hxxp://www[.]lasermechanicalandelectrical[.]com/

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.lasermechanicalandelectrical.com/
Sample260825-rwtpgstdkg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321419921740719"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{8E26579B-FB0C-4A93-ADC1-568479F050C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4440	2564	msedge.exe	88
PID 2564 wrote to memory of 4520	2564	msedge.exe	89
PID 2564 wrote to memory of 2524	2564	msedge.exe	90
PID 2564 wrote to memory of 2524	2564	msedge.exe	90
PID 2564 wrote to memory of 2800	2564	msedge.exe	91
PID 2564 wrote to memory of 2800	2564	msedge.exe	91
PID 2564 wrote to memory of 2800	2564	msedge.exe	91
PID 2564 wrote to memory of 1532	2564	msedge.exe	93
PID 2564 wrote to memory of 1784	2564	msedge.exe	94
PID 2564 wrote to memory of 1532	2564	msedge.exe	93
PID 2564 wrote to memory of 1532	2564	msedge.exe	93
PID 2564 wrote to memory of 1784	2564	msedge.exe	94
PID 2564 wrote to memory of 1784	2564	msedge.exe	94
PID 2564 wrote to memory of 2024	2564	msedge.exe	95
PID 2564 wrote to memory of 2024	2564	msedge.exe	95
PID 2564 wrote to memory of 2024	2564	msedge.exe	95
PID 2564 wrote to memory of 864	2564	msedge.exe	96
PID 2564 wrote to memory of 864	2564	msedge.exe	96
PID 2564 wrote to memory of 864	2564	msedge.exe	96
PID 2564 wrote to memory of 3604	2564	msedge.exe	100
PID 2564 wrote to memory of 804	2564	msedge.exe	101
PID 2564 wrote to memory of 3604	2564	msedge.exe	100
PID 2564 wrote to memory of 804	2564	msedge.exe	101
PID 2564 wrote to memory of 3480	2564	msedge.exe	103
PID 2564 wrote to memory of 552	2564	msedge.exe	107
PID 2564 wrote to memory of 552	2564	msedge.exe	107
PID 2564 wrote to memory of 552	2564	msedge.exe	107
PID 2564 wrote to memory of 5064	2564	msedge.exe	108
PID 2564 wrote to memory of 5064	2564	msedge.exe	108
PID 2564 wrote to memory of 5064	2564	msedge.exe	108
PID 2564 wrote to memory of 4084	2564	msedge.exe	113
PID 2564 wrote to memory of 4084	2564	msedge.exe	113
PID 2564 wrote to memory of 4084	2564	msedge.exe	113
PID 2564 wrote to memory of 2244	2564	msedge.exe	118
PID 2564 wrote to memory of 2064	2564	msedge.exe	119
PID 2564 wrote to memory of 4884	2564	msedge.exe	120
PID 2564 wrote to memory of 2028	2564	msedge.exe	121
PID 2564 wrote to memory of 2028	2564	msedge.exe	121
PID 2564 wrote to memory of 2028	2564	msedge.exe	121
PID 2564 wrote to memory of 736	2564	msedge.exe	124
PID 2564 wrote to memory of 736	2564	msedge.exe	124
PID 2564 wrote to memory of 736	2564	msedge.exe	124
PID 2564 wrote to memory of 4888	2564	msedge.exe	125
PID 2564 wrote to memory of 4888	2564	msedge.exe	125
PID 2564 wrote to memory of 4888	2564	msedge.exe	125
PID 2564 wrote to memory of 4720	2564	msedge.exe	126
PID 2564 wrote to memory of 4720	2564	msedge.exe	126
PID 2564 wrote to memory of 1620	2564	msedge.exe	129
PID 2564 wrote to memory of 1620	2564	msedge.exe	129
PID 2564 wrote to memory of 1620	2564	msedge.exe	129
PID 2564 wrote to memory of 1684	2564	msedge.exe	130
PID 2564 wrote to memory of 1684	2564	msedge.exe	130
PID 2564 wrote to memory of 2432	2564	msedge.exe	132
PID 2564 wrote to memory of 1976	2564	msedge.exe	133
PID 2564 wrote to memory of 1976	2564	msedge.exe	133
PID 2564 wrote to memory of 1976	2564	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.lasermechanicalandelectrical.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbf556c188,0x7ffbf556c194,0x7ffbf556c1a0
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12932295460287328160,8071666282639008369,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,2805747657181937161,8395711697700552135,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,18098155461627832836,10296413115365846997,262144 