24f749a4ea3a635bf7613de479a9b64a356aa2a62d4b3237c665c125f4c370d3

Analysis

max time kernel
2s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JonnePanelBETA (1).exe
Size 857KB
Sample260728-lf1vzatcmd
SHA256 24f749a4ea3a635bf7613de479a9b64a356aa2a62d4b3237c665c125f4c370d3
MD5 e26f85385cfa5c8fdf9c4f177ba8d883
SHA1 25ba8c779f6be828b553c9bcfaaadef770adba6e
SHA512 1933fc33cad7946e13e27de0624b27bc324e202b19b5e16ab429d60aaf0b788e9d67a62dd843f0101dd433d1c2912e80b035eba6be9714103ea627438d0d5e85
SSDEEP 24576:GU+9XNrenyktDLdYNtcdvQNC9wHAP5c1gfrrrxnnw:I5OVeyffDxnw
TLSH
T1DB159E17A69744F7D46033F801B9D7A58926A3F47336AAC3AB703C34D9A16C32D39389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JonnePanelBETA (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1684	JonnePanelBETA (1).exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1684	JonnePanelBETA (1).exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3508	1684	JonnePanelBETA (1).exe	89
PID 1684 wrote to memory of 3224	1684	JonnePanelBETA (1).exe	90
PID 1684 wrote to memory of 4672	1684	JonnePanelBETA (1).exe	91
PID 1684 wrote to memory of 5804	1684	JonnePanelBETA (1).exe	93
PID 3508 wrote to memory of 5720	3508	msedge.exe	92
PID 1684 wrote to memory of 5860	1684	JonnePanelBETA (1).exe	95
PID 1684 wrote to memory of 5700	1684	JonnePanelBETA (1).exe	283
PID 1684 wrote to memory of 3296	1684	JonnePanelBETA (1).exe	97
PID 1684 wrote to memory of 5496	1684	JonnePanelBETA (1).exe	98
PID 1684 wrote to memory of 4584	1684	JonnePanelBETA (1).exe	99
PID 1684 wrote to memory of 1992	1684	JonnePanelBETA (1).exe	100
PID 3508 wrote to memory of 3448	3508	msedge.exe	101
PID 3508 wrote to memory of 988	3508	msedge.exe	102
PID 3508 wrote to memory of 988	3508	msedge.exe	102
PID 3508 wrote to memory of 988	3508	msedge.exe	102
PID 3508 wrote to memory of 3636	3508	msedge.exe	103
PID 3508 wrote to memory of 3636	3508	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\JonnePanelBETA (1).exe
"C:\Users\Admin\AppData\Local\Temp\JonnePanelBETA (1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffb9276c188,0x7ffb9276c194,0x7ffb9276c1a0
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,4820502382517869735,2885391226182365853,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,13460808455664294479,11184519389239340068,262144 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,11436245093688404737,5073840331182665934,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,14909718315614433439,6677999944792371580,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,12677987961081917595,17546195967513030847,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,8425537827991203714,5606302686228496527,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,6024071895850839633,9234153962636143097,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4432,i,5006689829943108262,3274758102023698846,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5424,i,16544235106911136567,5622076673105970320,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,16157820531234913715,9427526917555693541,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5796,i,5922377382396392747,2018798108385486999,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,16852020834437182096,4702261581297583413,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6040,i,3006339972547820086,16195102099426760438,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11180088134056793102,5531970094248959316,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6524,i,10923509688642866355,13152364385199146936,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6736,i,10806004217763042859,5139776482535153534,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6880,i,11418899955064563329,3559198819878238596,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3904,i,14846549979964895613,4100688285127067600,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4012,i,9137420203228419355,8178713005516886264,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7256,i,9066844340596475218,3408247284320860828,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7308,i,1731906924596749359,1269370127275855145,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5608,i,2457833861750870108,8179273649746910843,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7644,i,7211638978894973724,7178932372065549864,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,13573755082037398409,11039637817792745460,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:14
    3⤵
    PID:7520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,13573755082037398409,11039637817792745460,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:14
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7688,i,4071883544192465744,2188715363000267410,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5636,i,3368606142288473992,5064628536916294917,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
    3⤵
    PID:8672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7792,i,8087828974485808499,15936039216161542801,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7844,i,10431084339378884225,9255619289020972903,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
    3⤵
    PID:9660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7996,i,2293168686645783478,8306682170713360566,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7964,i,13533459058297980422,1413869507098805483,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5168,i,5001402359849158367,9678794365862188812,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:10152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9108,i,11379382130583841787,11681963849660105009,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:10160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8232,i,13307277419894204810,4865251923037700821,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:10148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8532,i,8700805148549285327,7839833922134430088,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8760,i,5406330407561400331,12978782240630850380,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4460,i,7226293840720498290,4298033716580704330,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
    3⤵
    PID:7812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8796,i,12792630442152084058,6699541115317486994,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:8128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8948,i,14511035628953561346,14777332143392443046,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:9048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9036,i,7797732669903444271,5079809633793278472,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:9760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9100,i,4243112074802743956,6950701467270947869,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8988,i,15166883479785180208,1671237577996542674,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9112,i,2123624837201631214,13479071123901855707,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9116,i,2161747890198302753,1480650829333666931,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9140,i,3242001276086599606,11415886571867545093,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9176,i,11763181907283865348,9950715920080542215,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:10004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=2928,i,5027422067299803307,13454514838837941065,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9196,i,15595941521986748605,990901940822713328,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5420,i,4664888533366276875,18048255683996156370,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9236,i,2770286667980116738,5214018545447427934,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:1
    3⤵
    PID:9336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=3868,i,17365552383137231371,1610955089374631515,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
    3⤵
    PID:10072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7260,i,7405230213634922709,4597448894347919796,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
    3⤵
    PID:8736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7620,i,5983683850189624205,12175748323336632694,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9264,i,1138178715565266494,12134613895621487198,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9340,i,13547152626785549362,4758084767032786054,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9380,i,14141280115114080011,70312198325796083,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4508,i,842637087857491643,3666886437155946765,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5172,i,15062037844724102100,16433029677674082808,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:1
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,12104271502339676629,16545640535512591314,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:14
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=4748,i,17709032763325011234,8585615915001716442,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:1
    3⤵
    PID:8348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4732,i,7396830364362327238,10239468113743908907,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:1
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6088,i,7596204621743754866,476672026597937177,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:1
