzczMzg3MTI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTUzIiBkb3dubG9hZF90aW1lX21zPSI0MDczNSIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTkxNiIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2052
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:2080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-installer
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Checks system information in the registry
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2820
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbdd054dc0,0x7ffbdd054dcc,0x7ffbdd054dd8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1580
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2200,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4844
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1832,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:456
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2500,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1404
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3420,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3428,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2836
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4132,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1656
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5280,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5440,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5476,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2752
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5680,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:536
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5688,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5260
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5604,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5332
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6192,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5696
        • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe
          cookie_exporter.exe --cookie-json=1140
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5884
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3080
      • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6988,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7152,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7052,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5448
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7048,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5668
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6392,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5840
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6380,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5940
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6268,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5756
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7568,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5720
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=564,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5856
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6880,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3372
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4772,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5148
    • C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1488

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Browser Extensions

          1
          T1176

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          4
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Installer\setup.exe
          • Size 6.5MB
          • SHA256 64050839b4a6f27d896e1194e902a2f7a3c1cab0ef864b558ab77f1be25145d6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 182KB
          • SHA256 b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
          • Size 201KB
          • SHA256 b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 215KB
          • SHA256 5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 261KB
          • SHA256 f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdate.dll
          • Size 2.1MB
          • SHA256 03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_af.dll
          • Size 29KB
          • SHA256 9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_as.dll
          • Size 29KB
          • SHA256 cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bs.dll
          • Size 28KB
          • SHA256 d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 30KB
          • SHA256 ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_da.dll
          • Size 28KB
          • SHA256 d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_de.dll
          • Size 30KB
          • SHA256 49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_el.dll
          • Size 30KB
          • SHA256 4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es.dll
          • Size 29KB
          • SHA256 36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_eu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_eu.dll
          • Size 28KB
          • SHA256 1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fa.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fa.dll
          • Size 28KB
          • SHA256 082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fi.dll
          • Size 28KB
          • SHA256 5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fil.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fil.dll
          • Size 29KB
          • SHA256 3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fr-CA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr-CA.dll
          • Size 30KB
          • SHA256 3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_fr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr.dll
          • Size 30KB
          • SHA256 078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ga.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ga.dll
          • Size 29KB
          • SHA256 b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gd.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gd.dll
          • Size 30KB
          • SHA256 3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gl.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gl.dll
          • Size 29KB
          • SHA256 b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_gu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gu.dll
          • Size 28KB
          • SHA256 0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hi.dll
          • Size 29KB
          • SHA256 8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hr.dll
          • Size 29KB
          • SHA256 50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_hu.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hu.dll
          • Size 29KB
          • SHA256 c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_id.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_id.dll
          • Size 28KB
          • SHA256 a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_is.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_is.dll
          • Size 28KB
          • SHA256 69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_it.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_it.dll
          • Size 30KB
          • SHA256 bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_iw.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_iw.dll
          • Size 25KB
          • SHA256 3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ja.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ja.dll
          • Size 24KB
          • SHA256 bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ka.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ka.dll
          • Size 29KB
          • SHA256 066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kk.dll
          • Size 28KB
          • SHA256 b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_km.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_km.dll
          • Size 27KB
          • SHA256 90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kn.dll
          • Size 29KB
          • SHA256 92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ko.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ko.dll
          • Size 23KB
          • SHA256 b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_kok.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kok.dll
          • Size 28KB
          • SHA256 8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lb.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lb.dll
          • Size 30KB
          • SHA256 f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lo.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lo.dll
          • Size 27KB
          • SHA256 6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lt.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lt.dll
          • Size 28KB
          • SHA256 a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_lv.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lv.dll
          • Size 29KB
          • SHA256 5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mi.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mi.dll
          • Size 28KB
          • SHA256 0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mk.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mk.dll
          • Size 29KB
          • SHA256 7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ml.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ml.dll
          • Size 31KB
          • SHA256 155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mr.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mr.dll
          • Size 28KB
          • SHA256 9e000d271d96f02bd0baecae07ef5b9a7f5f17d33733e2c9bb50f13e4c6e84b1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ms.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ms.dll
          • Size 28KB
          • SHA256 d79365e02f80694a9a2d76becc6a203a758b4006fbb521453f943ace16d24c8c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_mt.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mt.dll
          • Size 29KB
          • SHA256 ce19cc60aceaecb34cf496857dd3698a2a5dfe88cb67bd4b7fd0a7ecc51c2ea8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 16KB
          • SHA256 134bd8f0dee7197ac97741cf5a8fa03f68b9e9e5ca8ef9c9cd40e9ef472cba8b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 feb5c2610d67e3f1c1d57596a2656ce3ae3fa33cffd3169fabd27049b3edb2b8
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 2KB
          • SHA256 36567bfb1433f1b37c7a53483a7a33558b558c986ccdd6e8acb4462812f656db
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
          • Size 9KB
          • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
          • Size 18KB
          • SHA256 b74bccb48f4dd9d1c6e981b0458f053db95fc15e11833c00cd28187e1d4c23ae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
          • Size 37KB
          • SHA256 a1f1e3af06c4c1628c47e3ed5dc8f1b4a9dec1f01aa459f490a21f0a24cb8c9b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index
          • Size 72B
          • SHA256 08f334a369933e338998bceba0b656a90595dcd3e125dd59d114261bbe96b44d
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index~RFe59bdd8.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index~RFe59bdd8.TMP
          • Size 48B
          • SHA256 b10ac1387a72db8fd25b9592202b1bd9f81a729daad1cd7c5e552f92d30311cb
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index
          • Size 2KB
          • SHA256 1511de493978472ef65dda25ab96bb39bcb4c41cb5213dc612faf561e77e2731
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index~RFe59d7a9.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index~RFe59d7a9.TMP
          • Size 48B
          • SHA256 074d4ce297de739201df13f8e84c3333b17f5b22711344ef455573a21e85e322
          • MD5 SHA1 SHA512
          Submit Download

