9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-04-2022 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SATURN_RANSOM.exe
Size

338KB
MD5

bbd4c2d2c72648c8f871b36261be23fd
SHA1

77c525e6b8a5760823ad6036e60b3fa244db8e42
SHA256

9e87f069de22ceac029a4ac56e6305d2df54227e6b0f0b3ecad52a01fbade021
SHA512

38f2ff3b7ff6faa63ef0a3200e0dbb9e48e1d404a065f6919cb6d245699479896a42316f299c33c8cc068922934c64f8aa06c88b000d1676870c1d0c0f18e14a

Score

10^/10

evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\odt\#DECRYPT_MY_FILES#.txt

Ransom Note

S A T U R N All of your files have been encrypted! To Decrypt your files follow these steps: #---------------------------------------------# 1. Download and install the "Tor Browser" from https://www.torproject.org 2. Run it. 3. In the Tor Browser, open website: http://su34pwhpcafeiztt.onion 4. Follow the instructions on the page #---------------------------------------------#

URLs

http://su34pwhpcafeiztt.onion

Extracted

Path

C:\odt\#DECRYPT_MY_FILES#.html

Ransom Note

<html> <title>S A T U R N</title> <center> <body> <h1>S A T U R N</h1> <h4>Your documents, photos, databases, and other important files have been encrypted!</h4> <br /> To Decrypt your files follow these instructions: <br /> <div> <h4>1. Download and Install Tor Browser from <a href=https://www.torproject.org/>https://www.torproject.org/</a></h4> <br /> <h4>2. Run the browser</h4> <br /> <h4>3. In the Tor Browser, open website:</h3> <div style="background-color: #d9d9d9; margin-left: 20px; margin-right: 20px; padding-bottom: 8px; padding-left: 8px; padding-right: 8px; padding-top: 8px;"> </a><b>http://su34pwhpcafeiztt.onion</b><br/> </div> <h4>4. Follow the instructions at this website</h4> </div> </body> </center> </html> <style> html { background-color: white; font-family: Helvetica, sans-serif; } div { background-color: #f2f2f2; width: 80: %; padding: 25px; margin: 25px; overflow:hidden; } </style>

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Enumerates VirtualBox registry keys 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
228	msedgerecovery.exe
3460	MicrosoftEdgeUpdateSetup.exe
3540	MicrosoftEdgeUpdate.exe
332	MicrosoftEdgeUpdate.exe
2116	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdateComRegisterShell64.exe
4028	MicrosoftEdgeUpdateComRegisterShell64.exe
4380	MicrosoftEdgeUpdateComRegisterShell64.exe
4112	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
2112	MicrosoftEdgeUpdate.exe
4732	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
4388	MicrosoftEdgeUpdate.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\ConvertToResize.png.C3Pw	SATURN_RANSOM.exe
File renamed	C:\Users\Admin\Pictures\ConvertToResize.png => C:\Users\Admin\Pictures\ConvertToResize.png.saturn	SATURN_RANSOM.exe
File opened for modification	C:\Users\Admin\Pictures\HideUse.tif.C3Pw	SATURN_RANSOM.exe
File renamed	C:\Users\Admin\Pictures\HideUse.tif => C:\Users\Admin\Pictures\HideUse.tif.saturn	SATURN_RANSOM.exe
File created	C:\Users\Admin\Pictures\StepSearch.png.C3Pw	SATURN_RANSOM.exe
File opened for modification	C:\Users\Admin\Pictures\StepSearch.png.C3Pw	SATURN_RANSOM.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertToResize.png.C3Pw	SATURN_RANSOM.exe
File created	C:\Users\Admin\Pictures\HideUse.tif.C3Pw	SATURN_RANSOM.exe
File renamed	C:\Users\Admin\Pictures\StepSearch.png => C:\Users\Admin\Pictures\StepSearch.png.saturn	SATURN_RANSOM.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SATURN_RANSOM.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	SATURN_RANSOM.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5zy4hsui.lnk	SATURN_RANSOM.exe

Loads dropped DLL 16 IoCs

pid	Process
3540	MicrosoftEdgeUpdate.exe
332	MicrosoftEdgeUpdate.exe
2116	MicrosoftEdgeUpdate.exe
2704	MicrosoftEdgeUpdateComRegisterShell64.exe
2116	MicrosoftEdgeUpdate.exe
4028	MicrosoftEdgeUpdateComRegisterShell64.exe
2116	MicrosoftEdgeUpdate.exe
4380	MicrosoftEdgeUpdateComRegisterShell64.exe
2116	MicrosoftEdgeUpdate.exe
4112	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
2112	MicrosoftEdgeUpdate.exe
4388	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\#DECRYPT_MY_FILES.BMP"	SATURN_RANSOM.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_en.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_es.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\EdgeUpdate.dat	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\NOTICE.TXT	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_te.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_da.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\MicrosoftEdgeUpdateBroker.exe	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_th.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ms.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\psuser_arm64.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_et.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdateOnDemand.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_te.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_sr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\psmachine_64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\NOTICE.TXT	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_el.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_th.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_as.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_da.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\psmachine_arm64.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9CD7.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\psuser_64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	4712	WerFault.exe	93