    3⤵
    PID:10212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4708,i,9541192631859402411,1062503252721187931,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10080 /prefetch:1
    3⤵
    PID:8632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7192,i,10521364125858951702,16710644481608887518,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10700 /prefetch:1
    3⤵
    PID:8800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=13412,i,583762102189998409,13931179939396138255,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=13432 /prefetch:1
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13792,i,4880027199206306243,16460711102173436229,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=13740 /prefetch:1
    3⤵
    PID:11580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9656,i,2442548094820493157,17799267924845325089,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:11636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11092,i,15797176892984242654,8954259016735427007,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:11736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9532,i,10545323489777148540,13552396825850728629,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:12
    3⤵
    PID:12536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4932466606081533852,3352196628333331380,524288 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=13756 /prefetch:14
    3⤵
    PID:12544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9528,i,9749990882492008613,12086917063249561789,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
    3⤵
    PID:12560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=6072,i,11901895834797069828,9090556497460457975,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:12552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=13852,i,2689151914696012607,17313471917744771350,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:1
    3⤵
    PID:12568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6228,i,8004455358249609511,12084345394782350404,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=13872 /prefetch:1
    3⤵
    PID:12576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=14492,i,950820725812506894,2406525773931549386,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10252 /prefetch:1
    3⤵
    PID:12592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14504,i,5537524024354381837,2902751429011851992,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
    3⤵
    PID:12600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14788,i,1859499995947814727,11046136509889805384,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:1
    3⤵
    PID:12608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6108,i,11307779783229911632,4471695863521543327,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:1
    3⤵
    PID:12616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=14832,i,4441634700771307285,15427647309865677878,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10552 /prefetch:1
    3⤵
    PID:12624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=14848,i,5686442979374050947,13200870833676900420,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:12632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=14452,i,6534421651826687961,17422322711463218947,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
    3⤵
    PID:12584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=16144,i,2328397351589529144,8007128463894597255,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=16168 /prefetch:1
    3⤵
    PID:12648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=16200,i,9945044012915738990,5497198334242791370,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=16316 /prefetch:1
    3⤵
    PID:12728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=14476,i,11116297689041567576,3605581588307528005,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=15684 /prefetch:1
    3⤵
    PID:9668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=16032,i,2919407155272216548,3882639329102149035,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=15268 /prefetch:1
    3⤵
    PID:9660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=16288,i,16460330811782403469,6689880892332817785,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=14040 /prefetch:1
    3⤵
    PID:8436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10956,i,14913067841753436204,2767456294198033808,2097152 --field-trial-handle=2416,i,14498409019343981543,15379524642935249689,262144 --variations-seed-version --mojo-platform-channel-handle=17252 /prefetch:1
    3⤵
    PID:4268
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3224
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5804
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5860
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3296
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4584
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3720
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4704
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2552
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:5800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:3420
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:5700
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4432
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:3360
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:6156
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6180
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:6200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:6212
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:6580
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6636
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:6652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:6660
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7032
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7040
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7100
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7112
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:3364
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6532
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2860
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7136
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7228
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7268
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7276
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7648
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7676
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7744
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7756
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8124
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:8136
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:8148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:8156
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:8164
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7284
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7580
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7992
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8172
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7492
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7868
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7676
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8448
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:8496
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:8504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:8536
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:8544
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8976
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:9000
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:9012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:9028
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:9044
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:6832
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7172
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:8612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2576
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:8588
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:3104
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:8444
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:8312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:9092
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:2076
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9108
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6420
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4956
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:6600
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:6764
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6752
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7764
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:9108
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8012
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:7420
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:7008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7768
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:9228
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9504
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:9568
