hxxp://file/localhost/C[:]/Windows/System32/drivers/etc/hosts

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://file/localhost/C:/Windows/System32/drivers/etc/hosts
Sample260814-a3vrpasalf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311418947963917"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DDE12E12-8758-4225-BC72-33AFED75F947}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3052	4228	msedge.exe	83
PID 4228 wrote to memory of 4232	4228	msedge.exe	84
PID 4228 wrote to memory of 4728	4228	msedge.exe	85
PID 4228 wrote to memory of 4728	4228	msedge.exe	85
PID 4228 wrote to memory of 4728	4228	msedge.exe	85
PID 4228 wrote to memory of 4548	4228	msedge.exe	86
PID 4228 wrote to memory of 4548	4228	msedge.exe	86
PID 4228 wrote to memory of 2636	4228	msedge.exe	88
PID 4228 wrote to memory of 3920	4228	msedge.exe	89
PID 4228 wrote to memory of 2636	4228	msedge.exe	88
PID 4228 wrote to memory of 2636	4228	msedge.exe	88
PID 4228 wrote to memory of 3920	4228	msedge.exe	89
PID 4228 wrote to memory of 3920	4228	msedge.exe	89
PID 4228 wrote to memory of 2784	4228	msedge.exe	90
PID 4228 wrote to memory of 2784	4228	msedge.exe	90
PID 4228 wrote to memory of 2784	4228	msedge.exe	90
PID 4228 wrote to memory of 2036	4228	msedge.exe	91
PID 4228 wrote to memory of 2036	4228	msedge.exe	91
PID 4228 wrote to memory of 2036	4228	msedge.exe	91
PID 4228 wrote to memory of 1380	4228	msedge.exe	95
PID 4228 wrote to memory of 1380	4228	msedge.exe	95
PID 4228 wrote to memory of 1380	4228	msedge.exe	95
PID 4228 wrote to memory of 2264	4228	msedge.exe	96
PID 4228 wrote to memory of 2264	4228	msedge.exe	96
PID 4228 wrote to memory of 2868	4228	msedge.exe	97
PID 4228 wrote to memory of 2868	4228	msedge.exe	97
PID 4228 wrote to memory of 4768	4228	msedge.exe	100
PID 4228 wrote to memory of 3460	4228	msedge.exe	101
PID 4228 wrote to memory of 3460	4228	msedge.exe	101
PID 4228 wrote to memory of 3460	4228	msedge.exe	101
PID 4228 wrote to memory of 3500	4228	msedge.exe	106
PID 4228 wrote to memory of 3500	4228	msedge.exe	106
PID 4228 wrote to memory of 3500	4228	msedge.exe	106
PID 4228 wrote to memory of 2444	4228	msedge.exe	112
PID 4228 wrote to memory of 1644	4228	msedge.exe	113
PID 4228 wrote to memory of 3000	4228	msedge.exe	114
PID 4228 wrote to memory of 4520	4228	msedge.exe	115
PID 4228 wrote to memory of 4520	4228	msedge.exe	115
PID 4228 wrote to memory of 2376	4228	msedge.exe	116
PID 4228 wrote to memory of 2376	4228	msedge.exe	116
PID 4228 wrote to memory of 1660	4228	msedge.exe	117
PID 4228 wrote to memory of 1660	4228	msedge.exe	117
PID 4228 wrote to memory of 1660	4228	msedge.exe	117
PID 4228 wrote to memory of 1920	4228	msedge.exe	119
PID 4228 wrote to memory of 1920	4228	msedge.exe	119
PID 4228 wrote to memory of 4460	4228	msedge.exe	121
PID 4228 wrote to memory of 4460	4228	msedge.exe	121
PID 4228 wrote to memory of 4552	4228	msedge.exe	129
PID 4228 wrote to memory of 4552	4228	msedge.exe	129
PID 4228 wrote to memory of 4520	4228	msedge.exe	131
PID 4228 wrote to memory of 4520	4228	msedge.exe	131
PID 4228 wrote to memory of 4520	4228	msedge.exe	131
PID 4228 wrote to memory of 1116	4228	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://file/localhost/C:/Windows/System32/drivers/etc/hosts