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1556FE7-1765-49F9-AB0C-9E9C0E9275C7}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ELEVATION	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ELEVATION	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E816B022-B276-4CA0-B42A-E3EF8927EFD2}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1556FE7-1765-49F9-AB0C-9E9C0E9275C7}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\LocalService = "edgeupdatem"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1556FE7-1765-49F9-AB0C-9E9C0E9275C7}\InprocHandler32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.157.61\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{E816B022-B276-4CA0-B42A-E3EF8927EFD2}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4080	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
3684	msedge.exe
3684	msedge.exe
660	identity_helper.exe
660	identity_helper.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
3540	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4572	MicrosoftEdgeUpdate.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4580	MicrosoftEdgeUpdate.exe
4580	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5060	WMIC.exe
Token: SeSecurityPrivilege	5060	WMIC.exe
Token: SeTakeOwnershipPrivilege	5060	WMIC.exe
Token: SeLoadDriverPrivilege	5060	WMIC.exe
Token: SeSystemProfilePrivilege	5060	WMIC.exe
Token: SeSystemtimePrivilege	5060	WMIC.exe
Token: SeProfSingleProcessPrivilege	5060	WMIC.exe
Token: SeIncBasePriorityPrivilege	5060	WMIC.exe
Token: SeCreatePagefilePrivilege	5060	WMIC.exe
Token: SeBackupPrivilege	5060	WMIC.exe
Token: SeRestorePrivilege	5060	WMIC.exe
Token: SeShutdownPrivilege	5060	WMIC.exe
Token: SeDebugPrivilege	5060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5060	WMIC.exe
Token: SeRemoteShutdownPrivilege	5060	WMIC.exe
Token: SeUndockPrivilege	5060	WMIC.exe
Token: SeManageVolumePrivilege	5060	WMIC.exe
Token: 33	5060	WMIC.exe
Token: 34	5060	WMIC.exe
Token: 35	5060	WMIC.exe
Token: 36	5060	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5060	WMIC.exe
Token: SeSecurityPrivilege	5060	WMIC.exe
Token: SeTakeOwnershipPrivilege	5060	WMIC.exe
Token: SeLoadDriverPrivilege	5060	WMIC.exe
Token: SeSystemProfilePrivilege	5060	WMIC.exe
Token: SeSystemtimePrivilege	5060	WMIC.exe
Token: SeProfSingleProcessPrivilege	5060	WMIC.exe
Token: SeIncBasePriorityPrivilege	5060	WMIC.exe
Token: SeCreatePagefilePrivilege	5060	WMIC.exe
Token: SeBackupPrivilege	5060	WMIC.exe
Token: SeRestorePrivilege	5060	WMIC.exe
Token: SeShutdownPrivilege	5060	WMIC.exe
Token: SeDebugPrivilege	5060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5060	WMIC.exe
Token: SeRemoteShutdownPrivilege	5060	WMIC.exe
Token: SeUndockPrivilege	5060	WMIC.exe
Token: SeManageVolumePrivilege	5060	WMIC.exe
Token: 33	5060	WMIC.exe
Token: 34	5060	WMIC.exe
Token: 35	5060	WMIC.exe
Token: 36	5060	WMIC.exe
Token: SeBackupPrivilege	1020	vssvc.exe
Token: SeRestorePrivilege	1020	vssvc.exe
Token: SeAuditPrivilege	1020	vssvc.exe
Token: 33	4784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4784	AUDIODG.EXE
Token: SeDebugPrivilege	3540	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4572	MicrosoftEdgeUpdate.exe
Token: SeRestorePrivilege	4580	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	4580	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4580	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 5068	3980	SATURN_RANSOM.exe	81
PID 3980 wrote to memory of 5068	3980	SATURN_RANSOM.exe	81
PID 3980 wrote to memory of 5068	3980	SATURN_RANSOM.exe	81
PID 5068 wrote to memory of 5060	5068	cmd.exe	83
PID 5068 wrote to memory of 5060	5068	cmd.exe	83
PID 5068 wrote to memory of 5060	5068	cmd.exe	83
PID 3980 wrote to memory of 5108	3980	SATURN_RANSOM.exe	94
PID 3980 wrote to memory of 5108	3980	SATURN_RANSOM.exe	94
PID 3980 wrote to memory of 5108	3980	SATURN_RANSOM.exe	94
PID 3980 wrote to memory of 3012	3980	SATURN_RANSOM.exe	95
PID 3980 wrote to memory of 3012	3980	SATURN_RANSOM.exe	95
PID 3980 wrote to memory of 3012	3980	SATURN_RANSOM.exe	95
PID 3980 wrote to memory of 3684	3980	SATURN_RANSOM.exe	96
PID 3980 wrote to memory of 3684	3980	SATURN_RANSOM.exe	96
PID 3980 wrote to memory of 1648	3980	SATURN_RANSOM.exe	98
PID 3980 wrote to memory of 1648	3980	SATURN_RANSOM.exe	98
PID 3980 wrote to memory of 1648	3980	SATURN_RANSOM.exe	98
PID 3684 wrote to memory of 3856	3684	msedge.exe	100
PID 3684 wrote to memory of 3856	3684	msedge.exe	100
PID 1648 wrote to memory of 4080	1648	cmd.exe	103
PID 1648 wrote to memory of 4080	1648	cmd.exe	103
PID 1648 wrote to memory of 4080	1648	cmd.exe	103
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 3232	3684	msedge.exe	108
PID 3684 wrote to memory of 2784	3684	msedge.exe	109
PID 3684 wrote to memory of 2784	3684	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\SATURN_RANSOM.exe
"C:\Users\Admin\AppData\Local\Temp\SATURN_RANSOM.exe"
1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic.exe shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.txt
