hxxps://lskannsserv[.]beer

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lskannsserv.beer
Sample260804-lmvmjaswey

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303099786543333"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FDD4427B-726B-4C76-AFAD-71C1DB91DD8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1744	3080	msedge.exe	88
PID 3080 wrote to memory of 1552	3080	msedge.exe	89
PID 3080 wrote to memory of 5052	3080	msedge.exe	90
PID 3080 wrote to memory of 5052	3080	msedge.exe	90
PID 3080 wrote to memory of 5052	3080	msedge.exe	90
PID 3080 wrote to memory of 1444	3080	msedge.exe	92
PID 3080 wrote to memory of 1444	3080	msedge.exe	92
PID 3080 wrote to memory of 3776	3080	msedge.exe	93
PID 3080 wrote to memory of 3776	3080	msedge.exe	93
PID 3080 wrote to memory of 4020	3080	msedge.exe	94
PID 3080 wrote to memory of 3776	3080	msedge.exe	93
PID 3080 wrote to memory of 4020	3080	msedge.exe	94
PID 3080 wrote to memory of 4020	3080	msedge.exe	94
PID 3080 wrote to memory of 4352	3080	msedge.exe	95
PID 3080 wrote to memory of 4500	3080	msedge.exe	96
PID 3080 wrote to memory of 4352	3080	msedge.exe	95
PID 3080 wrote to memory of 4352	3080	msedge.exe	95
PID 3080 wrote to memory of 4500	3080	msedge.exe	96
PID 3080 wrote to memory of 4500	3080	msedge.exe	96
PID 3080 wrote to memory of 4652	3080	msedge.exe	97
PID 3080 wrote to memory of 4652	3080	msedge.exe	97
PID 3080 wrote to memory of 4652	3080	msedge.exe	97
PID 3080 wrote to memory of 4908	3080	msedge.exe	100
PID 3080 wrote to memory of 4908	3080	msedge.exe	100
PID 3080 wrote to memory of 4908	3080	msedge.exe	100
PID 3080 wrote to memory of 692	3080	msedge.exe	101
PID 3080 wrote to memory of 692	3080	msedge.exe	101
PID 3080 wrote to memory of 2036	3080	msedge.exe	102
PID 3080 wrote to memory of 2036	3080	msedge.exe	102
PID 3080 wrote to memory of 632	3080	msedge.exe	104
PID 3080 wrote to memory of 4720	3080	msedge.exe	105
PID 3080 wrote to memory of 4720	3080	msedge.exe	105
PID 3080 wrote to memory of 4720	3080	msedge.exe	105
PID 3080 wrote to memory of 4616	3080	msedge.exe	106
PID 3080 wrote to memory of 4616	3080	msedge.exe	106
PID 3080 wrote to memory of 4616	3080	msedge.exe	106
PID 3080 wrote to memory of 4088	3080	msedge.exe	108
PID 3080 wrote to memory of 4088	3080	msedge.exe	108
PID 3080 wrote to memory of 4088	3080	msedge.exe	108
PID 3080 wrote to memory of 3104	3080	msedge.exe	109
PID 3080 wrote to memory of 3104	3080	msedge.exe	109
PID 3080 wrote to memory of 3104	3080	msedge.exe	109
PID 3080 wrote to memory of 4364	3080	msedge.exe	112
PID 3080 wrote to memory of 1996	3080	msedge.exe	113
PID 3080 wrote to memory of 3380	3080	msedge.exe	114
PID 3080 wrote to memory of 1068	3080	msedge.exe	121
PID 3080 wrote to memory of 1068	3080	msedge.exe	121
PID 3080 wrote to memory of 1068	3080	msedge.exe	121
PID 3080 wrote to memory of 4392	3080	msedge.exe	122
PID 3080 wrote to memory of 4392	3080	msedge.exe	122
PID 3080 wrote to memory of 3680	3080	msedge.exe	125
PID 3080 wrote to memory of 3680	3080	msedge.exe	125
PID 3080 wrote to memory of 3680	3080	msedge.exe	125
PID 3080 wrote to memory of 2368	3080	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lskannsserv.beer
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffde1fc188,0x7fffde1fc194,0x7fffde1fc1a0
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,5181608421357589245,4422387194444944970,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12932790818289209705,10349414378888005705,262144 