61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260930-ay2pfayscx
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_800588579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_169325682\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_169325682\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_1335724712\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_1335724712\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_1335724712\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_2059183757\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_2059183757\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2764_1335724712\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{B295140A-0067-427B-BFA0-920E54DECE85}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2764	4372	iexplore.exe	89
PID 2764 wrote to memory of 836	2764	msedge.exe	90
PID 2764 wrote to memory of 4480	2764	msedge.exe	91
PID 2764 wrote to memory of 5152	2764	msedge.exe	92
PID 2764 wrote to memory of 1712	2764	msedge.exe	93
PID 2764 wrote to memory of 5152	2764	msedge.exe	92
PID 2764 wrote to memory of 5152	2764	msedge.exe	92
PID 2764 wrote to memory of 1712	2764	msedge.exe	93
PID 2764 wrote to memory of 5640	2764	msedge.exe	96
PID 2764 wrote to memory of 1016	2764	msedge.exe	95
PID 2764 wrote to memory of 5640	2764	msedge.exe	96
PID 2764 wrote to memory of 5640	2764	msedge.exe	96
PID 2764 wrote to memory of 1016	2764	msedge.exe	95
PID 2764 wrote to memory of 1016	2764	msedge.exe	95
PID 2764 wrote to memory of 3900	2764	msedge.exe	97
PID 2764 wrote to memory of 1668	2764	msedge.exe	98
PID 2764 wrote to memory of 3900	2764	msedge.exe	97
PID 2764 wrote to memory of 3900	2764	msedge.exe	97
PID 2764 wrote to memory of 1668	2764	msedge.exe	98
PID 2764 wrote to memory of 1668	2764	msedge.exe	98
PID 2764 wrote to memory of 6052	2764	msedge.exe	99
PID 2764 wrote to memory of 6052	2764	msedge.exe	99
PID 2764 wrote to memory of 5548	2764	msedge.exe	101
PID 2764 wrote to memory of 2984	2764	msedge.exe	102
PID 2764 wrote to memory of 5548	2764	msedge.exe	101
PID 2764 wrote to memory of 2984	2764	msedge.exe	102
PID 2764 wrote to memory of 3336	2764	msedge.exe	104
PID 2764 wrote to memory of 4844	2764	msedge.exe	105
PID 2764 wrote to memory of 4844	2764	msedge.exe	105
PID 2764 wrote to memory of 2208	2764	msedge.exe	108
PID 2764 wrote to memory of 2208	2764	msedge.exe	108
PID 2764 wrote to memory of 2724	2764	msedge.exe	110
PID 2764 wrote to memory of 1884	2764	msedge.exe	111
PID 2764 wrote to memory of 4720	2764	msedge.exe	112
PID 2764 wrote to memory of 3128	2764	msedge.exe	113
PID 2764 wrote to memory of 3128	2764	msedge.exe	113
PID 2764 wrote to memory of 4464	2764	msedge.exe	117
PID 2764 wrote to memory of 4464	2764	msedge.exe	117
PID 2764 wrote to memory of 1824	2764	msedge.exe	118
PID 2764 wrote to memory of 1824	2764	msedge.exe	118
PID 2764 wrote to memory of 4088	2764	msedge.exe	119
PID 2764 wrote to memory of 4088	2764	msedge.exe	119
PID 2764 wrote to memory of 5712	2764	msedge.exe	120
PID 2764 wrote to memory of 4396	2764	msedge.exe	121
PID 2764 wrote to memory of 4396	2764	msedge.exe	121

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffe2b80c188,0x7ffe2b80c194,0x7ffe2b80c1a0