          index.txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
          • Size 253B
          • SHA256 dc1ff5829e4f7a48c0fc8f2b32e7e3be411a1423088d3c2f73f77d2468b2dc69
          • MD5 SHA1 SHA512
          Submit Download

          index.txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
          • Size 182B
          • SHA256 678f0ab63070749eb60e6087562d7cf3fac0923cfdea9a134b1f3d5f1c590092
          • MD5 SHA1 SHA512
          Submit Download

          index.txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
          • Size 257B
          • SHA256 8cf2ce383fe973cdb27295dc2e9dda08b071d477953e10babebd630af4128085
          • MD5 SHA1 SHA512
          Submit Download

          index.txt~RFe596d95.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe596d95.TMP
          • Size 119B
          • SHA256 de02a9e0a6a4953460396904399dd9494bbf2d89c9a0cfdfe9caef4873eb7361
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 72B
          • SHA256 6a661ea18f9656c7d0b661651af0db99d275092e0509ca465278bd6acbe51599
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index~RFe59bb96.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bb96.TMP
          • Size 48B
          • SHA256 8ea1942351ce2f8dc08b1569a30f2ce83365d62a8a8c6ec796bd231fbdb10a81
          • MD5 SHA1 SHA512
          Submit Download

          sync_diagnostic.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
          • Size 1KB
          • SHA256 5fb2ecd1129df375aab5a930bba5d2c0374e48645817c4e35238110e0d6b15ea
          • MD5 SHA1 SHA512
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 27KB
          • SHA256 6ebc56435717d71f8766dd28288831dd1f7d3f0fb7e57073f22bc27334f7e1fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 5KB
          • SHA256 bd395a399a4c1e813c675f17eac7b3bd78a6a0cf3b6bf8f4455b8344d24f11b4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 7KB
          • SHA256 250117b123684edc7478d4495e99d660bbcc8e7f5a9c97c83ba392cdef166d3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 7KB
          • SHA256 9b95b0634e7cdb4982db46982f856ba07c78b29e467f54d36e1eacd47513aa57
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 5KB
          • SHA256 e374abb4476272d0984c91c50ab032817fc85e12228d73a8c3ff1b5f2c387ba1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          901c276f-5e85-4acf-8167-b48b48daa9ef.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\901c276f-5e85-4acf-8167-b48b48daa9ef.tmp
          • Size 10KB
          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          d0a0ebab-d2cd-4391-82c8-03a6733cb481.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\d0a0ebab-d2cd-4391-82c8-03a6733cb481.tmp
          • Size 1B
          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
          • MD5 SHA1 SHA512
          Submit Download

          ddf8ee8d-1534-4683-a0b3-bd32fae709c0.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\ddf8ee8d-1534-4683-a0b3-bd32fae709c0.tmp
          • Size 132KB
          • SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat
          • Size 280B
          • SHA256 624023d4d93a969ef0ca70593fee2e000b128db696e070a10daf4524c045eb1c
          • MD5 SHA1 SHA512
          Submit Download

          memory/1256-285-0x00000000008C0000-0x00000000008F5000-memory.dmp
          Download

          memory/1256-201-0x0000000074880000-0x0000000074AA5000-memory.dmp
          Download

          memory/1256-193-0x0000000074880000-0x0000000074AA5000-memory.dmp
          Download

          memory/1256-192-0x00000000008C0000-0x00000000008F5000-memory.dmp
          Download