hxxps://u117190596[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]FbMAJF-2Fx2PboOi-2F4Imo6YcGTvGAdYDw8KSRIR7xAT9uMIK-2BF7NQs646d8nS6neh9zTI0hTylHnSWI5AUJfJkqw-3D-3DKp0K_IsYeSBG-2BZ-2BTZ5It1-2BmoDst3Md-2BRxCmpAshIcr1kYIn2ilKz-2B8WLn2kQMm2WLiVSOiubhWhhvgJWi6F8ZbnL1kXJNa9vnppHF76qE04xLv-2BT5wHnHp4-2FZ8EH-2FFbZvID32INb9-2BEUt4zLtoZVVK5eGb6okNZ1jXJUkfKo-2FWjB60-2B9B34AoNGzCo9tnfvSEU2uUNf3yKfFUdek-2FzYXlMENzFg-3D-3D

Analysis

user interaction
yes
max time kernel
137s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u117190596.ct.sendgrid.net/ls/click?upn=u001.FbMAJF-2Fx2PboOi-2F4Imo6YcGTvGAdYDw8KSRIR7xAT9uMIK-2BF7NQs646d8nS6neh9zTI0hTylHnSWI5AUJfJkqw-3D-3DKp0K_IsYeSBG-2BZ-2BTZ5It1-2BmoDst3Md-2BRxCmpAshIcr1kYIn2ilKz-2B8WLn2kQMm2WLiVSOiubhWhhvgJWi6F8ZbnL1kXJNa9vnppHF76qE04xLv-2BT5wHnHp4-2FZ8EH-2FFbZvID32INb9-2BEUt4zLtoZVVK5eGb6okNZ1jXJUkfKo-2FWjB60-2B9B34AoNGzCo9tnfvSEU2uUNf3yKfFUdek-2FzYXlMENzFg-3D-3D
Sample261027-msjynatsfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4272	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{AD55C7D7-95A5-4990-8D46-A5F609DD0253}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2280	3792	msedge.exe	85
PID 3792 wrote to memory of 1584	3792	msedge.exe	87
PID 3792 wrote to memory of 4272	3792	msedge.exe	88
PID 3792 wrote to memory of 1584	3792	msedge.exe	87
PID 3792 wrote to memory of 1584	3792	msedge.exe	87
PID 3792 wrote to memory of 2756	3792	msedge.exe	89
PID 3792 wrote to memory of 2756	3792	msedge.exe	89
PID 3792 wrote to memory of 4836	3792	msedge.exe	90
PID 3792 wrote to memory of 4836	3792	msedge.exe	90
PID 3792 wrote to memory of 4836	3792	msedge.exe	90
PID 3792 wrote to memory of 1300	3792	msedge.exe	91
PID 3792 wrote to memory of 1300	3792	msedge.exe	91
PID 3792 wrote to memory of 1300	3792	msedge.exe	91
PID 3792 wrote to memory of 3036	3792	msedge.exe	92
PID 3792 wrote to memory of 3036	3792	msedge.exe	92
PID 3792 wrote to memory of 3036	3792	msedge.exe	92
PID 3792 wrote to memory of 1312	3792	msedge.exe	93
PID 3792 wrote to memory of 1312	3792	msedge.exe	93
PID 3792 wrote to memory of 1312	3792	msedge.exe	93
PID 3792 wrote to memory of 1904	3792	msedge.exe	97
PID 3792 wrote to memory of 1904	3792	msedge.exe	97
PID 3792 wrote to memory of 1904	3792	msedge.exe	97
PID 3792 wrote to memory of 4300	3792	msedge.exe	99
PID 3792 wrote to memory of 4300	3792	msedge.exe	99
PID 3792 wrote to memory of 2940	3792	msedge.exe	98
PID 3792 wrote to memory of 2940	3792	msedge.exe	98
PID 3792 wrote to memory of 4384	3792	msedge.exe	101
PID 3792 wrote to memory of 3480	3792	msedge.exe	104
PID 3792 wrote to memory of 3480	3792	msedge.exe	104
PID 3792 wrote to memory of 3480	3792	msedge.exe	104
PID 3792 wrote to memory of 4152	3792	msedge.exe	111
PID 3792 wrote to memory of 4184	3792	msedge.exe	112
PID 3792 wrote to memory of 4788	3792	msedge.exe	113
PID 3792 wrote to memory of 1912	3792	msedge.exe	115
PID 3792 wrote to memory of 1912	3792	msedge.exe	115
PID 3792 wrote to memory of 1544	3792	msedge.exe	116
PID 3792 wrote to memory of 1544	3792	msedge.exe	116