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1904,i,10977736532907200265,12528062761993377234,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,5603497667502195220,3910895212664040988,262144 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2320,i,10165314974826351963,9289806286142038776,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,6796338901999964995,4751189171305024690,2097152 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,16436040647222002170,9730071226095493277,2097152 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,12871302130566959087,5218779310496006240,2097152 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,10434178499327580561,14559766084635545461,2097152 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3656,i,581797745370570617,5155532014942492187,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5388,i,18282327671243901154,2518886727035659227,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5476,i,4584924535298274433,8307247382670118734,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5920,i,8197515710142176936,3480480939424338159,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5920,i,8197515710142176936,3480480939424338159,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6324,i,9898636658502425038,14003665902935743736,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6700,i,4507524627373757550,560465362666762772,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4860,i,15057705399957790546,11452164160110557510,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5360,i,13585127388131329316,8139028599735814498,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3728,i,2265467345490281134,18436031761260516371,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5032,i,9563751733657404012,16500445526493769766,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6764,i,12280219058795231369,14568321214480058146,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6304,i,13707349493913668983,7631722507021512280,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6432,i,8684541580050529080,8937112352657905737,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,18086265523942830719,16752807705918291748,262144 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5756,i,1987680559958280318,3796499417411180851,524288 --field-trial-handle=2600,i,16922345474657632886,11919767637855480890,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:14
    3⤵
    PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e7ff1e2d312fe176f6e0ffec5be77bf1cd63df14c634ec4bef7bf6d2fb1a4f21
MD5 13afe898402c47bf30ef2de5a6096122
SHA1 3b9c5ed10ffc50e498bdf1a9ee3790bb19a23bf8
SHA512 229c344b6c17e05a865c5907d21e086abc0648377aceb834b10714dea96be8e585061b44166cce7e6433234316201c59bebb4946b01d6e60313c3ff794d46049
TLSH
T19B513D881A634E8AE7BCBF33CEF1228B3B30A6B965C35E492074C4BC6BD275510D4345
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b87203b611af7652076c657b4a518b684ec7ff619ff715652407d706790a6fd9
MD5 e265b4c03be7d7331e1996723780e5de
SHA1 bde4014826739f88093d0c9b6640e1443514697b
SHA512 f1a7ee9c5c3b27cb8695d8cb2adf88a910b033abaf53f6590d907afc5cc17b5aa22a75b40d61e41353af17c04dedf849e16097ef9a8c34501dc588163a8368a5
TLSH
T1E9518EF3C3E8866DCD0196F0AA186E2BCE1D0915532C3D5AC9E4DF5B93E2471E28195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f0f6620f8a2f2a599e8abb852b9d641e92974acb5afff88a4b66672d4607cdbc
MD5 8becde7ca7ecb6cf111d899c428d2866
SHA1 24ff406d364656fc9cfa2b9c3364f15da9273c35
SHA512 60e2443b21969e80ffbf752b73fce70d87a9121755ba686eb2da178ad24499abe3f9b39177b4c0ca4fc62ddff2966e6c0e3ec1598a9a740e7ceeef60f77ad5ac
SSDEEP 192:sxRMRxCM/fHs6MZd52PzoA8p49/g6+WNIYlac+m+GZIgDp+J:sxRM2M/fHs6ydcmc/5IIPM
TLSH
T14732A615AE68A97B4CCBD21DFB557F53E6F91032A0941E48B6FC8A2C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63fda77faf58fa75c3fcd5106f6840cce857eba31d79a9fd8287c83571226581
MD5 a640b78cb3bdd86be5ef9d5b0ee85fed
SHA1 6c478493d2463534b4e2cb7512542e3313ab5d64
SHA512 f7471b5172cd7f1a75a1b066bb122b31d7dd2840f28b00f1e2c52a11ed7b42acc3672d9d85f89977bdd3acdb709c67493b8630746970cc3472c6f7ffb49e69e2
SSDEEP 192:sxRMRxCM/fHsjMZd52PzoA8p49/g6+WNIYlacsm+GZIgDD+J:sxRM2M/fHsjydcmc/5IgPq
TLSH
