6b263193a8dc67f5efc1c07788c30f96b55ca403c82ddc088d6157c0f35867bf

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee.exe
Size 1.1MB
Sample260720-2nnhlsh19x
SHA256 6b263193a8dc67f5efc1c07788c30f96b55ca403c82ddc088d6157c0f35867bf
MD5 c4e818994682efe44c00e688dd819b8a
SHA1 86ca20c2757279c1d4631b6f83fd0ba718afb689
SHA512 746d0e626a9b560d6b123885540aae9fa6d34bc61c520994c24313e1bbab10a228ad3ff7df1d70b0369717ac929056de280d1219234c951fda1f078c5ca5a3ba
SSDEEP 24576:egBlcMzBQUrAGtMYVPVvcNy4DyLqhOvsCf:egIMmUrZ5cNd1Qko
TLSH
T19B35CE19249084B3F13272F2459262AA75EA2D727720F5C6B7BA371D6A7524FCF4320F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5740	winvnc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_474427334\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1590688396\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_380684450\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1206151699\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1206151699\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1590688396\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_380684450\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1206151699\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5900_1206151699\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winvnc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290610474349976"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{CE63622C-F3CE-4826-A43E-10C1C612828F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 5740	5364	2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee.exe	89
PID 5740 wrote to memory of 5900	5740	winvnc.exe	90
PID 5900 wrote to memory of 3944	5900	msedge.exe	91
PID 5900 wrote to memory of 3960	5900	msedge.exe	92
PID 5900 wrote to memory of 4560	5900	msedge.exe	93
PID 5900 wrote to memory of 3960	5900	msedge.exe	92
PID 5900 wrote to memory of 3960	5900	msedge.exe	92
PID 5900 wrote to memory of 3148	5900	msedge.exe	94
PID 5900 wrote to memory of 3148	5900	msedge.exe	94
PID 5900 wrote to memory of 3344	5900	msedge.exe	96
PID 5900 wrote to memory of 5348	5900	msedge.exe	97
PID 5900 wrote to memory of 5348	5900	msedge.exe	97
PID 5900 wrote to memory of 5348	5900	msedge.exe	97
PID 5900 wrote to memory of 3344	5900	msedge.exe	96
PID 5900 wrote to memory of 3344	5900	msedge.exe	96
PID 5900 wrote to memory of 3336	5900	msedge.exe	98
PID 5900 wrote to memory of 4204	5900	msedge.exe	99
PID 5900 wrote to memory of 3336	5900	msedge.exe	98
PID 5900 wrote to memory of 3336	5900	msedge.exe	98
PID 5900 wrote to memory of 4204	5900	msedge.exe	99
PID 5900 wrote to memory of 4204	5900	msedge.exe	99
PID 5900 wrote to memory of 2040	5900	msedge.exe	100
PID 5900 wrote to memory of 2040	5900	msedge.exe	100
PID 5900 wrote to memory of 1740	5900	msedge.exe	103
PID 5900 wrote to memory of 1528	5900	msedge.exe	102
PID 5900 wrote to memory of 1740	5900	msedge.exe	103
PID 5900 wrote to memory of 1528	5900	msedge.exe	102
PID 5900 wrote to memory of 5896	5900	msedge.exe	105
PID 5900 wrote to memory of 5380	5900	msedge.exe	108
PID 5900 wrote to memory of 5380	5900	msedge.exe	108
PID 5900 wrote to memory of 5380	5900	msedge.exe	108
PID 5900 wrote to memory of 1660	5900	msedge.exe	109
PID 5900 wrote to memory of 1660	5900	msedge.exe	109
PID 5740 wrote to memory of 864	5740	winvnc.exe	110
PID 5900 wrote to memory of 3932	5900	msedge.exe	111
PID 5900 wrote to memory of 3932	5900	msedge.exe	111
PID 5900 wrote to memory of 3932	5900	msedge.exe	111
PID 5900 wrote to memory of 5508	5900	msedge.exe	112
PID 5900 wrote to memory of 5508	5900	msedge.exe	112
PID 5900 wrote to memory of 5508	5900	msedge.exe	112
PID 5900 wrote to memory of 4772	5900	msedge.exe	113
PID 5900 wrote to memory of 4772	5900	msedge.exe	113
PID 5740 wrote to memory of 960	5740	winvnc.exe	114
PID 5900 wrote to memory of 5720	5900	msedge.exe	115
PID 5900 wrote to memory of 5720	5900	msedge.exe	115
PID 5900 wrote to memory of 5720	5900	msedge.exe	115
PID 5900 wrote to memory of 2344	5900	msedge.exe	116
PID 5900 wrote to memory of 2344	5900	msedge.exe	116
PID 5900 wrote to memory of 2344	5900	msedge.exe	116
PID 5740 wrote to memory of 2840	5740	winvnc.exe	117
PID 5900 wrote to memory of 3640	5900	msedge.exe	118
PID 5900 wrote to memory of 3640	5900	msedge.exe	118
PID 5900 wrote to memory of 3640	5900	msedge.exe	118
PID 5900 wrote to memory of 4636	5900	msedge.exe	119
PID 5900 wrote to memory of 4636	5900	msedge.exe	119
PID 5900 wrote to memory of 4636	5900	msedge.exe	119
PID 5740 wrote to memory of 3704	5740	winvnc.exe	121
PID 5900 wrote to memory of 3780	5900	msedge.exe	122
PID 5900 wrote to memory of 3780	5900	msedge.exe	122
PID 5900 wrote to memory of 3780	5900	msedge.exe	122
PID 5900 wrote to memory of 2828	5900	msedge.exe	123
PID 5900 wrote to memory of 2828	5900	msedge.exe	123
PID 5900 wrote to memory of 2828	5900	msedge.exe	123
PID 5900 wrote to memory of 3388	5900	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c4e818994682efe44c00e688dd819b8a_amadey_elex_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Users\Admin\AppData\Local\Temp\7zS4F446239\winvnc.exe
  .\winvnc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffae139c188,0x7ffae139c194,0x7ffae139c1a0
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,6235494087789667412,16343633555932858118,262144 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9546136555537680332,10815447897695691826,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      System Time Discovery