  2⤵
  PID:5108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.vbs"
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdaa0246f8,0x7ffdaa024708,0x7ffdaa024718
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2704 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3312 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff67cab5460,0x7ff67cab5470,0x7ff67cab5480
      4⤵
      PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2316 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4823134522097391697,14459949878785695051,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6152 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\SATURN_RANSOM.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:4080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4712 -ip 4712
1⤵
PID:2816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4712 -s 1900
1⤵
- Program crash
PID:1568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x344 0x470
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\msedgerecovery.exe
  "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={4d4a1ea3-26c2-4127-a65e-318bcb33b2a8} --system
  2⤵
  - Executes dropped EXE
  PID:228
- - C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\MicrosoftEdgeUpdateSetup.exe
    "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3460
  - - C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3540
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:332
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2116
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2704
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4028
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.157.61\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4380
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkFGODg2MjEtQkZCQi00Qjc4LUEwMTYtMjc2NUFGODRERDk4fSIgdXNlcmlkPSJ7QzQzRDUwOUYtRTlBOC00RDQ0LUE4RDEtQTEwNjZDODFGRDE0fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0U0OERDOEVELUE2RkItNDEwMy05ODc4LTVGOTBGMEEzQkQwNX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xNTcuNjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGluc3RhbGxfdGltZV9tcz0iNjg3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4112
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzQ3NThDQzMtMDAyMi00NjNGLUE4NjUtQkY2NUYzQkU1QTUyfSIgdXNlcmlkPSJ7QzQzRDUwOUYtRTlBOC00RDQ0LUE4RDEtQTEwNjZDODFGRDE0fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezFCMUIxMjkwLTYxMzktNDFFMC1BQTVCLUYzODg2RjM5NUVCOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSI4OS4wLjQzODkuMTE0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxNiIgaW5zdGFsbGRhdGU9Ii00IiBpbnN0YWxsZGF0ZXRpbWU9IjE2NDk5NjE4MjkiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2112
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4580" "1116" "1048" "1120" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3648
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3EA6BD4F-4D23-4BB1-BDE4-BE3D0D0F1F0E}\MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3EA6BD4F-4D23-4BB1-BDE4-BE3D0D0F1F0E}\MicrosoftEdgeUpdateSetup_X86_1.3.161.35.exe" /update /sessionid "{34758CC3-0022-463F-A865-BF65F3BE5A52}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4732
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTcuNjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNTcuNjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzQ3NThDQzMtMDAyMi00NjNGLUE4NjUtQkY2NUYzQkU1QTUyfSIgdXNlcmlkPSJ7QzQzRDUwOUYtRTlBOC00RDQ0LUE4RDEtQTEwNjZDODFGRDE0fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezM0MkYzQzdFLUUwNTktNDgxMS1BMTI0LUE1RkJBNzkzQUQ2Mn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNTcuNjEiIG5leHR2ZXJzaW9uPSIxLjMuMTYxLjM1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMjE4UiIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvM2QxZjM5YTUtNDI1Ny00NWIyLTlhYTctNTJhNWI4MDE0ZWY2P1AxPTE2NTE5NTMyOTcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VEM4SGRRNXA3ZmNzeFhHJTJmTzNrJTJmR0RieFY0SjdROHNPUlpydTB3OWVYRjd0bTRnUCUyYjh6SmRGMyUyZlBFTzdTaEZLZyUyYkZzJTJmUUdUb2NKOCUyYlJCTzdBbzVRZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzNkMWYzOWE1LTQyNTctNDViMi05YWE3LTUyYTViODAxNGVmNj9QMT0xNjUxOTUzMjk3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVRDOEhkUTVwN2Zjc3hYRyUyZk8zayUyZkdEYnhWNEo3UThzT1JacnUwdzllWEY3dG00Z1AlMmI4ekpkRjMlMmZQRU83U2hGS2clMmJGcyUyZlFHVG9jSjglMmJSQk83QW81UWclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODM1NDU2IiB0b3RhbD0iMTgzNTQ1NiIgZG93bmxvYWRfdGltZV9tcz0iOTgzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjE1IiByZD0iNTU4MyIgcGluZ19mcmVzaG5lc3M9IntBOTJCRDA5NC04RDRFLTQ4QzctODk5OS05RkJDNzcxNzU5OUN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMjk1ODI5MTY2NTAwMzE1Ij48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9IjE1IiBhZD0iLTEiIHJkPSI1NTgzIiBwaW5nX2ZyZXNobmVzcz0ie0E4Q0NBRDg3LTVFN0MtNDg3MC04MTk1LUIzQTUxMkY0OEFFRH0iLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\MicrosoftEdgeUpdateSetup.exe

