2141f607d0987a83d9b6018d31059cc1bab729cda79bf7479d05a8241a639f82

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
load-file0dsdf567.html
Size 5KB
Sample260429-pp7awsbz81
SHA256 2141f607d0987a83d9b6018d31059cc1bab729cda79bf7479d05a8241a639f82
MD5 cb26b4faf47291db7e74e736787e4783
SHA1 b99a1291c173446fda2f1511a51183e6751b7dc5
SHA512 ceb4235ad0738ebf9eda5c23db81e268895560d722c47f8828d25284dc9d34334cea3dda10bb5a774f0ef4ad713496ad79ea04fb343ce2353f23f7e5793173b8
SSDEEP 96:fjFj7jOjEHDK/D5DMFLzLeiO/tjGAixleZNeBuo7RslvaQxvbzM:fjFj7jOjEjK/VoPnOV/WleZyuo7qlCek
TLSH
T101B19472F9BD147E2093917361BDB70A39A4C143CB9709903ABCC2755F8AF89AA172C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3292	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219425370502364"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{621FC0A0-5987-40FB-B06A-F5D62B79BF32}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2772	1216	msedge.exe	83
PID 1216 wrote to memory of 3292	1216	msedge.exe	84
PID 1216 wrote to memory of 1840	1216	msedge.exe	85
PID 1216 wrote to memory of 1840	1216	msedge.exe	85
PID 1216 wrote to memory of 1840	1216	msedge.exe	85
PID 1216 wrote to memory of 1872	1216	msedge.exe	86
PID 1216 wrote to memory of 1872	1216	msedge.exe	86
PID 1216 wrote to memory of 2608	1216	msedge.exe	88
PID 1216 wrote to memory of 2160	1216	msedge.exe	89
PID 1216 wrote to memory of 2608	1216	msedge.exe	88
PID 1216 wrote to memory of 2608	1216	msedge.exe	88
PID 1216 wrote to memory of 2160	1216	msedge.exe	89
PID 1216 wrote to memory of 2160	1216	msedge.exe	89
PID 1216 wrote to memory of 4348	1216	msedge.exe	90
PID 1216 wrote to memory of 4380	1216	msedge.exe	91
PID 1216 wrote to memory of 4348	1216	msedge.exe	90
PID 1216 wrote to memory of 4348	1216	msedge.exe	90
PID 1216 wrote to memory of 4380	1216	msedge.exe	91
PID 1216 wrote to memory of 4380	1216	msedge.exe	91
PID 1216 wrote to memory of 212	1216	msedge.exe	94
PID 1216 wrote to memory of 212	1216	msedge.exe	94
PID 1216 wrote to memory of 4580	1216	msedge.exe	95
PID 1216 wrote to memory of 4580	1216	msedge.exe	95
PID 1216 wrote to memory of 3224	1216	msedge.exe	97
PID 1216 wrote to memory of 3224	1216	msedge.exe	97
PID 1216 wrote to memory of 2188	1216	msedge.exe	98
PID 1216 wrote to memory of 2188	1216	msedge.exe	98
PID 1216 wrote to memory of 1096	1216	msedge.exe	100
PID 1216 wrote to memory of 2660	1216	msedge.exe	101
PID 1216 wrote to memory of 2660	1216	msedge.exe	101
PID 1216 wrote to memory of 1348	1216	msedge.exe	102
PID 1216 wrote to memory of 1348	1216	msedge.exe	102
PID 1216 wrote to memory of 2084	1216	msedge.exe	103
PID 1216 wrote to memory of 2084	1216	msedge.exe	103
PID 1216 wrote to memory of 3028	1216	msedge.exe	104
PID 1216 wrote to memory of 3028	1216	msedge.exe	104
PID 1216 wrote to memory of 4112	1216	msedge.exe	105
PID 1216 wrote to memory of 4112	1216	msedge.exe	105
PID 1216 wrote to memory of 828	1216	msedge.exe	114
PID 1216 wrote to memory of 3648	1216	msedge.exe	115
PID 1216 wrote to memory of 2128	1216	msedge.exe	116
PID 1216 wrote to memory of 1564	1216	msedge.exe	118
PID 1216 wrote to memory of 1564	1216	msedge.exe	118