PID 3792 wrote to memory of 1400	3792	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u117190596.ct.sendgrid.net/ls/click?upn=u001.FbMAJF-2Fx2PboOi-2F4Imo6YcGTvGAdYDw8KSRIR7xAT9uMIK-2BF7NQs646d8nS6neh9zTI0hTylHnSWI5AUJfJkqw-3D-3DKp0K_IsYeSBG-2BZ-2BTZ5It1-2BmoDst3Md-2BRxCmpAshIcr1kYIn2ilKz-2B8WLn2kQMm2WLiVSOiubhWhhvgJWi6F8ZbnL1kXJNa9vnppHF76qE04xLv-2BT5wHnHp4-2FZ8EH-2FFbZvID32INb9-2BEUt4zLtoZVVK5eGb6okNZ1jXJUkfKo-2FWjB60-2B9B34AoNGzCo9tnfvSEU2uUNf3yKfFUdek-2FzYXlMENzFg-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8b66fc188,0x7ff8b66fc194,0x7ff8b66fc1a0
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,3397955574069287600,11761688561667603514,262144 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3195388584191675574,8406044231318004215,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,2829437989861929934,4287021086302893855,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16368766069344829529,14600068796321288093,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,8080363187841054521,18103753477960127066,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,9360359227537177784,7382306227091504022,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,15372421343135935371,17286102382793349910,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,7563013598033845379,18229983122584011523,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,8807529745878738477,8063474549069899199,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,13209779550469741093,2486111177289278596,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8290568889494414313,18401062819710984355,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8290568889494414313,18401062819710984355,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,1000777169647960492,10403911847356811058,2097152 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,14184435935040036040,12217559449027511610,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,14218744424788072338,6057405402553688963,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,7223496734442678948,8892717318150528937,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9084690971141668625,15315442929635351665,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9591882824673765816,5589605408443540701,524288 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,5479157193774127725,5107652670241284528,262144 --field-trial-handle=2992,i,13565879538908234743,9668805459694593873,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03ca8880-ec8c-413a-8e00-26a695a3b2e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03ca8880-ec8c-413a-8e00-26a695a3b2e6.tmp
Size 18KB
SHA256 2957da924c253d2a367ebba1ca824f7b587461ce62cce3af6a48aebc3f3fd74a
MD5 8123b88fdee03afb61213680e44c8a64
SHA1 334db7f974f15863e08c4a0f3e17bff8cd658bf3
SHA512 2ef9b4d3eee35a17fd421d0c510b406459e42f2f718b0305fb06cf5ee9500fecaaceb71db3c5a9a33cfe29199984b4ef4bf3b37cb159cc0dbd2f0e86abb4cdb0
SSDEEP 384:tQkUSv8sNdprzZd4nHX58EvOeJB3JrgSEvaTZc3u+SIIlC:X8Cz43a8OY3hgNvaTZc3qLc
TLSH
T1DC827C32E968AD3749E6D604F14B3603DFB0D16BD6C82F94D6ED6F2C01DA29C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12e25185-087b-4089-bec7-00d08719f3bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12e25185-087b-4089-bec7-00d08719f3bf.tmp
Size 8KB
SHA256 a083e59f33d187564b5c04b15e18249ba7d1a5913b588f0ff78fb60394316498