Filesize
1.7MB

MD5
28c0f6643449ca44ac182524106c1ef1

SHA1
1172f3442d3135931c0f9cc34f328e1715982704

SHA256
e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452

SHA512
3e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\MicrosoftEdgeUpdateSetup.exe

Filesize
1.7MB

MD5
28c0f6643449ca44ac182524106c1ef1

SHA1
1172f3442d3135931c0f9cc34f328e1715982704

SHA256
e007cc34cdfe9db8402e657686a0ad8d2d0bdc78186db0a6906a79e110b38452

SHA512
3e3138694e50ea8d03d778cb6aff76cfea99b98d9daf59045873637cb964f9983b8c41e44c369ec40dbb13cb7e41ab55d8a10ee81ed6394a33996a49058ee958

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1156_1686750979\msedgerecovery.exe

Filesize
1.6MB

MD5
99c95302031a74fb25045dcc84221f82

SHA1
1da4c7970f008f47f22e9f16f14b08c88d07849e

SHA256
58fac72920eabe2ef2aacc12dfe0dbea9a4dc10532706374d4a98034c16b765a

SHA512
c951b77cc3e708fb7a36ffe2997eb77852d8652598e11daedab56de7678edbc246f0da69c3446c2b8c4e52f5b005bdfabc0fba568c1e472a32049297f06ff546

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
171KB

MD5
b2cfaa142985112fd06e092bd3f04a06

SHA1
653d76cdd6f8e0317dd408c5e7aef142a944cd8d

SHA256
7f80809d759619369129f12242b171dc672d0dd699ade0d814067c07aaede8d1

SHA512
da9730dcdba3a14893e588533d16b526e2c599f0793285eafb6701d1795024981441f8d7259587bacdc7cbf69d56419e67007cbab32fd0e19814c5d2eab84077

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
02e716344c3241e304196b5444ac4e25

SHA1
a801213a0bf89b77642f6b1de77a14a6edbc02a6

SHA256
d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add

SHA512
1dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
02e716344c3241e304196b5444ac4e25

SHA1
a801213a0bf89b77642f6b1de77a14a6edbc02a6

SHA256
d956a39cdee0d6a334415386ef023849b6a933cdfc85af218bba49c5d6a45add

SHA512
1dc61c81428c605d6cd0ff3a1bed81fb1cbd1028db231ce13a97db74f03f3a326458f0d92afd292435abfa57754de871bb88add1d2acc8a5312852463b562855

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
204KB

MD5
0275f8bae9e6800d29f6d326a4dedd41

SHA1
c89bca78a22e0a4cac7e8e58a9a58e64c6ab6ec2

SHA256
1ff7eb6b43772f6924ca7f5097a1b16f40ffbe11cd79e219c56fa409bf388469

SHA512
d2363c926be2793ecb94319f4e79e7196385d80f33744bf5f737f0a2488e1555f5863225a152d05fdccb957b8368fa726253d8f4bd0763389956f035d7430ba1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
246KB

MD5
09ec85b85d220fa3832f2387e51b4108

SHA1
bcdfab0aefc14e6753397380538f3f521235180e

SHA256
ce3e7a87c24d7f55880dbd919711ac8a32e30befa7cd8b1d21bd0037a9016138

SHA512
2ddb2fe0c2ac3867d7110d5fc52c673c423853321d3a0d3151e27b5e2c1aeee9d3180000b8e43855577981834f9d6b1c25a4180cbd2b07d4d50c3d656a978a03

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdate.dll

Filesize
2.5MB

MD5
68b63876016abd50d706fc52a4a311ce

SHA1
f13e486d06218cacf1f3e30c02d6ad27b1f85423

SHA256
a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e

SHA512
7091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdate.dll

Filesize
2.5MB

MD5
68b63876016abd50d706fc52a4a311ce

SHA1
f13e486d06218cacf1f3e30c02d6ad27b1f85423

SHA256
a4cd7b731956b92f852086664f15012157e9d3133c66d72c5ae064475632831e

SHA512
7091ff907d9cc264d0f20b999c9ec427fc2950c75d02645d55319eebda3007566037ebf7f8beaafc14fc3217801ab352aa3e7c701390e36a3d3dff91871e92d8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_af.dll