PID 1216 wrote to memory of 2752	1216	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\load-file0dsdf567.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbbd9fc188,0x7ffbbd9fc194,0x7ffbbd9fc1a0
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9583866322473880929,11818221918905518876,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6157874320689643579,4514215663383823866,262144 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,18317256501248301928,14623641130172240757,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,14667803581999959505,17696561131706647196,2097152 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,12906008620573230706,3988386826248827742,2097152 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,12841965503019390123,13987633161633255853,2097152 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10170398074307122938,12551660307037270152,2097152 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,5300976927572781981,6220526961217450997,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,15248326066878097231,10465466053117778987,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,84694426480409289,11906102449494589925,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,830834901732733488,10367638832360226700,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,17263229722923569383,2167311733421911475,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,17263229722923569383,2167311733421911475,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13507245572544316031,3602288650839056373,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,17613088242124189541,17655398322063482300,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,18161828227013595932,923044056046162624,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,1785277387205443409,4323255665440031799,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,1781979049914360073,7973854692153058291,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1426570208350157079,8622512064143092490,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,16006019584330436455,16178663671150740957,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,883805303616356011,2306505407899450101,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,9493652787913495530,8423020375320210944,524288 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6336,i,3474616208688060560,4391222310924813230,262144 --field-trial-handle=2280,i,4657906937836428897,17810041441784077754,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 329f09584b2d1b595fd09386d31dbe1eec1906f7d450ee40fb405617035e9b3b
MD5 c89978251aec9d90daf9a199726976fa
SHA1 72d52e478c5ea1ddaee134eed8228a6bfada9c3f
SHA512 898671bc521bd5dc24824557f42f33f18007179c03133a4c176d62af1a4afb01dd96179fb320915cfa4fc4d3e62c77cc770436b76ebeb4b092c4a313f9100f39
TLSH
T140D0228CC300A820C3CC88B220ABAB88282AC820820282082CB2080C2C82282300E082
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2bd3d8acad7d87faaaf9e7ad0b2cde732c6b9d81cc99b60b8f4603119990e753
MD5 c9bb0c8db7b89aad46acd9c9764bd5ba
SHA1 1990e5165981ea9ef4100a3b0cbc52a1b98c7c35
SHA512 2874eaadfa4a756a4ffbb2a7a3ff7274df840eb2096bb90ebbc8853bd037aa27f288149599b1a35390dc6f1e1fd79fc91ca87c4c7919643df8aaac28174beb28
TLSH