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x294,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,17714830441735856312,3888710022843761898,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16646642031206578252,929514161618619817,262144 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,564335667571729933,15706587676160002562,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4019271164786449495,4067551789423391962,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7864743005245010012,16482690046605306297,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2256352066506640678,18077643353626354901,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4420,i,2315051018353202471,11463908215452294695,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4868,i,4657111479628935779,2152835691166929590,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,1824073903334706215,11828251009449990937,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,11323219464984219801,2565381941613922151,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,18383172706286729457,14892495174464283376,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,18383172706286729457,14892495174464283376,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6080,i,7464763712295706532,5516558606039923596,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5152,i,15407332299740625231,4183839461405208765,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,13280457507906646827,12060164367888113820,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8175881592695562961,11975613563237668258,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=572 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,14492837996191697666,391130843023634789,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10985705387520573975,2045144148334317918,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,1487630362504259835,14831305263594673467,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5300,i,15695759829091088437,8999681416271735264,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,6903810055664767332,3161204266785054320,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17251272792689493094,3820311095806264341,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,17506917219131903119,7585145508683057624,524288 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4988,i,17794106940909645673,2778625012166629265,2097152 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3744,i,13264417830974586501,12832718290101540978,262144 --field-trial-handle=2312,i,15718487205200853493,5585192286222502332,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d532012-7593-433d-9cf1-7727bb06266b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d532012-7593-433d-9cf1-7727bb06266b.tmp
Size 8KB
SHA256 ed9e3f753a40dd6d2f963c20d0193db77203620766a4c486e8c21b4ec342e3ee
MD5 690ab6e099d524e41a12b37b3f568a9c
SHA1 4b22bb3eed8e43fd23c8c1af77c66c01b548d7b9
SHA512 6f17f472e8b6b3fc6eca74fe359103f7ff507d9d1258479d23e71db3120ecacf72a97580b324a5f5ac57f82c74f43c3da9a2b002326fe5782ddcb252700080be
SSDEEP 192:tONK6JkRtQmiUy9rW+RN3OmNOmFHh3oROFU6:tONK6Ur2W+RN3OKBpdU6
TLSH
T1A702E9357D382C7B8EF2AD09B98B27135FE4206BE9952F84DAD81B1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e553d63669b9170784876229b42b415b17aafd87b15e9d0139d828750733a937