MD5 6c4baf90d89bf917a1f61008bf1ebb7f
SHA1 18d3768d154145544ec5b66cc42a1911dea06bfc
SHA512 1e500a5ddd25b663574037b2aae0ef94de9da95eaecc85b2f947d1849e32cb92364f191b2d574fdb1ca325cbdd7406929115bd6421eea3f095d8dbc9b8662ebf
SSDEEP 192:qONY6wlDsQmiUypvV4X58gZvOKNJyqwSJrRveyqixiU6:qONY6k8qV4X58EvOeJB3JrgSEU6
TLSH
T153121936F568AC375DE2A544F48736139FB54167EA896F90C2EC2E1C01EF2AC230AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

158c0889-3afe-4ba7-b374-334d70f983dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\158c0889-3afe-4ba7-b374-334d70f983dd.tmp
Size 8KB
SHA256 8ae1d4675072b764008fcc1da82438b274c7a50b12b4a0ed3428210d4a2d98fc
MD5 09d2929aea86dcba8b4c1dc6a7ff3f85
SHA1 fbba610c443894d74202ba68b516af7afa6e35b4
SHA512 f28cd23f33db4aa0d0f84998aa46c302b4563436389a22dc5eee8737576fdc83191a47dbd25a914a02752c2e057e9cc561613028be57ff12457cf18aaa3dfd8a
SSDEEP 192:1ONgV6wlDgQmiUyFvW4X58gZvOKNJ7DlQ9U6:1ONu6kgqW4X58EvOeJd0U6
TLSH
T1BF02F938F9687C7B8EF2AE09F58737139FE5106BE5552F84DAE81A1C00D729C130A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dcfb2e6-035c-4a21-af9d-a725be4f769d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1dcfb2e6-035c-4a21-af9d-a725be4f769d.tmp
Size 26KB
SHA256 3dff82668f3c944bcdf5cf7ee12bc604e714802a0567f6aa02fcf14e4eaf23a4
MD5 377b0e414ea52f8367a17710ad826dd3
SHA1 f5bf8b924f87fdfb840456e98bf41fcd63b5fa8b
SHA512 877e5698adbbc1e02d9580218d806c4090ab7bfd432c26441f61e10e0d9a57325ed24536532703ebfcf09c14b51dfb5a20b509330d2b755c77f5aa692935d590
SSDEEP 384:NriFzQkUSvFDsNn8TUNTUlIlprzZdinHX58EvOeJB3Jr7SEvaTZc3u+SIIlC:NGFd9iwgjzi3a8OY3h7NvaTZc3qLc
TLSH
T142C218F294D7993BD9AE8707A77E2D038EBCC067F5845A90B388591CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fe46e56-5a65-45f0-9f79-c7a904646c34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fe46e56-5a65-45f0-9f79-c7a904646c34.tmp
Size 18KB
SHA256 94dc944569535ec983d6c727fd45bea4550f6f97d0d4bda5726558d3d7e5e4ec
MD5 c321a31165edb89734722abb963b3131
SHA1 64b5404835c512663c660ed8e3a4ee162beec6de
SHA512 de344fa39db839c7149aa1744916d5c78d0b194bca3299ef1c8b3d8b365d6bb57f5bb31687ff3d949801f8250a265da027f9e751f6ea2516f436a0205b8f4245
SSDEEP 384:rQkUSv8sNdArzZd4nHX58EvOeJB3JrgSEvaTZc3u+SIIlC:l8Nz43a8OY3hgNvaTZc3qLc
TLSH
T12C827C36E9A8AD3749E69604F14B3603DFB0D167D6C82F94D6ED6B2C01DA29C230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e408335-d2b3-4e4f-aee9-7de28810bb46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e408335-d2b3-4e4f-aee9-7de28810bb46.tmp
Size 18KB
SHA256 09967f508cb31540d0b76a1ec1a1d24fcee34ef448e44c3616367579d80f7a4d
MD5 d946083abc20f3db8f11b2615cb404ba
SHA1 c6816a5c6bae9ef4b568c17e7d8821409a1307ba
SHA512 675f181904a5d66adbf1dee85ef28a6125ba5a1c33aa07651d85d883603658b71faeb2d96873014b76bff5f434ef299c68d90324d76f8a624f21676dba18c220
SSDEEP 384:rQkUSv0sNdArzZ+4nHX58EvOeJB3JrgSEvaTZc3u+SIIlC:l0Nzv3a8OY3hgNvaTZc3qLc
TLSH
T1C5827C36E9A8AD374DE69604F14B3603DFB0D167D6C82F94D6DD6B2C01DA29C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

1e7b775a-31a1-418f-8201-fd48489c9810.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e7b775a-31a1-418f-8201-fd48489c9810.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2bec2cd2-83de-4c1b-b521-ce95d8b0b784.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bec2cd2-83de-4c1b-b521-ce95d8b0b784.tmp