T1DD61B35561A3942AE7E0C0BEDED2E01D36BF4FF481BB0F59FEF4043D4615B524181908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 491fa3c550f80abf9d0ec266479dc8ca802167b946a67b3c4aeb5f35f0f16167
MD5 3c0f29425f1bb030e18ff9466a8a7f58
SHA1 a43c24548ec4481c0a77229cc541ee095dd1f938
SHA512 c0e282cb5fad03399139d1bc4f0c4f2a1ebd03a81b660a0334177eeccd87b648a0be45793a13f62ee953804d0fb58afdc2a944c917b1d545cfc048a87d091f4c
TLSH
T185519DF7C2E8866DC95196F0AA187E2FCE2D0A15432C3C5A89E4AF4B93E2470E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8167735a6fdbc60e1cdc7f6eb5e1f4192632afcf98fb241a7f3500be13db3900
MD5 efd049166aafbeeb42635b63a9dab2bd
SHA1 0254fc1a904ce3c74fb78cac359c9424c229a1d3
SHA512 506d58f3df119b3875ad73f80e3ee9d5cdfa59f40897cfa371a50d6850fd2812f99675254989b77bc52fc9aaf314b8535bcdfb8f6f620e13630334ef395a6e25
SSDEEP 192:sxZKRqyM/jK1Ml8Mk7/fwsiH7xKRP/SIdpd+HW6+WNGz6WzxnRhIg4J:sxZKUM7/fwsiHiXboHbGnfc
TLSH
T19552E806AA345977CCDBD209BA45BB53D6F94473A2940E44AEFCDA0C04E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 142c85d913cb8bb96162936613a4d27e8f7da840ab9cd5319971a631a3dcd6c9
MD5 449715d57d9d2746c3fe7b273cc283ad
SHA1 0c95bb24f75417fdf3676da9f48bfa5fe1d27dac
SHA512 4cb8e17067a95dd75ba48c217cec78f724f2f2251f8246d6219f889b77b0fc67ec02ec5e6139c8766d1c0136c7cf00d7ef241f71aad11e2b09185c9bd97c50f3
SSDEEP 192:sxZKRqyM/jK1Ml8UQQFk7/fwsR07xKRP/SIdpH+HW6+WNGz6WMx0IhIg5qJ:sxZKUqQO7/fwsR0iXbeHbGOjY
TLSH
T1C662D716AA345977CCDBD209BA45BB53D6F94473A2900E44AEFCDA0C01E6BDD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8a03e8de4423839323f55579e16d8781cde3767b39166de169b9db2260a31430
MD5 c22ca6775c3104150f6ed2c16bc41065
SHA1 5d1ae3a979f8dc0186ef0cce8c141f2b08a5d5c7
SHA512 9a89a8e0821bc81236fc929a515a99e65076676fd39bbc0c3ffa445c695f31826b708b54ecfd2d39e50bf6b941086df271e0832d2eb8f8d717e88b9728e721bb
SSDEEP 768:cG0G9Qek7pLuLnFJWvFnSP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrI18LlSMdFTrJ:cG0G9QeoEnFJWvFnSPu1jaKI18LcEFgK
TLSH
T17CF21B3B6C0CCB7E4F844E9CEC2A7E9A6DE8018B96DC894447F9444C03C66EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 da853d6bf6a75dc508a73a0f224faac0b121ef9ff0eb90004b50b4ab1f932daa
MD5 2fc0af580bea2d723908ee74111e8686
SHA1 2a3a1fef3f896f1398a493bc69fedcda2ea805b1
SHA512 f6b0bf4eb13c0abe5a3477b19a4114c286acfe23e04f1c77871d986cf1f6429a63c448c5cdb24eda06a422577a45224b2a5150f167a8abf4d7a897d4fb97d5ba
SSDEEP 48:KIbIZKoocjyRyIfKLiQPjIxKIA0DyFRIlK0:KIb6KooCiyMKLiwjKKIAq+RmK0
TLSH
T1B9A18465717B02C13D7D645693E8A61BCA8130E334ACA42B3BEC55A24F76E109CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b58da2a-577b-42c5-8400-a80a6dd4c956.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4b58da2a-577b-42c5-8400-a80a6dd4c956.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c0d855891b9c09dea7550fea143c40f5b36b2236a9881be73a815778f6c978c9
MD5 b83ba27d9c3fd18df5b2345f19da428f
SHA1 91c262da1fb954b499d8457ed63f8388738bc7a2
SHA512 cef0ab50a3cbe874497c00bfe35bec13186afb04266e4b7c79ef5aec2d28c6db98ea24d4b351cc43889d6e4240edc2867c014d33f0d82d9cea5477689b50e435
SSDEEP 384:nYcXqn6sNpCQc+CZgstX+hOhkQpJrPjMEGR76ay5vDbf:K66CphgOGmhPjMZRA5vDj
TLSH
T12C827C36A5281C7B9FA28B45F01B37575FF960A786962F54DED8AF0C008779C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 3c42ac135dec8c2e754f18225ebbbb68e679d0740831edfb84eaf2a25fedcb09