Filesize
28KB

MD5
53cee9e7b391b77329f6bb511ef3fa76

SHA1
5ebc0650d070d419e99d8b981d694ceed4bd00c0

SHA256
c8fa8e9464ef77b65c671bd62dd0cbd7c7f57105dd5f6dfd067df16b4b2b77dc

SHA512
2bbbffa2367723a39083397ef914d4dadc19dbcb5e721cf4b542445a4f82872c826eb9d69de2ad5a85300f37c5883bcedc5087eb18599e9ccab65feffa1043ba

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
7983a34a0d846476b88f1c3d41946e73

SHA1
0bcfd01e64b5a56da00dd30c50dce884289e3751

SHA256
471d5c299f3a1a94413ed271f907df5456b75eecd2097ea28582f13c4f068334

SHA512
8cdb16a5deb6de26708389ec5a760f0d45cf8ee382958d6c713444fb04c99efd7d58594036d10a261c92595d4aea7a5dbbbe59441e54fcf06524efa7d5c8b328

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
d2366075f22f6b547283291a5fd1dcd3

SHA1
3002063ba12e6bc26eef6b5f3a72c9c4e966dbf4

SHA256
ea525aab28041424e06d026e8e31fd8e58b8ed148cdc69a26393bf2f855d90e3

SHA512
b5c6cddab52fd7d0e4f3e657220168b4fbf00aa4d899a807978e9b9514065a98008bc3e4b1822f63c25350baf746ff2ba03f78662a4ee3a1ee86f47a0a8d4e7f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_as.dll

Filesize
28KB

MD5
e09e9c955952d927388da22e7b167f24

SHA1
b91a0c5499b5a7be216ec2531add3cdbfa51ea49

SHA256
11f80f94dbb42e5efbcfe47e6f9fd946429b969c614094966d7be23ab206e10b

SHA512
73e6bfdcd7b5357246ea2a19d9f45f0ee130f3f8e1c488bbe42246472114e1d220544a215f75a1a521717005ecc47dd2f81a8b16bbae58e1f5687b271c572a3b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
44ff2e251a8f08c1c82fd1c276856ad9

SHA1
86f24bb3b1ccb0f17c6ce6da5f0a19d77683c6b0

SHA256
7daa97f3bca0bf401bad880f03b1376cfd5dfb305287811eda7f65d9199fb53a

SHA512
81dc61e2410ec314cedd744ef81a200764057afb7a038da7cf5b7861cb4960aeed0b7cfb7a10e97b0ee1821c512f013a42634020f86aa0688d17de86762cd494

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
c0af898f97a104d6649e6fa9a71acc15

SHA1
dc8b5f6865b0d3e168f7ef781c927ed872cefad2

SHA256
686289d2c5eb42009dc68019de3fa5c311bc37636fcf428f51c8192062c2c1a5

SHA512
25b822fe686fb89fee2eb7d01e2de406142713798da98651606abf4aa68d631d09b654b7ac71df83f6c639800daf7004bf3766b8c8c7468a85978495127159a9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
a51cd3e21d94611a399147f63665ebed

SHA1
64dd626916343410a547a06fd7b48906f72b78a4

SHA256
8a0872efa10942f6dee725092b32d2bd074d798110a3a990ae5b6c8b30c3310b

SHA512
214223bf1711fd1a27cde00ba056ae897ff17c195b62e6d140d749e7dfc603584944163158eafc5ef66d523e81096c0791ef78ad36f56ac83336f89f9136e1f5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
4cac1f99c27ee7c6720a5612cfeb20ef

SHA1
dd27e3358279fca9c14a9f0c161ee093bcadd825

SHA256
9008377200f8cc9d3ac62d88baad58cb4554d73d52105c8b304227ae05cc3424

SHA512
1769e62033b7576a2413c9bdfd1ab519c48edfa3e14ee62c83491b380fc9ec62a0260fff5cb481cb5aff3f23121baa6265a002fd1825661349261e1686b12b7d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
cf18296527bad3ee720412ae71d12e86

SHA1
9a45c48e6d39156681282479cfd3d2b60980d159

SHA256
658a04651a83851ecb6520ef958a3e1d6cf1dcbf0f1d1eec59f25741b92ed300

SHA512
1cc9a53445efeb88e9d8f2b6097e5dc498489edc87b539bc023e556b638d3d476f7f83adb3003b4900d742a7ccd47da21979141f3e07df3d98e52ee7d49d6d8f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
29KB

MD5
a7d153624a53642437a5fdcfb90cf5ab

SHA1
ce20204b8966bbb9f5bfe71b2d8b378cbc39bd58

SHA256
6d3daa6c91efa623ac9ebfaa8e59e7f554b528b6887707f80ee91aef68c92de7

SHA512
45f04693e4d05afe5bc645b2d129365f87381862c8ecafd821d87f9425796b3f421a079f1405bf9128e4b4c3e0f144626470153f663595ba6bcbfe74cfbcf0c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
faa9b8a39400cd92b4b96a7903b21cdc