Size 11KB
SHA256 967b656903942019036461fe290aa18da78237597d67a5efc7fac2390bacd261
MD5 29d669e7b20ffb488e3f6bb55c1d46b2
SHA1 12bd4cbeaa6ace71219907760760e2d23362a087
SHA512 771b0b872e33738105758d4911fb7a61d50b1cc47c66218656c48228e1ed85ca7404d2e4406fe7281b37009b9c3927b1087f1ff4289ccf7c65018518c351d89f
SSDEEP 192:sxZbRBWF/fSYs2KIdpbSBHW6+WNc4qK/YrGVTTIg5ytJ:sxZbyF/fDs2DmHbz/5+
TLSH
T17532B856AE34A97B8CCBD31DBA16BF53E6F9543295901E44AAFC861C04E7BCD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86edc06d-74f1-408a-a926-f3629a195fb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86edc06d-74f1-408a-a926-f3629a195fb7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 18182b54347ae2942134c45e2963d2f37e923b37b33a94fbe21dda983a6d78f6
MD5 01730c8d4c501b736322043ee0db9dde
SHA1 d82f13a68e631d79a7d7b85b2c147b4571437378
SHA512 36b26ee4cd190b797b2bb4886f171180c737eee0333e5b84cc677c56f25bbd31820e30654826e62ef9a083ac4af2428cb373cc9412ee340ad65fa313ab586f72
TLSH
T1D8E0268508CCD22FA308648702ECB39C8F82275B96C06E8E2700CE88F647048B3AA690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 7266cbb4de18f5483129374cf68b34e1c78c138e40f4eedc8717522dd93d88ac
MD5 9d6432966b6cb5ef5e451debfcf27035
SHA1 3b1de53c6e6e8ac356c53373d68c400bc64bc082
SHA512 ea85af5dbcd3f493e33db2fa07daa64417c9c4df4504426d3bcbb178d3ce7c5b926a369950bcc2d9b5225b16704356d3377f12c96cdd8682d3fc1f6427a87969
TLSH
T11851FA48A5F10577FBE84671C1F715CB36304F6154833F020596F7BABA4A799CF09856
MD5 SHA1 SHA512 TLSH

Submit Download

52b6026b-a338-479b-9510-94c0e32b16b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\52b6026b-a338-479b-9510-94c0e32b16b1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0441221e-4bfb-49b4-8373-80c9ae8637b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0441221e-4bfb-49b4-8373-80c9ae8637b3.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a4e9666e-c261-41e5-ad2a-6924cf9b9deb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4e9666e-c261-41e5-ad2a-6924cf9b9deb.tmp
Size 2KB
SHA256 958db646c5de4a7e2251dcbf9893ffa2b3c3c101bbe16c8a8d127af6144b0686
MD5 373ec06ba1b77d692aecad5466ef4b17
SHA1 7bb3f0f9951ef262b3321b680f05dd4e2071dbfd
SHA512 2a9b27c124d5cde4c67f6cfd8b84ddd1af86ade86fc6d0e98eee14d1e1bf36e478830a9d71f1666b65be4ecbf433b762a06eac281ce94c6bf4b6dbfe28709f71
TLSH
T18F5179B3C3E5862D9A1556F46A14BE2BCE1D0611532C3C2AC9D8AF1BE3F2571E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

fedb2a65-395e-42ae-ace6-459d38587507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fedb2a65-395e-42ae-ace6-459d38587507.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b8d085e04de4ec49c2b06d3da72fd97ef082e98c83d247e6401b87525f5706fc
MD5 2166a5083ffbde1ae56963c8870454a1
SHA1 ad8204d13220465bb5ea1af93132facc68f609c0
SHA512 98f1456adfa0b5ae2c8e7d60e4f6619dee716ee65b53b4dd4aa90e0724e5b2f257ad6bea0c7ccdebeac37cbdf9a151b099863a91d669794f5a485a724597a08a
SSDEEP 48:KIDI1Ks04jyLEzy+suCLbyB6ISWLK9y1ALxEbYJqC4yLpBpQp9pxpbpfpjp8bpPb:KIDCKs0+uzeKEIOSc4KR2N
TLSH
T1E491215170BB131538BD258885B4D76E028236B33168EE6F7FBC44A58E6BE040DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0cc8e0c-81f6-4682-bd09-bd3877c11614.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0cc8e0c-81f6-4682-bd09-bd3877c11614.tmp