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,1727020840124951315,6708948233885039221,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,15082080911195884432,7853013727842419412,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,13572053503451661907,16649228524796543282,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15683021705483531294,1095891766269795816,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,14072622889313649705,13186581818799258685,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,18049604393028506951,3274555348024022073,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,6225802038325567668,8298864689446086783,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1382405619027566205,13960117714631416009,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2276298160686658730,8006014362726955918,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2276298160686658730,8006014362726955918,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6280,i,15810155160712047810,1649282146632899653,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1884251405351094692,2796048611088476071,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6768,i,12253307175203091111,3514712427629342500,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6964,i,3193601029236396376,9666445368281113133,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,4233294825447550202,940634253469585621,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7364,i,1793762037553665354,18444162490720369685,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3744,i,12042066796520720091,5168623586022523511,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5948,i,124211079100165751,3365556643806641804,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5064,i,9237400049939652022,8021064326677329292,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7496,i,1550210222839124386,1184828263763268754,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7660,i,6945971031264596300,14226003337915175684,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,9185018433133182101,14368069000140340042,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,1480820803307982128,3743408901726445052,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,14535193476955002155,1313289928545371768,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3256,i,16310187559999688759,9357037695020028030,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7844,i,12558440891871841720,9567290165247784771,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7728,i,14899297384687105349,17184645032294459461,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8104,i,8849613585972858820,14598696211418126301,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7980,i,11625781828508012120,13437903933729077769,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3700,i,15117965540990953329,7105541542030574686,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3708,i,7142610552265212766,7963899113338599044,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4252,i,170362167515880750,10790671904844399789,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7892,i,4767919133966413736,12769991047507612204,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6348,i,17827158641186827365,4702768954444439517,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,7593766464288918526,7439730186223919915,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8232,i,6630515180813421456,17487537709264492287,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8352,i,8388898830351946652,12599486798645325804,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6436,i,11042257672776084442,9420081679587149389,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8536,i,16113033215295500923,4963867316439736198,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8648,i,18385117942235612849,2656366085415819693,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:14
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8420,i,15233714215448639397,10943227327763611165,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8808,i,922420763664112998,17321412178800596723,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8576,i,4977521201758333478,3308019774584184287,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9064,i,5132418610216719240,1421139532893688081,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8392,i,11258255423851225429,1064086210743741734,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8648,i,18328100576911349341,540630049413955799,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,16842440148104814014,8442417632927380874,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:14
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9192,i,15588459840521264938,11656489882150723454,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8476,i,4619454762429110047,9648236907971127727,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9116,i,17596864252562328576,2201250830901936791,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:1
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9368,i,2894286266716144798,11172541120624663807,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8848,i,2524425305386291444,7353473028607496739,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
      4⤵
      PID:6212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9500,i,15545980089039435405,6280234114391396937,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9464,i,8719493708608762914,11958133453096477391,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:14
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9344,i,16846097682429520789,4512246165256040741,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:1
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9692,i,6223936661136102092,5321363571364268172,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9648,i,14307934527399766386,8273042092535273971,262144 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9856 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9644,i,3118229555916788338,14479989001933963275,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9612 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9220,i,14510437013709461456,14623900021009499479,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5712,i,13290931428387240900,2070657798314724341,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9848,i,2218626114813014810,13003011123606281567,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=5784,i,9685530502989471142,1247085354828012789,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=3572,i,11357879043187612389,3456796076719614076,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9788,i,15463319910796927021,3453735619477608885,524288 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9812 /prefetch:14