MD5 c02aa38227eb5ee84342496be7c2b212
SHA1 4e2586b157ee50e7efde26a1b5046c64ab381732
SHA512 35090ffe458f3d3782ee99f6e5a079e9c33bbe442442cdd724f69c2f8983a90235fa13d7a03eb974a4797428b2181166e76595b7d246c01af4ae3901c9448bcf
TLSH
T184E026E416CAC26FEA80664F777C570CC2A0764FD2C8B98A2750C49D7001050E2D77A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e61960fb0c739a5f32e6ef4086fdfe0e4d576c53aed1d7ea23ce5ab4e0ac8a66
MD5 56e21e6614eda1aa5d7b3d0ad698b12f
SHA1 aa8502456ca9cbcc154601eb641ecd06b0929de0
SHA512 f7215542f0d84bb923f9de206c922837f3e81db4bfba8b3bb321fa75354cbf80dd170174276ad39f3b3da7169c64b1e4a89c79b21a2454a785ff825e61c2eb12
TLSH
T165E078881DD9C23FFB786787616D770C8190378FD7CDBD4E57488548700555472C7564
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9d2a409d8a2dc6ddbaaf06236604b3133d78bdeee92b5044be7dd611729ce895
MD5 4553613b3ec6ba4f5dbb2fe8e7c06201
SHA1 ff5c551b7185ce6b1afc7181eac45cf7dcc9dc1d
SHA512 8b6337231e2af713dbb5f158a69db66899aa1d6608c3722f69b983edbea57f5e0bda025dc726b6034217a7a816b2f503700d3fde8e1b570c9fd2b9aad8bc1428
TLSH
T109715EFE18E30FA5EB11F2705AC10242B13085EBF613ED675D80D7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58653d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58653d.TMP
Size 3KB
SHA256 b5d6ee6c6043bd147e180fc37b01057c9f74f44c4c9a293079e59c91d83d3c5f
MD5 2d4180f3b6bd67d8917409a21c5ba537
SHA1 954d54eb10d3897d4beb0413ca3539321ac367dd
SHA512 fd52313bee15604203a079e2682613cabc0780250fc53dfdc90aaf6e32cffac6e4eac0d6b579c0f89adac8d5d324c0220f76fd4efd294f7abf981d473e6a69d4
TLSH
T11C716DFE18E30FA5EB22F2705AC10242B13081EBF613ED278D80C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f365e48341479cea38149a2b040f3f2778a3dda43e7ca58f779bfa3412f7f196
MD5 ae3e654c01c8e77029f4e5490c46f89e
SHA1 6f55a82b5db735764dfe0c641370f5cda2d45083
SHA512 a296dadf5896d9567ff4fa122e6e576da24854e425c78a411e4e8b012d6d2a97e249df94f121d93f5df8da0d0078add1197091e64bbd5339d536d23c7ffdd4ab
TLSH
T182218BF3C7D5C66EC91216F0AA24AE2BDE1D060642287C59C9D4EF6BD3F2075D102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c6e3153450448d1690cb99a84ed479b6acaa05b67b927f5016a97865a225edff
MD5 2c6008992528451aabd1ec7894cd3645
SHA1 b660ee3de41d7f03680738903c49cd9b1ede6472
SHA512 9122ace1ac53a2eee67fc172dacd4ad462ea79b37b0ffc1690d1a65acd559700e8aedee401fd2c1e415febdb6213e276f0b7e53e5d573f19b6ea66911743d586
SSDEEP 192:sxZnRukcW/fVseTHNIdpnEZHW6+WNGYIkCOiIgrJ:sxZnPcW/fVseTHuwHbGX9
TLSH
T1EE22B7116F38A53B4CC7E21ABA157F53D7F95072A1D51E48AAFC851C04E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b91bcdf0ec6633ef7ffb7e6f9245373fa8d3ea11471a862fcbc9a53e29165c32
MD5 f791dc119570db34ec4423517c8f4f4e
SHA1 d3a12b62440b24d1527501c55885df588fa2f747
SHA512 a8796137a5554d38bac75669b8401ef590140ed7a06e26249b46e9c2fc8321d01bc60b0bd5423ef79d5ba3d0bd97f6a121f010a7fbc7a1afb54cbe74e3439cd4
SSDEEP 192:sxZnRukcW/fVsUSHNIdpnEZHW6+WNnkoe/YItGOiIg5AJ:sxZnPcW/fVsUSHuwHbO/Sa
TLSH
T1E622C8516F38A97B4CC7E61ABA15BF53E7F5507251D11E48AAFC861C04EBACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9083eaaee5b4f3542047df2437545735c89d664aa2ed91e366e7e311448c2aa4
MD5 07371782684408e09750c411b84d9d9b
SHA1 a248f59ad18f3e4cfd548fc1eff7cea1eefa050b
SHA512 769fba06b70fa96d2dda6d784e53e8512b866120a945d5e8d2e602e80506ba21ee9c9a0a197ef3c53a14e806173518699b28083e362e3ad14d1154ef33b8709d