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10930057312193182242,12532409523886741969,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12050000890770534701,12038576538416734185,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5170462554403754511,4903787665831064111,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,2586294250510347070,17949922256942936878,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,5282919100745018585,4195379474642495497,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,4935163000471256629,677178433048449726,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,6164714949728558047,5207637302855381605,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,18020977770151008007,17601047504041543987,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17810322433730930904,6353226021841742398,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10062326347666092694,14407948795847623655,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10062326347666092694,14407948795847623655,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6344,i,12177791421740523338,6043682096094307613,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5196,i,12873000793190495148,18402493667638662930,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6316,i,2735954635528982748,14274780866257641906,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6056,i,13270719207263726104,12460076332785018769,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16943166923751541289,14682919196052246402,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,4677211772161555528,14875890642420795660,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,10423756245587332726,4496757304608054792,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3060,i,890342857578452806,11784964422980048775,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4647771719384525596,15096403780333144208,524288 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3680,i,3830815782771710525,4896765166111491599,2097152 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=560,i,16459457793666768509,16574762334095533588,262144 --field-trial-handle=2196,i,1321476976926607196,9783334366887482369,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

35edcefc-d006-47a9-9a2a-1f1b09e421ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35edcefc-d006-47a9-9a2a-1f1b09e421ff.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c71b58e9e15536332fc9d361dfd924d55f2acfc6ec97cd2e0a7324c6945a5c73
MD5 c8801da288dc523d7346d29088dc502f
SHA1 da05eca8df20ea1832f99db0392ec20954e8e633
SHA512 f935cc58e3327b935cea3fafd8da354dd0d84eeaba072e206ba414397fb7725e83f50bb3fff7aeeb3fdafa74f95d3a61de15dd27b0afe3b22a46232a8a2c4985
TLSH
T12D5151180651645EE730D231C0E01B03BE36C1F989BB8E380250D9BFD7277E79B6901C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a6e9.TMP
Size 2KB
SHA256 3ad8ee565e8fd0220d76395b49dc75a4e6a82c9b4655d697a5a9f7e9e80c02cb
MD5 4dd580671f007e5126d810adebf31885
SHA1 6ab67920200e266f80e8f7c707875e7630319f43
SHA512 37e565dd104e2d84c3de188074d4f165e84f16956b85f63ef1fd447322c3ca8e3a6909e5ee1cf336b527bf31d0ff2d35aa1f072891501ae5536912102e822af5
TLSH
T18B513F180652649EE731D231C4E01B13BE36C5F9897B8E390290E9BF97277E79B6905C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 63c4c174ff45eb91589551f6fc3f9b4577c93e55df688f9af8574065806573c0
MD5 fe68f79fea985128215b0b11b6cc7ab3
SHA1 35eb18f3c3766dd17444a8b4962ff9b90490d613
SHA512 cfd10cbc388996185e222f79550e1a59ebfd411cb63159bfdfeca37b50393efff6aac7512649774ccbb4244d7f6b296105bd215fed7bf7b0e2856c31e163bc0d
TLSH
T145218BF7C7D9866EC90117F09A24AE1BDE1D0605821C7D1A95D4EF6B93F3035E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78e6117e3036fcdfb5755fde0641de490f86f9c9626481d6ade77ce0e357c640
MD5 84e59bf5bead546a3fd2c5650a114682
SHA1 95dfa0228a55364814be207f64153b89200c7b2b
SHA512 2da57e253147a98838de157e0e0b311994ff3d530ea5bb5515d6718a41266183bb893603fbbff77db7c274b83852ab02befa8e03fbf2c81607e66728e4931602
SSDEEP 192:sxZERWyM/jK1Ml8Mkr/fCsRwyIdp/w6wHHyt6+WNGYwKiQLIgrJ:sxZEgMr/fCsRw7gHfG+9
TLSH
T1E952E7016B38A97BCCCBD209BA54BF53D6F9557292900E44EAFCD91C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e38917e5b9233900fdb80b2aaa60253e07f061d93e16371f795d5baea1a60cfc
MD5 7d3f6f622c4db3b290b8ecbee924624a
SHA1 c0db5ccacd24b3890dc950d64635f0c80e4a9852
SHA512 e90c8f68ec76809e197a32c76802730729c136ca1e4e18bf731d878321356106a0a9adefe83465700ad5fc77d3fa3c95c0113b2f851ec8a8c2af8aa897549401
SSDEEP 192:sxZERWyM/jK1Ml8UQPkr/fCsqRAyIdpBw6wHHyU6+WNAVS/YwYXZLIg5MJ:sxZEgq8r/fCsq27yHQ1/4a
TLSH
T12052F801AA346977CCCBD219BA44BF53D6F9557291800E44AAFCEA1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fc8fae1fe30acacc70ea76a4ba459c54ee2b075b8739dd7ae9ddf26c6028c0cb