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10128,i,15219693259213510386,7683248710210043524,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=10196 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9920,i,1759432615729285356,18152192319180871368,2097152 --field-trial-handle=2344,i,8142083310215038429,8901000084923469872,262144 --variations-seed-version --mojo-platform-channel-handle=9924 /prefetch:1
      4⤵
      PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cantustange.com.br/downloads.html
    3⤵
    PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 38KB
SHA256 5821c8b7de2ea7011fa41cc4060dc357f11701d76924ace70ae5349ad44e0090
MD5 dbafeb729d88ef38eec940b72bc6bc29
SHA1 04b1d225354b1adf15d9d0f3de78413a1874ea8e
SHA512 721051e97695d721418ad05ecbafbf87751da592227daca8700afe02da19afe20d835f0a389d36226b421698681082a0f62d6374d717cc5dcab7ddbc74f73f2f
SSDEEP 768:VlFpWqmJ0rYEmEb7NeHilZAC5lwyoWMpT5IEIEMNHoBUjHG0/byI82YtjdErk2h8:VlFpWqmJ0rLpb7NeHilZAC5lwyoWMpTt
TLSH
T12703225F10C9A23319BB42CE5B98EB44FCD2D103CA064A2274FD82579F76E416497AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 83KB
SHA256 dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
MD5 1d35678c5edbb639ab7aa5cce0856f57
SHA1 3b0f35285a7088b1fd321773696f9d3b45d31942
SHA512 40057ceba29c0a8d984a08fc0fb056f999f715ee7054a4d6c332ad5b2f26916fad78f7092fb2588a5bdd7eb04541c773e0e0c3e3c1a920f9e14e9f540c8dfbbb
SSDEEP 1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOi79xfWBZ+Bjda4w9W3qT9a986:v4J+OlfOM9xrCW6T9a98Hr2
TLSH
T1F283C6D9B2D6706297B734B850BF410BB17A98DAB44C8C60F059D4E47EB4A8E507BF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 158KB
SHA256 94df4e4976db8ddaec27f8e8c33eef912e744fb200ca09051794b38e5a502fc0
MD5 d5c46b134c17b2138dcd1bb0efa67049
SHA1 7d0421de4e1398fb9087378a9ccc9297bdbc84b9
SHA512 439ee91745e269e0b61af6d8d15616f69113cc3342fc68bf37a10fe329b1ce6894532fffe809a3ba2cc02c5864c5ecb51792759a5807615e7fe94ad765bbf6f1
SSDEEP 3072:OPfQZEGwFXbUqc9ZQRN6DKiAfSd2PYrEsQ5+xwmrRCicOkDY8cZX/o4hE:OPGRncNUKiMSwPeWYxwOu3cfy
TLSH
T1A9F34A1BF343EB57DE65AD7902B5C3E2661DFC2622339A47E0BFBA2498030E51D164E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 102KB
SHA256 9ccdfcbdb1b970e684c20f5fd1356e57c9e8200cd51c5ecb4a33d30254faf856
MD5 a1e45fd4f7f23a8936b9f9847b5cbd29
SHA1 ef39965f27575c1ccd8eeb99bf2db7c477551442
SHA512 bb705aedc1c61f434e9cb75ac0481306ccd3e1e48452f160e45cf68c94710f243aba4c98a646bab0335ab2e82b710bdabae89b86f4e2f3581354d981c43b5eb8
SSDEEP 3072:RnPavmWKjp9lvHSqxgtsJwAnXhn23bytFga:RPam599lvHpGsJvXhkbyfn
TLSH
T197A312B56E580CA45D445028E890E9B848F6624F8F14146B1FB5BCE13F3BD26FDC2D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 154KB
SHA256 2efe5301b93d1e4aa90fed89f766a88be1b80be64873f853c1b6e089cab19fea
MD5 8f7b8dc753ec34b0c7c3d748a835c38c
SHA1 25e47bf261a07aa014c90bca273542907f7461cd
SHA512 08b06a24d82f7d599e35778029df43150bce2425f69ef96c8d7d7de1c569c44e29af14329ac7051f023749f43f4f0f2057c41d5a885b409fb476e42541a38b8a
SSDEEP 3072:KPfuitPzZbQpBjgXQI5BAY5bAYS4bajKV/cFR19woicZX/oFg8:KPb2SvRA4FcILc4P
TLSH
T1F6F34B1BB343EB56CE616D7912B1C3D2AA09FC792733DE57E0BBBA5498030E51D224E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 154KB
SHA256 16466ef65064e6f3885a6d2806b8949ac1ac38b524dd0cf8fc96565eb4cc28e8
MD5 5673da52c98bb6cb33ada5aaf649703e
SHA1 a18dcbf99c8d2325c2fbf22a64e8cc28a0cf4d3b
SHA512 9728536f1e67069b4c44effc3245d81f61fb79c811a4bd2d3879f57eb220e475dfee0639dbecbe03f411aa8f1e2e84fc38a966ba38982b0b35e2b2a98549583a
SSDEEP 3072:CPfJU8fbEc6MjbUzk0pewfMi4dbARp/cZX/ogD8:CPx4k00wEOcc
TLSH
T177F34A17B343AF52CE656D7802B5C3E26A5DFC2A27379A57E0BFBB2499030E51C124E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 62KB
SHA256 ff63087bd0071bd148e8675adf53a55c4d00db373359d559d461f609b61a3924
MD5 6d6bc700d0371d509c7a4e12cd7d8bc0
SHA1 e233ec43cb7c9332917529685411e37a50921b81
SHA512 93947ab35fd6388be595e60055164514efaabeb0ab2f766d49608017711b6c00fc98ce6264c3434ba57d56f5f9814f1bbd1df82cf8e31838e4d872221a4b875a
SSDEEP 1536:3K9xhhR76iGUurk+KYnV4mH09ZJ/GPerbph2CJd4EWFd:3ExhKzUurk+KGA/prb9ob
TLSH
T1BC530233D04F7FBC528D87620B2164608176D42EF5A4CF4996EC23A5CE2ED190ED6ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 321KB
SHA256 62e07b571f6a2d222f92b65ff5ad876c96093f9588d07af63bb010b98420b6b3
MD5 2770a6a77094ae5ebe2699fd73aeaa93
SHA1 ab9ff9db04c76c65a110376082dd2f24c4cea3c0
SHA512 6ee4327c3356881ffe2987cd7c914947fa25d8bb740df816616cd5ffb0c9ff6af3f24e15013c62aaac1a6b38e3cc75e867ae8aac56fdd54deb7abea74d8154c2
SSDEEP 3072:xFGWbHRFMtmgyb11s/Qt7k8Z5U5+EO2g7gstwapSVC5D/xyB9jQ3Q:xFGOHjMxyb1ST+EQksXQB9jQ3Q
TLSH
T13B64963F03E40253785F63C6B329E63BAF8089C6FB4AC647152643A161CEF46D6A553B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 37KB
SHA256 e072db380a2eea853448d74243c5e7103b8931f28c7da37d45d2599c4fdf145d
MD5 e5bd8927853b8b45cb9ff293e53a4412
SHA1 831814d9f78df095c345cf50dfe4b2627c153d54
SHA512 65ae9df7366ab344da2f9928e0c362467a41a73005290489c27909122a7fff08391062534f89b9f69a839befad9cf6fccecebed2ab2df779a0a1f9c2e3497bda
SSDEEP 768:OzWQa3pIyCQXurwBeOKYzwmikYWvCsOa5zg1MHwkCwO+b/GwgmsYc8m1gnrSa9/:WWQyFBFBe2LikYWRbxgywlH2Cj5mn+Y
TLSH
T1C50301A4F7275D3D60EA3220E655032839E1A5BA1BEC125EE33B55CE44C1EC71837D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08b14c70355973de_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08b14c70355973de_0
Size 259B
SHA256 77309b88dda85949eeed456a99c19140859c5faffa3173e5555cd81cb59748c8
MD5 43c0ec9e2c98b704a942cb34fdde8a7e
SHA1 be05496742a5fde0dfc0cee53f2f1d95ada606c7
SHA512 5c3e7bf616b5476dbc7e832b966ad5e8ce4e1c33e7cb2ae808c8945f09f95553b8a67073859017ca0ca3daa000b031f626997db9bed6478637cf62c78ccdafdd
TLSH
T1B2D09707E8042814F51DCEF8AB93245FE12B60C04E0AD080020664B37202CF26EC0D13
MD5 SHA1 SHA512 TLSH