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14023381075869707779,17500799823959660491,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,555222727446472674,12855822872533923239,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4783545261855154025,8142707353627388627,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,13284506508186843454,17121478973312496948,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,3477057916079932771,17945769693626686613,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,7883911784687956169,11653605577606747480,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,1463315525388035877,8492277480323934866,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,1463315525388035877,8492277480323934866,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,1716944102538831263,13674604341851076303,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6484,i,8261356194775553674,14030910319191112797,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6348,i,3805224430685979470,18401212082052247244,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,2962432977433010318,10479627847445047730,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8599797958711340222,12659028875168496179,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,3461286872589623345,14008058535774607545,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6300,i,15675627078870949545,14204178940429574087,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6672,i,3716473742625731855,9399150112978652667,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6492,i,1675433898595145359,16720734253725765026,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,9606377960367539748,9992068246345890329,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5804,i,4298189505297112221,10975018626620255072,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,17602366906054113179,6704376604572198616,524288 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,4031315330771523219,1107667524029780823,262144 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5976,i,14277613848677339071,4544262729731687902,2097152 --field-trial-handle=2244,i,8657852686024852606,13178148786539827812,262144 --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

7d258d58-80e2-466f-9092-2bd0df1a574f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d258d58-80e2-466f-9092-2bd0df1a574f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01379d487ec4549aec0c69013496c665411fa8d18d2b501c803d5e8738b3fcc7
MD5 92707607ffab023ea9efbb1887148f1c
SHA1 4832182a407fdeff8ff8ba96e67993760b8d54b9
SHA512 efab35a19528a848d66f4ac0ba6adccc29512a71a13d34d991945530074578d06433c1e431cb1ed69ebfd36c5857a83efffd7ea976e9f1aaaedf5b69e22dfa7d
TLSH
T16161F7008E4A4501FF211237D4D21314F87042B93A975EEA426E8BBF440EB62FD3FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f30a77a0c5f50aec628682af6440c91a79a8b1ade75b27984f44368cd14181cb
MD5 436f2c885b60e5e10c532229199982fa
SHA1 1be489597d75464248bf4b73568435d1ae4b99de
SHA512 9435d14328951363cc56ceb14d83cf95f24a08eae413bc594ee605eed0ae8766bcf88afae8cf125c2d0d376a46bd49219f8bdf901de25ff72b018535b47cbbad
TLSH
T176117DF7C3D5966E890157F09A24AE2BCE1D0506422C7C19C5D4FF2BD3E3075E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a0272cc6e42cf1618cde4f49f2c3420202fc103c090211ecc45038dba14d91af
MD5 db09fc43780b74a9c8ca0780024b4f8e
SHA1 3f0a2d045035f5b25b96a0a812b8cb47ad8d6e83
SHA512 a1a8441608e95e11c2e09ef5bacd2a18d34446753a263cc45e18db7eae4cf3c4c4c319ba801de6095a63d8db390b6800e819d4b4795f009b820501a6491ebbd1
SSDEEP 192:sxZ0RrkQ/fTsnWpIdpKmHrm6+WNGYL2U9wIg59J:sxZ0SQ/fTsnWi5HHGZl
TLSH
T1BA32D6526E2869778CC7D60DFB15BB43E6F9103291911E48EAFCC61C04E7ACE220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7a032dde0836426d7d55ac13ca8eb8f8e627d624a7155f292c7a6a2b9a29cd66
MD5 457458781246aed617ad26ff5d82eac7
SHA1 e37affad03480da796de0907d416e76eea3cd6c3
SHA512 048c9a9264302ac8d05e275ca0060d482e696b46e38283c4adc95700146d8ad9df36daa8d146a71f97a7af0c86c92c7dbe0a7fa5133dc11232b3d6407c1617fe
SSDEEP 192:sxZ0RrkQ/fTsvcpIdpKmHrS6+WNGYLzs9wIgrJ:sxZ0SQ/fTsvci5HzGU9
TLSH
T1F022C7516E3865778CC7D61EFB25BB53E6F91032A1951E48EAFCC51C04E6ACD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 626deda7587fbe5ef9b86ee001f57abe86deb1543bab40255a01b5e33129a11b
MD5 560745d3f5d7ce250048dcec263e1740
SHA1 7095a2de508f7c444c33835ea95fd936625869e6
SHA512 495becdc6105ba3b4ee28972346382e396fdbc3272f1f48e83ed0a51b95ad3a393c56b823df8cb0ff19d1bfb89d4f33e7c6ec2ec07cc5a5c56a2841f0b883469