MD5 cb05fe7f30bb1397ca0be68990b450e8
SHA1 74ea567f159504d7fe56e8384d94a654a35523f2
SHA512 b6c83b53aeac4a7bcb226bcdc9bfa9d53a860c44790e2ee68cf92e6d27a0fd6cf976a69901a82a2703520360cba9e92991d4a32f608c8cfaad12249dfa112d31
SSDEEP 768:8B4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dnrohacPaP:8B4jeXmWvmKLEu1jacPLZQd0Xo
TLSH
T124D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c0670ed288945adc30f689053978bcd3325660456d366994c42dcd4a14292f5d
MD5 b9758d066c6f4743c221c631ab39d585
SHA1 908f9469877f90575fbad4e86ca4d326964d4a5c
SHA512 64f01cf4c420fee232092d9d2401e5c78452181bd451c10310045b02a87348089cc670531af55079625351770738a612a93390487d75970e0c7718419c64885e
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCA+L:WvdxjfQ
TLSH
T185C1D29930BF02163D7E2509A2A4D7274F4276A37419E42B7B6940B20EA7E354CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594126.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594126.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5f9d010961335d6802365c718bf1fb6f78d5e98f5b77f5cde4897f90790e1d29
MD5 8aaaa5e470cadfd9baaee3763dca5727
SHA1 eed98bb5aa43ff072c1a69b697cc517ebfc3e8a9
SHA512 499620a97a9d2842a180e746db5576a12f5e1a19657d0cd41e9e340fa41af7e63a39780960af2537ece724abd136a64ee58aee14cf3916b705c5ed335efeaa18
SSDEEP 384:CYZcIhsNMkN0a1Gf+MOetB+2vFwBeRs9JKgqijUXv:CmhleWhOqBltwTjKgqmUXv
TLSH
T157927E3158386D7799E6A685F88736274FF89027EAD5BFD0E1EC7F0D008A59C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b861f877ba824f5baba4810d01a76842692e51df5946472cdc9176b7de1322ea
MD5 940725aec2117b5517a0c6745fc45357
SHA1 876535baebdb8a2681def8fe441b63814941d65b
SHA512 84a6f9574304341518463acb300b252877ada58df984767334499ad62598f9dad0c973f83621cc199f26374e76cb90b4392b129839233d62cb46f12ef859541a
SSDEEP 384:ahiFiZcInzsNE8TUNTUlIlzN0a1Gf+MOetB+2LFwBeRs9JKgqijUXv:aIFQz9wg8eWhOqBl5wTjKgqmUXv
TLSH
T11AA26C324868997B9DF6AB85F84A36278FF55067DAD5BB90F2DC6E0D008B59C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c0a03501de82bb7cd9476d8e70f20f20d0ca4626710ee70b8f23b8b95ad24ed0
MD5 a9fca290483804f6a53014667c1de2fc
SHA1 b5ab75894bf74e65af6023e2b64c91f2810e11b9
SHA512 c27c8636f85bce804f408cd99b4f355ce39439dff457f738cc56398e603fc9baea6158a484c5a087ff9215a0e3c4d2a91a549c57d3303aeaeda37bd1e9dda8c1
SSDEEP 192:EONg6hZ0QmiUy81pc/+jVqO1Qz5wOZPT9U6:EONg6o9pu+MOeK2PBU6
TLSH
T15002E73968686C778EE2AE45F48737235FE5117BE9957F84E6E82B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 734139297fc62951f1bf15932c078a80576f1594200c0582f73cf1e42d903d6c
MD5 5c6b77a9896a35bcfaa77a396e9ddeaa
SHA1 465f22299a7c8dba9f3bc7f7b576abd9c40f57ba
SHA512 adaf92b14eac42da27754b7fb4b33293004ee20c1e46732ef123a4f3051b542efb6c5cd19cb5e78706f6006d8e4305946e3d15c3e91c0de2f973d28896898f79
SSDEEP 384:yYZcIhsNMzN0a1Gf+MOetB+2vFwBeRs9JKgqijUXv:ymh6eWhOqBltwTjKgqmUXv
TLSH
T171927E3158386D7799E6A685F88736274FF49027EAD5BFD0E1EC7F0D008A99C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55ce13cc021b721995a707c00e81f5037599e57a0799aa1bdecf33006bbca7c2
MD5 5c96746867b3602fb7e1f4e7a4e74068
SHA1 1dc2ce1d0f547328ec1d48be11a9bb4b7f6cb4b5
SHA512 12284a0fab3c1fad4e54c886c07eb9d2de720c59df71a5cfc195ce0fc70263ee8e865f1ac6e9f6de78a0b035fdb202efa68bfd12f34d2a88b330d0799abdb7d3
SSDEEP 192:QRONV6hZM8QmiUya1Sc/+jVqO1QtB+2bG5cOqLqLU6:QRONV6AMJSu+MOetB+219wU6
TLSH
T11312F9356968AC774DE2A651F48732278EE55127EAC5BFC0E5DC3F1C04DF66C230A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfc833e8-161d-48c1-9cd5-1e2c09c7cc70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bfc833e8-161d-48c1-9cd5-1e2c09c7cc70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b3bb64f8766b707207a60a0243012811b75c80759531fc8de6f5d013882c46c8
MD5 78aa28e94dd0d5ce0b9b510caa1582a1
SHA1 296fb35ba9b0edccecaae7b8e65c48c8a8309c18
SHA512 1b736c96e3b5311d74d59fae52fbcd7f78ccaf1708b9059e5b6d5b20acdc3cf925ca1faa2b26616e0a12ae05cefccbb2f0f281dc55412eb107d27a6b0bed437b
TLSH
T154410C58A6FE1108B3B76E5AAFF6B86E487AB9772F07D45D10110D4E0A72B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download