Submit Download

44b05b54badfd7ba_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44b05b54badfd7ba_0
Size 570KB
SHA256 1690d35106e3e42ff3440c322848c5da5bb71429cfb016c6aebc6d4e15a10ce1
MD5 8fc26b7efc0c0c9d75fe5f0c3cc78958
SHA1 07aa34b47a9da528f86f67de3119a0061b4590a8
SHA512 bb6cd927dc5164937c8351b7093c9b3fd024b70ae5729a023f84a7c93422f4e6ce3bac1189a567b4721234370a051b22ac22f3ca2201030e2a45632a7477d0a9
SSDEEP 6144:sfX2iC54RcvUInS3PKSXHaAeFlMJT8Nr/6jZgKrBUmzmL3Qf4PVohIA:qC5IXIIS0HaUTkr/62KMA
TLSH
T1B0C4E8065B90A922CA7613F651B78627B33645453FC3E31329A5B3352C287FA1E9EC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49fa42ff8f19250c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\49fa42ff8f19250c_0
Size 4KB
SHA256 444fce39660e8fb0ae35300f0e69301bdf6345eeb8dba734324a89791ec8f7ee
MD5 afb7252cf66cc424cc03c52e9fba9a7d
SHA1 9c3f869a66a885fb77e780b506124e10e883120d
SHA512 8f2b6eb27da4f2fea7490716020e7222f6c9aa9c4f4232c84c7685e9b18eadcb2bc9682b2d4cdbc20458c79c2806d54b95c5a31087944d081f6f60e331c77723
SSDEEP 96:wAoE9lLEm8p0jnQQfcxDFaYZl5LsIIdKcFJwVWCACAsNii:Pc50jQQgAAcI4KcHwtLF
TLSH
T10EA1B32957111A56CE690BFA42F6882FBB3205043F83CB1219E533755C2C3EB5F0E98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

647f6ea4a33ea57c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\647f6ea4a33ea57c_0
Size 1KB
SHA256 b2dfeab58074b1b9d2731fe88568f6ad750a08b15aa7b7fbbba3145f56f05081
MD5 702defeb61da0eeba26a819aa936fe14
SHA1 db71cd988bbd67f1308d4df61d6a3add2d599adf
SHA512 b868fd76e6ac6928dc3ff3ed3a9fe17b6b59077706aeba4a4add5fcd910054968263ae76540454d3f14480c3cfdb8e707377a6ff52d2f75cd6737bf96f142ba3
TLSH
T1683146159F81E829D53E23F0D1B6412E773601CC6F97C14F00D5727A3C6E6E7495594A
MD5 SHA1 SHA512 TLSH

Submit Download

801cff6cf425eec8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\801cff6cf425eec8_0
Size 1KB
SHA256 5d89e2ae16a75c20bfb558d24408b1be39cf0600079085b11cb28ef27c0d4d63
MD5 1647172f4648ea922d27c41268c2b829
SHA1 c8e9a1345e28ebdb747cca319a4c458c124bc78e
SHA512 aba6fbea5b9d5bc45895620e271fc144a9ff6e2f5b163cba8f855778b94a585ed7ea93d7b61e4525a0f9c617626d48ebbe7e9ab475753bba708608b4baea56b6
TLSH
T17B21D21C44A274E0E6B94E966CA320721949A15FECB77EFC8448C532396986C58C796F
MD5 SHA1 SHA512 TLSH

Submit Download

91354cb9c658fabe_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\91354cb9c658fabe_0
Size 3KB
SHA256 e53cb3d888c9f8fdd77634a4cf05675e08cb5dbd7708ab38f27371cd3d1e80b3
MD5 9023003dfc3ec287201743669bc6eded
SHA1 7fb4b72157da70bc7bf7641b23bf3021c841ad4a
SHA512 6d5a50e13841a9cccdfff2f99ce0c386d714e838eb901edf38a953eca6e53f333c8be533f65eaec72d3f5bf6f2ecf44773739a505d50a4cce26e884dda830484
TLSH
T14E71FBD197A04E2ECE6137FF88E79D37A6A941490DC9F7060351BB742C182D2FB58522
MD5 SHA1 SHA512 TLSH