MD5 3f6213897f86ffd8fe49282476bf174b
SHA1 bf4e85b81fc2b6382bb99ece994eb6fbc6a0e3f9
SHA512 e9b4b25456b8dfcf7b0f8149863e3885a9e6f01b7529accb4b869f0eee9dd96a963c71f450056a8104eb354305f44dcd7be41c294587803b8d146a4c42f2287e
SSDEEP 384:nFiFrcXqnizsNL8TUNTUlIl1Qc+CZgstZDf4L+hOhkQpJr2jMEGR76ay5vDbf:MFzqmwgYCpwLgOGmh2jMZRA5vDj
TLSH
T184B22936D8648E7BEEE28BC6F60A76479FE110A386C96DD4DEC86E4C00836DD130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e5a6a4d5b1c80a91ce33283a8a002614c15596b66de5bd9a069971a4a586bf5
MD5 322a529c0263139377c8d30e36231c77
SHA1 b2b0fd360511ab2bc01d22d5eb044fb568af63f2
SHA512 392684b578cdb1baf398e473852b34bf9cf9ef714d415468d16a5d4175ce9f212118283a5767dc8250b12c1e78ba0abdaf617f5f344ed52d10837347ae0e01ca
SSDEEP 192:0ONU6TZ0HQmiUyQlvab+jNOV7FeUF8rSJrFcXjIrqCU6:0ONU6TCppvg+hOhkQpJrAjMU6
TLSH
T132121A3569286CB78FA2AE55F44736279FE5107B99862F94D9D81F0C00C779C230BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 94c4c4c56080d7b46f2f79900f6d9823c7be466126bc0e383ab6a45f50f048c3
MD5 d929d22826a909e8905545ffbf21752a
SHA1 728e615f4f6d65f2f51c20fb107943893011f35c
SHA512 bd66bfc2ad50c1c6580d5ba401d2431ce01cb7383b8b70a9fd50256d496cb25d6c08d4f793165d080c4c5919f50ea830ef66dbd7d97408f08dffe4aa35ffb4ca
SSDEEP 384:nOcXqn6sNp1Qc+CZgstX+hOhkQpJrPjMEGR76ay5vDbf:s6bCphgOGmhPjMZRA5vDj
TLSH
T120827C36A5281C7B9FA28B45F01B37575FF560A7868A2F54DED8AF0C009779C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2a47424b2c50f2237d63c5ae2d8e9218c229d096fd301ce9a6c3387d93bbb5e
MD5 84c51d8d53a34bd9d2ca85524831e51b
SHA1 d4bf81d7d6a91dca61f1b72cb70f6e3c06d6815d
SHA512 ec59154ebd92928d7a7f96d59fd7dcd8512565fd7bd9856fea8007bcbbc60014eb8aedecd482c081315f1c0b9c40a60193652a4c73c1343d3f93e1ada1b2a1c3
SSDEEP 192:YONN6TZ0qQmiUyfllab+jNOV7Fno8jeFU6:YONN6TCm0lg+hOhbjyU6
TLSH
T13A02083569686CBB8FA2AE45F44737279FE4107BD9852F84D9D85F1C00C779C2707922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

526350d1-a0fe-4740-b06e-2792afd60484.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\526350d1-a0fe-4740-b06e-2792afd60484.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c95d3950c543373f544de1e4ebe8f7de226afeee4b9bd002ec249ab29ec9603b
MD5 12a41a158bd614fcf7a91471bb21869e
SHA1 a130e5f465359fa53ba29959298b03a4412a71db
SHA512 ea784c5418cc29aa45f36efb7610b3c059666ca7e8fa848167c61b1c329406c17a003c0dce68df414ba917a105323264c65dec641ac7a7ebd68819cd08c14779
TLSH
T1CA411C59A6EA1148B3B76F16DBF6A87D447F78372E06D49D00110D4F0A63F41C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

c1b9c971-5b60-40e6-ad33-d92b000a6917.tmp

Path C:\Users\Admin\AppData\Local\Temp\c1b9c971-5b60-40e6-ad33-d92b000a6917.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea893f2e-3f25-4a15-bcfd-8e860bcb93f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\ea893f2e-3f25-4a15-bcfd-8e860bcb93f7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1216_860156009\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f4d088d-9512-4e3f-a26f-d3989a003842.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1216_905689980\2f4d088d-9512-4e3f-a26f-d3989a003842.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download