SHA1
0f1a96ba3f8ef4cc5ae8bf347dc9735a7cbc9123

SHA256
432f9ed510cf9e74227ea61da17a02568870e501687bb21c115fc2b21d824ff9

SHA512
ecd03b669b6aa8cbedfc38b446877b8b25646ceda7954023e004c612d0b7977f303bf27890e792a90afe4babe7503c36fa0f920bed4564c25445b84545f175f2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
ba75b3be4bcbec567eadbc56076432e4

SHA1
e17a67a2831aa2e9ab6c7f59052c0b0baf6d3a4e

SHA256
1f933c0ab6daee1581a60300c476bdff6865f68b7305fb9b32a737f6d6b8fca1

SHA512
61f6e102354a285746848fdfba871137e36e759c292937d8182315e631c0f8d3d163eb1081f7f17000e88c9417defa4fcec416ee8cb6daa930a276751ff4025b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
77e5904f1ffb344502a466ae27511f7a

SHA1
9cee96bd6df0f0984405e8fe95bb720ec9b916c1

SHA256
e46aededa1d007bf8fe641d0ddd6abf889bafefcc029c91b59196eb55ba7ee92

SHA512
0160e9317645b6ad38b359d7b9c4ec54899052503d1bb5914f4bf7bf90f2c7c521b11e01adfa9910b2b3189189362ed912db34a9824ea464cd18ee0938641cd3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
d0c21bcf54df2cd71cb5df9d8aa3aeb3

SHA1
6c78e1817d9def3d0ed20fdcd201a8ac2afb3af9

SHA256
bc56ddc6f0509cacde23da7a6773c7803d38e06eedacc8c63b6c9d87be1c7513

SHA512
421b30b84a196c14b659100fe66764af1661a3e1a5cfe7b3eaef781a5e691d725251963f02e6afc4f93692ff42a6a22ade5aecd36b5d1e734ce686a175b7f5bf

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
1ade464c5ead694b76726a094962b85a

SHA1
22afa85a58e6a4872a92f34fb847fa50dcc59a0e

SHA256
8d3ead21598744d6c19ba15812e8a05e95316e5000b04d96863b1b7d7918f564

SHA512
0f003bf35b7ca2262789533e0e1f4b20d17f8bce5885f88d79356a745a03e7a85f6868d00e04139be0b0990ed79c7b84e8e135c937d36b641acbb2c608e5a430

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
7947d858efe2c8bdedf1b6ece07f2f0c

SHA1
3c5bd7afb2872a1c35db316180182b61498647f5

SHA256
37f66ca033654488e732710f2928a781834380011da81f6dc61356ea65ff3cd8

SHA512
b4416197b5a34a971543a40d5af7de8b5d166dc40b00888f8a12a812472ed5c10172f6f340d8ca022bc6ded6d9e3114c9de6f3ca5df7fd151fa27677a005b6ca

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
604d7950ad651e06b518e72034a691d5

SHA1
ae4bfb658b0ed616dc47d5e9f41611f3b00ab5de

SHA256
3d88879839db205fb1428717a85e8610b932e3b6e451e16e176e71850ffc4d88

SHA512
df3f11d4686a16e2f8fc95b65d2e97639216fd75d72c4a91c5b1019602937bc177b75e5448961d7efa7341bb6630aab01b5dd41a2c701c88d201d3037d0ccb41

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
a864d97ab266aba9972155acc2afabc3

SHA1
ac3bda7b69af04cc796c24980996de2db7a31dd4

SHA256
db2dc77075ef42d4f36b9ab3f11817610464f8538f1264cf0373705af91676f8

SHA512
a2f747f9f304fbbbaa1a5d071499925f4524170efbc5a3f9ce0d2e5d38eeee74ee6f18d460689eeb41e988c8d16169e84e44dd906d8989e93808574466eb1ca6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
5549e5687c3a753e186f301cf13ed6f8

SHA1
c06ce0554859b534c3fc591a80f1e7a2d25f52f7

SHA256
7cc3eaa3160d69b542419a235c64d899b9b4086cd572ae69d701a7b247d1c077

SHA512
1866f569cd4b3b796f5b1f160058d9b37907a3b5726139e95953e1cf76a63e0c80f88182c41bf31ccc823c3b13b74cc22fbc639eaa5e8ab469a01deaf94ce6e0

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_es.dll

Filesize
28KB

MD5
e78bc59cfed1c26cee4d76bad5f80516

SHA1
2c60386beb9eeb1e00d9400b041c88b8e6ebf293

SHA256
60b55896071089fd8e8f31df0f22929909408d67a09e1aeed54376e597683a7f

SHA512
e071aedf19275c844c0949980e462d35dd6987c0510b2f5cad5b53d5a75a605342e773e12b4ccba122c5e5d4a1448dc5c804336197eb0e59ec9b39c3983dddcc

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
74169fbf0de252eccbf01e7d5ea3a56d

SHA1
902a2405089c99bba5f5438026386ce9416d4f6b

SHA256
453aa79b55c137eb3c95738de475b9fc9383ef07923a80f0365f6e53bfc78476

SHA512
a8c0864cbc807368959452fc540165d7a67ff5f4e6315dbc1f5230b6a049f33988b991cc65503e6eb92f4f5326ea7c0460969377cbc9efae9f70021efe3b1cde