Submit Download

964bd62eb16907ed_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\964bd62eb16907ed_0
Size 10KB
SHA256 3405798230c5d92cc8e92e08a3f194488b131ced7cc5259c2c9c44ba51775e5b
MD5 ca7be63ae6149babd9d4b106d2f2ef8b
SHA1 253991b35bab7b6988bed2efb8cb4bfa642f4859
SHA512 fcbfa430eef639b2b15befc14123b740f94bd3710772a07639d5b7f0673a133b67aae5313d5bdafbcd1d0d1695b59c794f342f2406c2e35b70ba02d37d415ea6
SSDEEP 192:ZtnOFgMFH+G31Raltz/TsCOVAdoqCWqCsqDnq0Yq44tqPgq6xq8KqGyItUNvR3Z2:znOFXv3/wbTsCOVAdoqCWqCsqDnq0Yq+
TLSH
T1C232C615D7509A27CBB507FA41A6DB1BB73681453F838B5328E2F3300E2E3F75A8A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96908e5073a89433_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96908e5073a89433_0
Size 260B
SHA256 dbe289887d7f037f892c569e8a657574266d6ec1c8fe33a5b7aaaabc13ec038c
MD5 ecf239434cb50073fd8d11685f30e269
SHA1 8745b4711e774b2fd4b84df80959f062a49c73b7
SHA512 e4ec29f3d3c16612db2ea4390eaf1b8f7bb19dcd71d3f01b9b96d0b8996369983ebfca532ce44cb538a82645076e6d0d21a43bc6a7418738e7a9f122bd8b88ee
TLSH
T13ED097EB08143021EB148AF0A2AB435CAA3F28F04319C1CA8206A2B39F076E9A407E01
MD5 SHA1 SHA512 TLSH

Submit Download

ae30c55fac29595a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae30c55fac29595a_0
Size 280B
SHA256 8f2bffd14cc382c53408a1632057fcc920b3546bd44ae57a53e184802a42ae91
MD5 f748d5678a42bf9cbb1c824c09f4b72f
SHA1 f397bd60f2bea7c9ea21b72cf993286cab096e85
SHA512 7a6d12072616c72c38d4f178f966bb62bb2e9723d13eba4d760d6c07bc1a91c2ea21a6f67554e8882dda311f74062f16958869aaa290a3e01005bb15ff4c2caa
TLSH
T1FBD02BAF83203802C59088F089AA728E9614DD8C0C9EC9C2004E54C6FA23AF35A6E545
MD5 SHA1 SHA512 TLSH