SSDEEP 192:sxZnRukcW/fVsUTHNIdpnEZHW6+WNGYIkCOiIg5qJ:sxZnPcW/fVsUTHuwHbGXA
TLSH
T10422C8126F38A57B4CC7E21ABA15BF43D7F95072A1D51E48AAFC861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ae5fd8cf9551fa0d80af124fef35efbacfe1a93be9ad3b5025d71c473602fad3
MD5 ded782fdf78c76b5623d975f828c5f97
SHA1 953d6d97f67b62105a6c6d68f0cfae261e467528
SHA512 83cec2ddee6a2c0623ba26b555441d25965f8142982fbe158a6d682fd5fda32a0c5968815d15dab7bfdd1803a14c0a55e7b0437e1196086254a8f60d6f6b84ad
SSDEEP 768:1MyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7+roIYMn:1MyqbblWvJDjTu1jah4LAs7VIY6
TLSH
T124C2F93B654CCB7E4FC00AADDD5A6FD73E9802C7A6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590100.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590100.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c6e58cbc65023c56617008626498a27baf907667760bb778919e4310569956af
MD5 799d10c8e2592aa34279413b028c3ffd
SHA1 8f3c28e71ee4691fa1cb0dc99251a8314114dcaf
SHA512 3836d18388cd7806d5ffa4b87aee4fd15a8b938dcd0e91a03228c35a93349498883dec76516ba214dfcb89d44006a44941de82ef8328a7cb7276b0dad0fb8048
SSDEEP 384:sZcIhsNOYqcbUPluVRN3OKZ9QvQOOPrXLpe8C/FB8:6hHbmH3Om9wQOi9PC8
TLSH
T102929E71A9385C676DF7F942F94726035FF8906BF6C52B8491DC9B0C02EAA99130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 865411122104a43eb9a38b963cb86edafaf9dd8b6c9092f31ae70f1e22172d5f
MD5 b384e44eb4a8366db5da2d3e5fc8ea7e
SHA1 5ae65f6be42f8da0d144a2c612131eca12187a8f
SHA512 b2339b83c4d9daf948743190116aaa84fd8ec9f4219270888bbd931e067a87bc337eaefd276dd71b5c208044c3892f749597bc76dbb56f4daa29ddaa1762613d
SSDEEP 384:3iFiZcIEsNe8TUNTUlIlZqcbU8luVRN3OKZ9QcQOOPrXLpe8C/FB8:yFQELwgGImH3Om9VQOi9PC8
TLSH
T131A28E7359649D7BADF7AE42FA4A32039FF44077D5C16A94E2CC9A0C01EB59C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 347b1c31e14be5f39c569ee060ad25e0d90ff1f601eafb2257724d462b5ae25c
MD5 c1e03f36ed23d4d7a01f0e669bbdbe38
SHA1 6881ecb29c5fb063b5966ee4dc850c5daa2c8235
SHA512 62dd82c2f8be0578d19fca67862d42373d28d8c753656122949574391d39c748bbd5f8dc711d7ecfab625f89507e7add28c7e81fff48c4eb49460c6a789da62e
SSDEEP 192:gON/6JkRBQmiUy+rQ+RN3OmNOmSC9QjMDVc/qGyU6:gON/6UftQ+RN3OKZ9QtQU6
TLSH
T14B12093179385C7B5EE2A845F58736135FF8512BEA8A6F80D5DC1F1C01DFA9C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c809bdd4971ed351aba9e75347e4e122b35641a413096ec82660223904eed0fd
MD5 9dd102c98c91f8a2a6dee4415882d842
SHA1 838cbac90bc977aefa792eb1dc4861473ede7672
SHA512 6f19eb5a31584275c97d350580250f37d24bbc9bb3077ee9e80c5f7c0ef95a2539e0a7a660ba74f903253dab1d5d111701bf8cf0120c84715551745d7ca9714d
SSDEEP 384:kZcIhsNOZqcbU8luVRN3OKZ9QvQOOPrXLpe8C/FB8:ChKImH3Om9wQOi9PC8
TLSH
T1B9929E71A9385C676DF7F942F94626035FF8907BF6C52F8491DC9B0C02EAA99130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7483921-4415-45c7-8afc-03729d9773f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7483921-4415-45c7-8afc-03729d9773f2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00ba9ddfe601d79e55a778b69c59121dd231ee62f4720e5c89b583964d79c832
MD5 c9b9046abe7592fa0b9e973e1050e45e
SHA1 9e0c410dda522f600460a058d3b518917e90e2b9
SHA512 92b385acfead57f4c684d636999426818f7fc263822156dc653b71d22bb71f7f94d6e1572d7be398b1f6224578e736eac07509c920d50d2bf56529c66a5a9828
TLSH
T11C41245DA6EA1148B3B76F5AABF6A86E487BBC772F0AD05D00110E4F4622B40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download