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
bbfc5f09aab008784d415a6de3cf239c

SHA1
8e0d6d2e6c9363e2edb6e1fc681fe353f0652da2

SHA256
cc0f547674915e21c070cf3fab6fb00ee0926790db71b9d37b78e20aad370d24

SHA512
6ae45de266fb6b8dd2f946260b6ab2968e9a091cc74a27587453e40e859a8fe0046945f3e582a6eb5afa24deed8d80235ceb57be006a35e3efaac0067ce43124

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fa.dll

Filesize
27KB

MD5
04889ddabdb2373e3384c9211d606e8f

SHA1
3862aee6bdd9ce36f604aa91ef40c0f8cd3ff30d

SHA256
c43d5644b2e241b4867b78e19d103b28a77e3ba5a21ed683a1e67df95c92cbdb

SHA512
a74b55913123d63c392a9653930b548dd7e3ac2b5deec4ac26efa92e42573d996b03de27d16b244e0cf8fc2a3c00dd9329956f75225a1c2b0ad9d9dc6f947325

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
236b8e50cae45f545b8cd39b72c56447

SHA1
5bcdd006e6699cd7f6e8b3c15e13abc83532457f

SHA256
a0ada887431cf3749871e78ee632a026ca837f0716305b470375f7d25fa5e69a

SHA512
c9ac74fcab02635e9b98c236bf4cec2a0349f5159f329aee3c4a080fc82e3acfd9c92d5e3489bbab527df48acb65c71abe6aa1fdaf40002bb48bcb3c53738458

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
e70514683320c06ebe56cb93b6bb8312

SHA1
1eec4a1f5a1c05dc24a1db2ceac197767dd28b1d

SHA256
04e85f77193990dc0a2f6f46347159de7199a89a943508df79e1d5894cd66f13

SHA512
3aeed7719137372083d4ea93d0748d66e7174cc38f205e801ef8ece72de87775ea9e4cafffea0bb75f1ed80a9a8b620ae18f3e45485722ee530b51802e0c6fd2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
ca8102591eff12328e8415981c690873

SHA1
31bf4e36faddd93abdf9abd4df4627846696d6fb

SHA256
857dbfc185d3b917e8c8db77f6154545c2c970502c08f6d0e09606291a6eb4ca

SHA512
eae9a17e6f9ddac303e90b29d0de98228f6338cc2b5e5452ea211a1c696331b38200efe91c8d569e2109bef30baf2b85dedcfcdcab9a159e3453555e9788076e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
bcc5a525c21a765abee63d7e27f5b856

SHA1
f04b95f5342c3d0051b27220f51a2f4fe26c7968

SHA256
05a04132aef3eb2de8807b0c4926d559f2d169de29c55b1b290ce0438710624b

SHA512
96b593b0385fd7a6115197e9ebf39966ac83ed69f40524b5a5d37e10a43d25d7cd320e9b64e75941db3e6efe5c22e0db25d900a573089039fddc219e011f326a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_ga.dll

Filesize
28KB

MD5
7c8af529514df4e5b0679119c38c76d7

SHA1
abfd9b4c8a9f42a891a5dcc0b010e14ca5baecef

SHA256
3132a0a8fbf6e6453ee6e702e9a6fb762381f51c047521d149679e87e90cae47

SHA512
9de4324b52ca8de158a909114f898b9485b3625fa1ca515123174711f7329ca8db1ce1ad12128729c2fa616dd1fa3f74103052b90429ef19833c062a25304243

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
6744d58930e8a6feff6c8864f4c2fade

SHA1
20950eb138278e843722b4d76abce45b79be39ea

SHA256
f3d2ef4a2606e662430f4f1370b9201c0d0995bae89cbddb320b48d80dec6359

SHA512
589229880266a01d9c36424163747c3346945aed6d1057ac55b4bc234de9f5ece347844658303db02859a47149477eb6ada0209564f2d693f3cb5ca13fa15470

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_gl.dll

Filesize
28KB

MD5
611de7bffd3fdac3a9235c2a5edb4a4b

SHA1
bba11ee77f7b211cd2a545ba4b6b75e8aba0db92

SHA256
cbd7bd241306efa0015ac8da0b8131efc46c0e2708f14eb9e3375b5de1259463

SHA512
42a205c3ece65b80c4ca26b09876ee377c76f20d5f709dd8c1e4366e17cc9c89ee411752465b413e6eaf8439fc20f0233c8d17add94a040bd6ff061606eac206

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
f7fe21fb053273b5c066c98247e37742

SHA1
8c32ef5bde19194b7f08f6a4991992dec50b3de3

SHA256
e0ea5e8b21a6b240e89f6267ef86f358d6a64262f38451eea4728e55d05d5438

SHA512
b2951c0347cd2276da3da2c5d02f895324479290e75707d4a3a499c412a4be8d339dc52b4b5416e75f2a5c66fd9e363f490a6391dd6ec150cadd935ebb6d2f2e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_hi.dll