Submit Download

dc002f8c6db959d3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dc002f8c6db959d3_0
Size 37KB
SHA256 e43f0493712d5dac93ffa7f05e5109ddf982818bc0ffdae54c9f815cc90c3220
MD5 05cf832af2c2a1ae467fe42177b06fac
SHA1 df754df51ab05bb42c29330f30a55bf2a31bf712
SHA512 fc94182c3592a793b515d988f512cecdd24b27e2f1bbcd4ff175ad32f6941505e5dcf88a7631412ab06705a88eba2fde149cbe0fe50cb5ecaa013eb662708362
SSDEEP 768:QzGgz2sN6lFyturGjsoB+9LB+iziHOoDMuDgt/t8X:Qh/EgtKdJai0Ixs
TLSH
T1E903E5111761AE26CE6A53F641AB882BB73A410D3F83D72316E573352C397F75A0E84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa0ecdbded6aab51_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa0ecdbded6aab51_0
Size 126KB
SHA256 64430af7323eeb7ba9450341fd50cb2ed634706dfe5d9f9e709a54188f136a09
MD5 5ca7d9ade09b12ffd890f1fd9ba3ae53
SHA1 a156e3b195a959715744fa28b76112249b642afb
SHA512 d65bc727de1c4770047392c02b1a715ca313113a593f19898a22d335f1219f08491714e1c81c492413940894476c4fcb449cc107904528d043ffad1b15d90885
SSDEEP 1536:8LqS6ooAUWYHBgQlApzVZiOzjgoB8v36h2GYQSvzsmADuW0ZJ7wuDgX8Xz1:EoBWMShH4OYFzsmmY0XK
TLSH
T103C32C356F60AD3ACA3653F541B38C17B236854C3FD3E71F36A49235281D6DA0FA984A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd0245b056171837_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd0245b056171837_0
Size 297KB
SHA256 12366f608709414ec647f6822ae190cfd3187445e5ae99a0962a2a9844cd82c0
MD5 bb850c6a4b5eae15aa7efffc93b99a7b
SHA1 0ea6097db780a2543922c0b4855d4ea086fe447f
SHA512 6b505a5df6483402f7ace8122cc8aa0a1e1b0426bf951d7a91390a227c91691326ac7b05e17dcca678942ca5763f946975284ffaad405063d2a99a24764f7c6a
SSDEEP 3072:EKK+V0IuK/sgHsqaATciATeZ2Do6PfZDEC4s26E0t6ThBpNUOgpl:El+V058sESjCYpEm2TFBI
TLSH
T1E954F6055790ED33CE6A23F961A28927A73281057FE3D71325A1A3362C9D3E60F5ED4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 cfdeeb16ba073b3e187915838a3f42811fb249cad45ab7ee86cf6a9b78bebdbb
MD5 fd08585b5ff489a290ff6c9eb6aece7a
SHA1 c796cc4af8d5704792c03ff1d7356f016ef97e68
SHA512 3dfb6daa59f8d150ec9a5fc08aa86a4523c06e4f68639eafe75253d2b7fc7ff4e4a42ac65b382b96f0d189b1deef1440d719ef2e4c379995b641875f82ff85de
SSDEEP 48:YALlNm0BOdml+gymHPdzlpdb8bdzxAshaCZsqfoKsUQzsQzEsQ2CKslgmgwEsGIS:DnBOtYx1ujpamfqzE2Wiwiu/5UF
TLSH
T11E918CB7C2F8866D8E1256F0AA182E2BCF1D0914831C7D5AC4D8BF5FA3F2471D14195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b39fc64055e2e939cbdec89498bb6e70c5a2bbeb5e8e0d01fd7cc9c1cbc63806
MD5 3d91f69d4c97d1665834e441f5946d68
SHA1 8051a725c5b485012dcc7a393fe90d3246a4b461
SHA512 8dac40a222443825d00127a71d94346eac3b988774bb3cb3373f8572dea699f12748b0e4bbdf24a183b48f249ffe5c2635142d093f1768e35f75f35d095b2eee
SSDEEP 192:sxRLRsCG/fLsbslmmZKLjDzoA8pYT/g6+WNdOOf8e3Z75KsoGC3IgVuJ:sxRL1G/fLsbskQKLjyO/5tfZ+XQ
TLSH
T1B342B816A968997B9CC7D219FB557F53D6F95022A1D01E48EAFC8B0C04E7ADD530380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0d7f59c24803e64c275709555a632c9c0d24764f97e3131baaf77479c7112bde
MD5 1ab68ae37e96101cac78e779efa79052
SHA1 264a0b385da0267cf7d66b0782b31744a14ae16b
SHA512 7312a4a66c8e80b723212c137dcb3ec6f5420a3802af2c8cdab97debdda96556db7f4f04d460b21c0b6da5747b11692cf6bfa9ad34564bc710a3064664daf8a5
SSDEEP 192:sxRGRsCG/fLsos7mmZKoDzoA8pKV/g6+WNdXHh80WZ7smsoGC3IgDzvuJ:sxRG1G/fLsos6QKoym/5Rhz+XvC
TLSH
T1A442B71AA968997B9CC7D219FB557F53E6F95022A1D01F48ABFC8B0C04E76CD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 91a8c76ad18c2a36c745dff2d47e8766328f8b8a88eb4a2c854ac6b544b78f91
MD5 b5f7f10743ac22547d963135d1b802dc
SHA1 9af3b3dc151499a2512cc2d5f94dd3203bbef46a
SHA512 67c83e2cb501562337f185271234e7eaa95f2c4825ec7130efb549a041ade758c1e4a750b290f037c5f209b98b5e2907657a58916d5f16b78bf4e0b89b095bda
SSDEEP 192:sxRLRsCG/fLsos7mmZKnDzoA8pK5/g6+WNdNSh877Z7GmsoGC3IgDz8uJ:sxRL1G/fLsos6QKny+/5KhJ+XvH
TLSH
T1DB42C71AA968997B5CC7D219FB557F53E6F95022A1D01F48ABFC8B0C05E7ACD630380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf524138d391f501f4b3e994058614ebe0b7377736fb571b25edf37415fa841b
MD5 3f18aa87ae8eb993a8a167c2e43573eb
SHA1 7bde5eea8a9d27c109faf73238a4d4f7966cf048
SHA512 b16ec545204c8027a83b8530ecc23377c99fd9e2accae7f268c2060309ec1caf4cd1b41959e3c3da4b4eade69dc27f7115306671088187c2b63acf71b3a084d0
SSDEEP 192:sxRdRsCG/fLsoslmmZKlDzoA8pYR/g6+WNdLTZ8JeTZ7gKsoGC3IgDB2uJ:sxRd1G/fLsoskQKlyQ/5RZ8H+Xdh
TLSH
T11042B71AA968997B5CC7D219FB557F53E6F95022A1D01E48ABFC8B0C04E7ADD630380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 24f7f2fa21f19bf6697c95142f4de8c04fa81a31ee4a6c58afcfa5ebb9b0feb4
MD5 7c72263f9e99fab364ec123011a79dca
SHA1 c4bc101c9d969d375652cf31ebffd1560834687c
SHA512 e4134c604d601a24be49e643d7dce3932de973930509ef008df1d0b3930b7f5e8fd3cc406c2439156097bb64a56a2cfef4afd7b4c15c7f2f6797685c75e4178c
SSDEEP 192:sxRSRsCG/fLsos7mmZKTDzoA8pYE/g6+WNdigp8fLZ75msoGC3IgDzouJ:sxRS1G/fLsos6QKTyR/57p2+Xvj
TLSH
T1F842B71AA9689D7BACC7D219BB557F53E6F95022A1D41E48ABFC8B0C04E7ACD530340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2d03691cb54931bda132fc64b2e7ca90e6d3a2fcc35d28d751eee604485a7b6
MD5 e868ae8cb7d2af62b59491ccd277581f
SHA1 10636f73ff710bd3161fcd1368a00a3a17796748
SHA512 335cff8f9f27da204b906ad6a62b069da5bdbbf1363049f453029c7e1fb9a6e849d7dcbe6dd7878c1354f04c2a965c2d0ec1d447248701557ead87207dd74c92
SSDEEP 192:sxRJRsCG/fLsos7mmZKZDzoA8pYS/g6+WNdp2B88FZ7KrmsoGC3IgDzKuJ:sxRJ1G/fLsos6QKZyP/5uBQB+Xv1