T1C842B615AD68A97B4CCBE21DBB557F53E6F91032A0951E48B6FC8A2C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4bab20489dc62716e2f2c1dfb958ff9fea06681cd2802b0e83002ca467f797ca
MD5 b8af71d4cee6636bea128e46da2b4235
SHA1 7b4c5447b411922749236a171e15c2df0c09affb
SHA512 e460b49f28ebef6fce0151d2b427110bee50e37799e903db71156c202f807965af27613432da51f29d02ec2eba6caa9b1ae90540d6198c222dd8c1136832d634
SSDEEP 192:sxRnRxCM/fHsTMZd52PzoA8p49/g6+WNIYlac+m+GZIgV+J:sxRn2M/fHsTydcmc/5IIPE
TLSH
T1FA32A615AD68A97B4CCBE21DBB557F53E6F91032A0941E48F6FC8A2C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5516ee63b0827258ea91c353e59d99ba2a7438597de0612efc6de67d21dca111
MD5 b025a659a3b9a00d85f76caaa4552df1
SHA1 4baad900aa5b11a1e31f13b123efd85a9f1f3dd5
SHA512 7a63562bc613c7752457d7e9d1bfcf8229ac980de5237891762466411bef305d313f6f9dbe4d138fef9cd655640437c82a8b135b9f5b66e33192762d931af4d7
SSDEEP 768:ksRdFG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVG++2+gwroe2dcR:ksRdFmEb0JWgSwffTu1ja1++rgbe21Ho
TLSH
T101D2D87B640CCB7F4F804ADDEC197A9F6DA802CB9698CD8047FE841D02D6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7500d73d10e2f71c0110509f24d2cac242ecc4730232631a8d5e589c4837272e
MD5 c147aff358a3b5f7cf3338a9da0076f2
SHA1 6b215b72196ca3758cf19fb2c0549a3af6099061
SHA512 98921b6d46b9e1ca65333a1997da05bfeaad37fd0676d48895be995ccbf5a02403ec72cb463736e163a306c5468550cd108b2602234230e49051f2067ed35ef0
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyLfir/BhBab5UpISPaK9v1lax/KYstuJ:K8qEKLqKCIgKpeuDmKIsaX
TLSH
T1BF91BD10317B0650397D295C85B48B2E125232A33159FA6FBFBC54A64A6FE188DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e1eba780a1da7e7c56f32fa5654b9971f2bc86c8cb2a92589c360c3c53980c4f
MD5 dac2a506777a9f10869404efb72ec28f
SHA1 86026b5955d7b25abba3f5ba2ccb801d83f09157
SHA512 736361aa409d5c14d5777530f7bf2e936d2d964acf79ef5b8123325855098916f37560b70459a9aa4f20768601616da521f86c11c993d2d75b329feb5178121e
SSDEEP 768:O/UxvxjgC+Ft3zXDSFajtUnqMwQi5BgK5/CwYclsA8Dea:DZj3+Ft3zhGVmBg8/dKA8Sa
TLSH
T18403C036ECB49EB78CFA9644764A638BEFF45153C484089889ED2E0E06D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fafe60e6436b49164037473e1e15e1cb815e7aee8badc8469d468cf737bf6f17
MD5 f12c3ebb3a7864dd3a7744088de62615
SHA1 4e3b939f2ea350e0fd98e057b760d36242d3b161
SHA512 2783470d1d6fed67f60d3c0c18360949e16e53b5d86936a6d20b5bad30df763737f046f214392eb0937130d39d724577bb076cfa141430e5aec2db1683c5471a
SSDEEP 768:MFQMC3twgiZRW8AlajtbQ4nqMwQi5BgK5/CwYcZM2s4B:/N30LO4VmBg8/di2s4B
TLSH
T1CF037C36D8B4CEBBACFA9785F7467786AEF411A3C89888D8D5D95D0D00934EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5206d840e851d15b3c61054383c0601e732139738169a75c03c9ce56ecb656ba
MD5 156204476d970c335aa69e3b9d76cfd4
SHA1 fc67dcdef3c52c7113bc9fe00926349b899b35a5
SHA512 1857a1be237547d42e404d4af8a5b94bd4952bd46e1c6c2b1f2499acbcd1ba08e120e1f14a47d6e86d81036663da4d8255333bbfacbce928d6b7366e316d0641
SSDEEP 768:m535ZRx8SFajtb3nqMwQi5BgK5/CwYcZM2s4B:m531ytVmBg8/di2s4B
TLSH
T178F2AE31ECB48EB75CFE9244F2867786AFF42157D8940988C4E95E0E41939EE274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c320ce810a9f1af29f31855635f2b3de83272cbe1ccc1588be704ca7953bd728
MD5 a5362fa69938bda247cccc5a35874dc1
SHA1 861845fdb4e5173578cfccbc01336f2ef7af0ee9
SHA512 48e60266d9e18b4f860a24c2c3dc4577f64c433cb581f76cae5e5bad71177c48118b8baf6a6e5bfe6cbc905c7cf4a386d9c57439e6940095a61cc1161c32c57f
SSDEEP 768:T53MZRW8SFajtb3nqMwQi5BgK5/CwYcZM2s4B:T53WbtVmBg8/di2s4B
TLSH
T182F2AE31ECB48EB75CFE9244F2867782AFF46157D8940988C4E95E0E41939EE274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

fe472657-5161-43a8-b305-fecdcd5fd93b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe472657-5161-43a8-b305-fecdcd5fd93b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2764_698904239\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download