Filesize
28KB

MD5
b6d61617811d9e4cc5d0966eb001012e

SHA1
28460e7a0bfd48ce0b262e477bde36500fafe276

SHA256
4f007cdf835ffb101af0fb10ff7a9a267672c5f111af01ed0167ef0b401bab29

SHA512
aceec3064b2848128ab18ea2bcb8631d34789e8c12b6df18ee29d18878297ce940e40a09a572734da14345031419d7d5e50c0f085b53c901ec6e1ab695783f96

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
5af49e7e2dcae87eb3e94d5ab7ec13de

SHA1
eebde505c3ca36dd4570c285fc45221d9a2f1b89

SHA256
7ebe5be4955f5efe9c16c7c86c33fc52b7ffb79ec78ab656362c49cce52e6e5b

SHA512
4daf7795bd4bc8c85f3352acb4b3bacbf9a6ab03432d02929eb8c17008e0c028e7d92bf4ae504d61bc5b6dbf7cd08246db421411fe53a13c5e6249809e9e4622

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
f08d89f07d6fca78c885131e2b065685

SHA1
bfd4e1527dd7e33732e60e0b2ab2804ea077e104

SHA256
a8dd0875938fdf9671dc05da56b6ac5ede2f03a62b05ebce0c3b40293588214c

SHA512
ac6f8bd81334fa60c1d136947b9d845823ffd122ef8aaf1a0d8dd8c349a940910298e43530c4cb7c56bb8a4edf02818be7d688147607179d3c87751187f7f29b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUCAB2.tmp\msedgeupdateres_id.dll

Filesize
27KB

MD5
26a6a569fec7eb9face5cdb5d2280819

SHA1
cd5d58bf7db0f50253f146edaedf90da94dc7c37

SHA256
e36e9d602cf58161c1fb37e3f101c9ff0e42a862b8d5626b7fba68612bd17ef3

SHA512
fc21aecb49419a605a6681de05bff5b948ebf14c7f028fb65c00465a77f5e1a9ddec2f5af86154e76d45de75faced65c15c740951f55ddff033e757bc7cc4b0c

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
56KB

MD5
4efc8ff48992472368e11b5d9163fb2d

SHA1
89f8e959e0edbab14bd05bb63623c87fdb193a3d

SHA256
8cdc49a32aadc7610cbc7dfdc51a1ad81c285869b63817e10a703c85015c063b

SHA512
be6f589abb85f7ccfab2b385cd8b4bf48a35e99271992f38b2e42bd23ee3fe435f8087ef665d75a61d32f6d244d9bca75e51bf3818c7c57220e304d873d7e958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.157.61\recovery-component-inner.crx

Filesize
2.4MB

MD5
f28893c3053a372b69b27fba5719ff9f

SHA1
73c737a6f1191ab05944ad5075c8fa01a5fbc93e

SHA256
f1b2f319099c84789057212d87f3d213a5d7e5a2c08f1b79fac1ffd159bdff85

SHA512
105d4c2a9c6d20d4ecc2d890613e1920926e5de9dc016d9e397521d5af20a234b58fe77d281df32891569da9a1d2f1ae62b05d32aeb6590636b9fa097906c416

Download Submit
C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.html

Filesize
983B

MD5
81a5c46ac3078e69ee370e929c738602

SHA1
404c83c60bf8c5c711be2e99286549c55fed3368

SHA256
d6e6ad1b9a348ccab1255ccd894394aec921aa4ecbef55dec17cacdd8c5cd212

SHA512
5850a41591a39a84360db47992e360a4f618a28e949e49576cbe10bc624110665d3b1c14f0cfeb9197f567d10cbbe0cedaa9a9a9c281c426b9733f1e9a0614d0

Download Submit
C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.txt

Filesize
407B

MD5
f3d19c544c10a8337a7d9f7aef079a43

SHA1
252612bbdbdbe790853fe560ce5ce8e1df5fcdc5

SHA256
b660c9236f4d6d9b62eb04b40599e852f979dd3dbfd1d03e545a287fe8e5d32b

SHA512
c5cd69e7134f6d587d0823f6e7f9e5ba6affd75f5398fcea96e299dfb57996234ba87abe4632b2de807a4b79bbafd1b1132ae55b18a815eb8c4112b48942fb1b

Download Submit
C:\Users\Admin\Desktop\#DECRYPT_MY_FILES#.vbs

Filesize
185B

MD5
23e0e8c821b40253c04d561a6d06e253

SHA1
5df1808c8485ad1d90f1431adfa2694dbb1ed693

SHA256
54905816b33af2b53b2e127e0a7db664d126700b3fdd360894b9d924544f639a

SHA512
87a57f1615db68d57381b1a8602c92e57e3a8bf447ed842f410e50efd13a7f7ba44998b00d5e54238f09cad24ffe59c3aa788c1390364c465c761f3da6a688e8

Download Submit