TLSH
T18C42C81AA9689D7B9CC7D219FB557F53E6F95022A1D01E48ABFC8B0C01E7ADD530380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 100e03ad9961c76d81568dc6c24269616aeea5fed20512312b418b3743d422a6
MD5 3c58c935cf3f9f13da49fb7b259cd91d
SHA1 f3c6e8ff949789ef11ea8fdada2c754e2d8e065c
SHA512 aa80b36452a0ddf89e927385747f1817a1ca7c71e3d4a6704e820ab685d21fa90dbe9f7961f7451c2b616dbd11cfd4e5029d39a8f528e8f46508e1e2c63efe79
SSDEEP 192:sxRaRsCG/fLsos7mmZKMDzoA8pKX/g6+WNdkbh8g1Z7HmsoGC3IgDzzuJ:sxRa1G/fLsos6QKMyA/5Shl+XvW
TLSH
T1C242B71AA9689D7B9CC7D219FB557F53E6F95022A1D01E48ABFC8B0C05EB6CD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 322ac6a6eaa9d88aab49f5d3ec34b6a54d2de7cef87c5aaf1aba63ce6d874a83
MD5 e85f598a26984a1af9516bd8a24d72cb
SHA1 fe18d630a55b573fc3c69be6e01f06cb37bd2b1f
SHA512 336aa68420519f851d0bc647c33a9b13c577cf6a28c3a0101dc735140a60d70d78b168f375a7be6dbc0a4b814f14f1b931a802b7bbdbfaa6b7366cfc214448dd
SSDEEP 192:sxRVRsCG/fLsos7mmZKSDzoA8pKF/g6+WNdLYh8DXZ74msoGC3IgDzxuJ:sxRV1G/fLsos6QKSyi/56hP+XvM
TLSH
T11B42C75AA9689D7B9CC7D219FB557F53E6F95022A1D01E48ABFC8B0C01E76CD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 deeabb0ab11e71ad7e36d6faf16b40c6be461b64ba655dc431a12b1f866d8806
MD5 9f7188b7164ba0aabd690d462ffe0b52
SHA1 b05522d139a1ea33322bb7d412bc97ac0b9a3d27
SHA512 d02705b0a49065c7978f902150bb7a7f125ddab64304ddb54803154dd1d779754c11f871e23220e6406d1f2be157fa807bc0138eba016139a405a8d4a3431fe9
SSDEEP 192:sxRhRsCG/fLsos7mmZKGSDzoA8pKP/g6+WNd7IUh8rAZ7JJmsoGC3IgDznuJ:sxRh1G/fLsos6QKGSyc/5Jh9+Xv6
TLSH
T1A642C81AA9689D7B5CC7D219FB557F53E6F95022A1D01E48ABFC8B0C04E7ADD530380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5420c0b21e255eb857184b45cad7771f3db6669f043b7a9e5311f946a7b843c1
MD5 ce840b4c5498678ad2861e22cf077a03
SHA1 0dbfadb408400966596a5b639a9f59e8f0e16a1b
SHA512 44777bf119bf2acdc023de982a358c19dab38efdd40ab8dc96e86151435d9e3894845bfe4e58174e8c9f0ef57863b522a85833f5361997964625ff72daa9bd67
SSDEEP 192:sxRpRsCG/fLsos7mmZKuDzoA8pK0/g6+WNdyWh8QtZ7RmsoGC3IgDztuJ:sxRp1G/fLsos6QKuyP/5Nhz+XvI
TLSH
T14E42B81AA9689D7B9CC7D219FB557F53E6F95022A1D01E48ABFC8B0C05EB6CD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28e620dcd971623b24f53d38d5b9ca39516877e7263464112334cdc747e466bc
MD5 14944fe7f7509d2113de584858a82869
SHA1 f9f6297c24ef8f6ceeefd1b6982703934ba9700a
SHA512 c8568fb71bff3ba299019fc8c9381a08d3b32b06aed576f4d270c730730691b9e5ff075e07060c5ca1fb96bd89ecb26bbaa215d74ece3406eb234f1979468a76
SSDEEP 192:sxRqRsCG/fLsos7mmZKGtDzoA8pKhY/g6+WNdhGnh8aXZ7zLmsoGC3IgDzWuJ:sxRq1G/fLsos6QKGty+Y/53Khzh+XvB
TLSH
T1C142B71AA9689D7B5CC7D219FB557F53E6F95022A1D01E48ABFC8B0C00E76CD530340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 840d63c7d58a3e18c8393bace260c12c6b58d9a2653187d3bc4f2d8b4b931726
MD5 1060f988ddc653a35755cf214046a436
SHA1 a54e054f90a4e7a939a2c5cba0bfe9ed9707cf1c
SHA512 fed953422b316b6f8c7cd4945362c9f66fab1f472b0e99eb646f6b846222a42212a86673442b81ccadff092db5720a038275828392db11333572264208efd4aa
SSDEEP 768:ky2S8S7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvduSV45rofJZ++:ky2S8qE7evWgd5f/bu1jakduU4yf++
TLSH
T145D2DA3B640CCB7F4F804ADDA8197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cd693fa-aafc-48ff-9174-e2408af64d58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0cd693fa-aafc-48ff-9174-e2408af64d58.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 82b5b0cc2aaa456c304d28e08471e84c866271ab4a8acf5a7910f18d78c2f5fa
MD5 c8d14e9f75da30b9bffb7c0b46c3dae3
SHA1 4cdb94a3bb3ec8e435be419bda02a731c49a9716
SHA512 1656e66eecd2fac42953eb9c94b52ac27ceda267fa62e81e79275ffb89c23699aab330aa36519decc0061a7cd0aea3b8b4e097ba26657e27797d2448c9a16d30
SSDEEP 768:/j+9z3nqpqOiAam6aQMGdjWca4Ghf9XRI:y9z3oMmaME6pXG
TLSH
T144D29E3058A9DC779CEA9695F62B3787BDF012B388C81E44D9D85F0D029768E270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c517046a8ad3ac526c4ec6e1f6edded19741bd7fe1d3f55d9d5d3b91caf29b18
MD5 f7ed1bfbe6fba0021bd2e99d2aebc48c
SHA1 f97d6f5b86f11ace467a05989d78a70d361a7bf6
SHA512 6d9d915bcdc7e49752c006cea56edfb20207cb235527f3d04a13a15ec48a3471123f98cd74ef913a09f6624a3377484ca6c200321dfece785be9ac26e0762f89
SSDEEP 768:/rv+4UNbdq303q8AAam6aQMGdjWca4GhfB4PeU/:/bsbc3WKmaME6pwH
TLSH
T1AEF2AE31A87C9973DDB79A99F21B6687BEF021A385D40E80DAD91B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e221a00c2f21173a518da2af08f04a1071bb2e40e3bf811e64221a04a1a34502
MD5 3aaaab1789c666b37cd151a5b0311ed0
SHA1 f1535ae3de66a0524bb86115641e1df1287f9e6c
SHA512 1299a883f22d66fc8067849aaf33de184fed0c519a13c675e16b7c2211024bcc719912b64103fb3bf9d261cd08d53dd80ffa5a68cd476cdf792c738b4e8625ff
SSDEEP 768:qj+9z3aYJqOLAam6aQMGdjWca4Ghf9XRI:J9z3h9maME6pXG
TLSH
T186D29E3098B9DC779CEA9695F62B3787BDF012B388C41E44D9D86F0D029768D270B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 876848ba78a2fb91574eb018996f34446e12029f21c3b8d7445116ebcf51a1b6
MD5 026f72caaa52d1eb6ee3b6ed435675f1
SHA1 902c57375e89dffd63e247c59bb84d78bb96ba45
SHA512 82545767bc35a794013d4a63f1c7069cd0dd44a4f987916c4b905786ad0ce4ccca9ee33f16f92179db2ec094cf19c6c461a6487a6f2403bafcb1e514891f5347
SSDEEP 768:gF1j+983mwgeiRiAam6aQMGdjWca4Ghf9XRI:t983BmaME6pXG
TLSH
T1AAF26B36D8A8CD6BACE79BD5F71A3687ADF011A388C85DC4DAD85E0C01D718E170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