SSDEEP 192:sxZ0RrkQ/fTsncpIdpKmHr66+WNGYLzs9wIg5fJ:sxZ0SQ/fTsnci5HLGUz
TLSH
T18B22D8516E3869778CC7D61EFB15BB53D6F91032A1951E48EAFC951C04E6BCD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6a2bedb2064b47fd33d4869559c9707906bad5342b2e01c76429eb1100a40f85
MD5 00586b111ee07d7b6be4fe3182686467
SHA1 634f71182872663cc85461b48c238450d7767a88
SHA512 19671dac9f032827e891debc3fa2a7697dd0c6a90474583aaeac75e6b71adfe3ecca88a79585a61cc4ec7a2ee3c4d52f3df6444e7764492f3d0d3c4ef9684500
SSDEEP 768:ITO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvvrojC:ITO6fP1Wvxz3ju1jaZILIsv8jC
TLSH
T196C2D83B240DCB7E4F801A9DEC5A6F973E9802C7AB58898447FE954C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 cd959592350ee855bc593ec41fc3e5b3bc7bf3e2a584d0bf372e20341e85d30b
MD5 9e96014787f4c09df7f7f17482be3c29
SHA1 f07c15b6c76697acbd8ca05287ec25166c59c249
SHA512 102206881be04562f8be99746a1689169aa8ba4f454052c805a643fb67106ee6c42e069402cec08e161aaa0fc709579cbf1e85c75865585627f2b8273fdd7e4d
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyZSI/KL6AXypGIPKTy0PyBsIXKZ28i:KUAAKtePKSsKL6C6GQKTyWSs4KZ2x
TLSH
T1C7C1251336B603026C7E2908969597279E467963302DA42B7FEE00725EA7E204EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5908e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5908e0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9d3067704aa77319f372151bbd3bcee29cd80378ecd331acb209176784decbd5
MD5 77a75d1b6a16b31c8ec74678679b6806
SHA1 0dd12f0d8bae52352dd7b52ed4bd4e8b30a76f2b
SHA512 3cfcae7cf43da19b560ba4f4340905f70bf80f1272b74815c7d75bb58d106c0868ae4f0e1c19a225cd62a2df631b3651be6cfee713c5e9706acba7a545d06b79
SSDEEP 384:piFiZcIfsNs8TUNTUlIl4+FeoM0Ja95O0MWv/sLivR3do4:AFQfZwgVt8/OOv/sLiJNX
TLSH
T19BA26C325C68DC7B1DF6DA45FA4626179FB54067C9CAAA90E6CC9F2C00EB59C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31881c997ed082b072116829da918d849cdbfcc6c34c79380d37a102723dd448
MD5 9eb333e280451dd579e840bfd547bd81
SHA1 3d41891988b123bd9d957e6a52cf09de36fd7d34
SHA512 f892bafea90f3e3d71112232dfaaf46f092adc9ec673bd1b54baa95b5f93d976f65481470f0243ae69483359dd16a244653fea57d50cc9e3961325635b2b7335
SSDEEP 192:qONY6O7+3hQmiUySOaGttb0UO2rh26gGhuSU6:qONY61l7Gt95O0M8dU6
TLSH
T19102D7346D386CB75EF3AE46FA8727235FA5112BA9951F40D6E81E0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba9c283d07b695ca6d8ed922154233f0fdd6b80ee65518a80198fb65f7ffa91b
MD5 068da54d6b1876482cb47d06a0432e14
SHA1 07cc9b98931f9ac8aca4bc205b378b43d019475e
SHA512 26adca3eac55f88ec45aa0384e61f1c87d92f430c057856f481d77bcc36f2dcbc53aa199a133061663d36aa46d183cf2ef3717cbcf9618478a1fd26869ba3eda
SSDEEP 192:CJON96O7+30QmiUySOarttb0UO2rh2Wv8EsdcNcqG+U6:AON962l7rt95O0MWv/fLU6
TLSH
T1B012FA316978AC771DE3A945F9C736135FA5412BDA8A2F80D5DC2E1C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ca94640d282587115eaec3334297ba0d5651ccbe7589b3eb5e55a278be5c4aa7
MD5 cb59deaa197d03d17808b8370386693e
SHA1 e85accf774a62d21da9bb63058f76427a9288b93
SHA512 e5a0b3f434e2de023ccde98630bae4459469e2c7a23a552fdfa69e390e5cd68955f5de30310afc86ac7402c64aa14384c34ba5dca32715518260759c01ca38f6
SSDEEP 384:OZcIhsNkt+FeoM0Ja95O0MWv/zLivR3do4:shQt8/OOv/zLiJNX
TLSH
T121828D316D789CB61CF6D545FA8626175FB9402B9ACE2E80D4DC9F2D01EA6AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 92b137e7fc89dd3459b8b96b265616a8ff96e2614f8b026ddfcbfb8ee9b29a9a
MD5 9f0cacf56de435b3f74b6bea9133fd3f
SHA1 fe5a3b22d9ad0656be6127c2ef527449ed1c8d59
SHA512 8fc46736f597651bef7dc0ac797265dcf3f0e24f4c78824f16afe4a1b9a13f62857c72ecd766ae65caa88b5d060b9a99dba591267e36a8374d239d00dcd5b92c
SSDEEP 384:yZcIhsNk4+FeoM0Ja95O0MWv/zLivR3do4:AhTt8/OOv/zLiJNX
TLSH
T181827D716C789CB61CE6D545F68626175FB8802B9ACE2E80D4DCDF2D01EE6AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7609692bbb98efd82966286a368cc5c197ea68fb2be6e5ad93a26e7ed3b16a1c
MD5 82dcb6d8b5876953cd445fbde34d1b91
SHA1 8b64ce6577dab41058f7b6005acdb395dee496e4
SHA512 e2108129ad86f25cb621b7af2359c2ff265c2963c85683568ed978d996309bd758ff5567034b66d26c0a671e161296cc711a6a702223c4f50861a9fa186a94e7
TLSH
T12C41E758B6E91148B3B7BE5A9BF6A86D487FBD332F07D49E00010D4F4662B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download