Size 27KB
SHA256 9b41c2dd965c10edfef9a0afdbec6e9dd21481abde0af38bfde44c221c7c468c
MD5 ffd92f94f265fa1eafc9502f23175ec4
SHA1 61a43e52ffc588f352c85597fcf93be24d3f3142
SHA512 a7ac6e7269fc720e8055ea8115670f5afd43825b37f90d1392df2827af4f8c28fe1b3196c9be154fdbef7f2cf5d1424e5b8b7c453bd4af77ce72d69b1a0c9df8
SSDEEP 768:hCy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb2roRP4:hCy4J/DWvbtBhu1jajiLm0bNh4
TLSH
T149C20B3B684CCB7E4FC00A9DED5E6F973E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d077ea6d-266d-40fa-bf8a-351dc992ff07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d077ea6d-266d-40fa-bf8a-351dc992ff07.tmp
Size 10KB
SHA256 8642bf77784948d9031b93312cee3f35f4a48b8f3e080ee25ffa99d270ca3027
MD5 98c26c9af7eb725234d467fdd1d1f0a8
SHA1 f20521eef44447f805e49828e71f9425c19c28cb
SHA512 f3d89a0a3e2fd2461ad6731024459d4778bef179756187fa8c26d0375de82deab8cec1c79867dadb809a8ad8490cf126bd7890f998b0fe6ef08993d5e8c08eb8
SSDEEP 192:sxZbRBWF/fSYs2KIdpZSBHW6+WNc4qK/YrJuzTIg5ytJ:sxZbyF/fDs2DUHbz/h+
TLSH
T10C32B852AE34A97B8CCBD31DBA16BF53E6F9543291941E44AAFC861C04E7BCD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f082f5d4-0492-490c-a6fd-1020b93ffdbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f082f5d4-0492-490c-a6fd-1020b93ffdbb.tmp
Size 10KB
SHA256 ecb97b87a03e71667da9577f42216ffc677402bb30d222daec922d7c19c7a0af
MD5 0d229b780151df1d0ae8f23bae5a0688
SHA1 e1af815de534665ed261cbba83477cb9bb27d0df
SHA512 d743eadabd50facd2fe763794710d9274afe142a84d7e13669c6451e42674dad093e035245d98fde4fc66f482ad3cafa3c8b672680b9f5beaba2a1537c8c4f57
SSDEEP 192:sxZbRBWF/fSYsPKIdpZSBHW6+WNc4qK/YrDWzTIg5stJ:sxZbyF/fDsPDUHbz/RU
TLSH
T13632A652AE34A97B8CCBD319BA16BF53D6F9543295D41E44AAFC861C04E6BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1e148f1-3681-4e77-b44d-2fc3a21aa70f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1e148f1-3681-4e77-b44d-2fc3a21aa70f.tmp
Size 10KB
SHA256 6c7bae1f29d30f08a19f519a2f5aeb13c6b4b9e90b00abfe2f1c780e6d46eec6
MD5 cda36a404ee5477a858fc4fe8984ebc3
SHA1 2e62007985eb0b0a3ea213cc109c1b5a62c17d17
SHA512 f02bf54bf0cd2b230835f6c5736329a3e9283352f15387f202f508d466ca1c9b8de5d315d4301bcf2fec7bfeff030850a54410ad6d8eaac721fdc87f8be91511
SSDEEP 192:sxZbRBWF/fSYswKIdpZSBHW6+WNc4qK/YrDWzTIgrJ:sxZbyF/fDswDUHbz/R9
TLSH
T10922B652AE34A97B8CCBD319BA16BF53D6F9543295D41E44BAFC851C04E6BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2d75d0f-28d8-45b3-ad43-2eb11d3c782f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c2d75d0f-28d8-45b3-ad43-2eb11d3c782f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4009b00-bdd8-4fa2-ba81-f6550e24a547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f4009b00-bdd8-4fa2-ba81-f6550e24a547.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3dc6e23271621e4ba2a93ffcb3930a15f72e806dcb41140e94c061e7b36431a2
MD5 f2a4e53053b793cc0aafe67155974064
SHA1 03251674e8f02dfac56a3359a79ebb2eddd92899
SHA512 8a868a58bbda5f053c3961e51d1b6a9befe76ed315d75221c5ff588cb75a9c62507780b80e71cd2005dae22fe591c168be1d1e997d6d4b83119dc72895ad9fac
TLSH
T173411A58A6E91048B7B76E4AAFF6986D847FBC372E06D56D40120D4F0A67B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download