1fe80046-8dd7-4230-8b99-a0b703e77ddd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1fe80046-8dd7-4230-8b99-a0b703e77ddd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb00b94b-3834-4841-a6f0-63fb0eb067de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb00b94b-3834-4841-a6f0-63fb0eb067de.tmp
Size 36KB
SHA256 9e1d318bf309aebfec4225947eeeb0cbec7d4c69a929a127b2df0d29f2c8c2fd
MD5 a729a6451cd581fe3e70d1f592545552
SHA1 12a52201b920e9e03ee7261b0bf21457d70db647
SHA512 b3c76d89d78f3a32b51a2223510cc5622b54ec201e5d519b6143f720d87bafe53a3ab5114d23c2e94b8b5a12b8b44ec1b64a2ec21256f3f8d6a951976c7184f9
SSDEEP 768:xrv+4UNbdB37pJqO2Aam6aQMGdjWca4Ghf9XCA:xbsbH3J4maME6pX3
TLSH
T19AF2AE31A8BCD9739CBBA695F21B36837EB421B388C40E54D9D95B0D029758E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.bmp

Path C:\Users\Admin\AppData\Local\Temp\7zS4F446239\background.bmp
Size 1KB
SHA256 cabe46131d9866cc887c4c97f1559d83dda26e3f1d50c7836bc02bbdf831dbee
MD5 f822f078c1ddcbb419df742794c8a37c
SHA1 4447fde31be652b525a8a102deef6d34f53fe18c
SHA512 9cdbcd86af72b60d39a957ac03db52f462eb804af023bda0132e2ce2a664826cbe6d4bf98839acea53dbfc0382474f35a0213253a9b17a39e9820764ef954fb4
TLSH
T13A21D4705FF14874EE022F7D4C67BB065E46AE56100E088451CC5CE1C862F8E923FFA9
MD5 SHA1 SHA512 TLSH

Submit Download

helpdesk.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS4F446239\helpdesk.txt
Size 3KB
SHA256 642d784174c8cd091113aff2e92f0e88a5c7a6082e4c72d70029aae7e52c68fd
MD5 0a3a5f428ab012ea03e04be1755138dc
SHA1 860d8894a9cdcecf1c1de78712e80490e9efda7d
SHA512 6aa6df614855da11bfe11081c920b6691317394554aaceccaa0731480c6c1694f7e5dc9db61f7fe08e064da87a41967aad66016bd7a481d6b3b296242e8251cf
TLSH
T1146124785A07D22793A30589051A0DFC212FC081D3E88581D3E8827B57699DACFBAFDE
MD5 SHA1 SHA512 TLSH

Submit Download

logo.bmp

Path C:\Users\Admin\AppData\Local\Temp\7zS4F446239\logo.bmp
Size 103KB
SHA256 d8c1f81d553257ba8d46cb14aea624b76c6ec3be5d1a38046704504ae6389ca1
MD5 01aa307133a6a7f1698b837b2dce34f4
SHA1 1fbf54a81fb8ab21bcb43b2d28d81c6f0ba08b78
SHA512 ed9465a3a98d9ea847e7690e9275673d6a897d17390c70f5e3e68187e64de2b77d7a0d657e10e9d3450b754ee1554d50a047e903b16918c3504ae551c0f33a51
SSDEEP 768:nzVnHRxX6XVi2vbWizLU9H7idWowmFL2jEqSuwVzS+VEKp9oUDMa0bpqXhH8EwiP:n5RxX4zvbbmbidWowOLyJSw4+VbG
TLSH
T174A35F04856B3E616CC1E8E3D8840FF2D7486DE11AA0866D76AF341DA7B0B555CCEE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winvnc.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4F446239\winvnc.exe
Size 340KB
SHA256 8e817f7da66b24eebde77c82010dd080830bc51512a03818df3cd0d8a34e0ece
MD5 01af44894cdd3e0b678f45ea4201d9d4
SHA1 9e7bdc6f26530f87a6dcaf3962acebd7abe78ec3
SHA512 cb4fc31f2b2cf0ae519f4d0449733b01630014d61f2c4ff5dde914e83a3bd8801ec124c1084482b9e8a0c5667991dc26ad0cb813f089438bab66a173416898b7
SSDEEP 6144:7zGEYF1B+zkIILcCV16ssBnWyng55mOc9TBi4lbrsGUnt:GEYF1B+zkII4CHvsBWygHmOc9TA8sGUt
TLSH
T15B74AE2277509433D4A211308AEBE361FEBEBD719D35821BA7D80A6C6D702D2D23579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_796006591\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download