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:9588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:9596
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:9612
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9892
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:9952
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:9968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:9980
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:9992
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9332
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:3660
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5700
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:1264
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:5848
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:8288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2904
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:11424
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:11472
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:11480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:11488
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:11504
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:12248
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:9996
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:10428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:10436
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:11156
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7796
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12164
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:12220
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7876
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:10036
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:936
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:12108
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:12200
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:11620
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:12196
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:11808
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:11384
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:10180
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:5264
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7180
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:6272
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:10424
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:7684
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:11528
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:12448
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12484
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:12504
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:12512
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:3300
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:9548
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4600
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:12828
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12840
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:8404
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:12668
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:8328
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12316
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:12392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:10424
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:12916
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12164
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:13316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:13324
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13332
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:13524
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:13540
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:13556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:13564
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13572
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:13888
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:13912
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:13940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:13948
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13956
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:14212
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:14236
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:14248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:14256
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:14268
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:12824
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:12520
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:13688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:13696
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13720
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:11680
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:10488
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:14008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:14020
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:14012
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9848
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:14168
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:12656
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13524
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:9692
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:13912
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:6832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:10148
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:14112
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:7592
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:14284
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:14048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:13712
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:13600
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:11004
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:6616
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:5868
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:7404
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:4220
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:13588
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:13912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:14292
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:8428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=xRDqYFpaTd4"
  2⤵
  PID:14640
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:14700
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:14728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:14736
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  PID:14752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 20KB
SHA256 652c695904bc7f0427931acd1988b101a27a14abebea2ad7b57c2fd725529435
MD5 22929c3aa6317203705c12f30d4fc0c8
SHA1 69997309d8f96560b6de50883a02fef551e413f7
SHA512 d2df1e2f8e0ff994f4a47e27585289edd531d66498cd72b85793a63b66291244aa687713f1bb062721f9350d20120afcec5da536cf0c6278ce930c7079523e5a
SSDEEP 384:ZosNmz8MkZcW4E590LG0jJjk/U0sVfra1yEdq997Hvj:Zo+mYMFELjCJjTZrandQ9v
TLSH
T134A2E1E8945EAAFBC28AF4433C5B691588E5C9F01D37097BC9EB34485CEC691B29850E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 56KB
SHA256 3f9b0c0a209ecaa2f816817bd374578d8ca9acbd0b1de8a110dfddf3c81435a5
MD5 74c2ec4bb46698ce9fddc0e5b0cbfcf9
SHA1 9692779807193c6df10eeb1151f533c670455f36
SHA512 a442dbbac7d346af3e65f78b11802953c38c63b2fbff4c413ac530d2972a1083218b115cc2a471ea5341730d09afc9da395deec45f97a989c8097c0382979a39
SSDEEP 1536:sgBxpaRRlGtjocgEAuoJl4/I4s3yvxs6Kk7C1UveOJ:saapGXADl8LdJake1UvH
TLSH
T11743F17BBE71F6DDE24201C25D132D6407129500B521A9C0EADAD7BE1B2D13377EA727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 281KB
SHA256 1755267059a5656099749ecdb758249d3aa82ff772a2eee7984c8f790e486ea0
MD5 6807e3441cb5ab16ced05f3738a534c4
SHA1 a0f8a063d00b4a1d30b5054e101058bf01cc88e1
SHA512 bcc5db387956b9226e9db584891ef3c7d441830c5a3a54f18813d4d42e5d4967999d875ce1c02a0243edebd51ad67b863f6b2d2b57332e9e03d52528902779b4
SSDEEP 6144:RtSC3aVViRJE96XUKqdBrgebFw6tB6VZW5varQA6zEahv8:Lr3aVVGJE9J6+u8k45SkpA8v8
TLSH
T168542315BE344392F9A007C6BCE6CB4689B796003EB175874EEDAD62FE51C8D94E03C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07c5635f49627f69_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\07c5635f49627f69_0
Size 28KB
SHA256 e9e18a0f0217ad6fd38519bc2d1c4e51d456d2368fc3debe7eacb08b61deba0e
MD5 1a8427a833e4a554bbf869031e12dd30
SHA1 798b55b738c98396e7e4440deb16d05d93398f0f
SHA512 ee3cf9f1ae69fa21b05fae60e0a8aef95f7e8645eab87b15ec385b9ee88e67928c3ba1b4b25df84a5d3f4464bd357a2156886ad89fab4337f1cf497d266b820a
SSDEEP 384:Q79MZrwG85xVNBMf6Mio9iVzldHo7+PTHDR5IibHgCYj1Mf1DFrihazFu:eM3GV0eoMXdIKPTIi8p5gDFF
TLSH
T17DD24165A7D2FAB9CF2323F90212C9627631499C2DE7921322F2F6251C9B9DD4D49C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ba318c35c0ea617_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ba318c35c0ea617_0
Size 279B
SHA256 501d83af9ca11dd200a035c51ebd992e6b3b211d4b0c6a772e0e61e668f1eda8
MD5 8377cfeddf1835b4c9420046aae48fd7
SHA1 c9c3566fc0703d9b615ead376873782d465b58eb
SHA512 833321f06f413a23a7c6d8cd42f6790c8c752c0a3eafbbd17280ced9356523e5cc222a3384c0b1f2ed3a24e8beedc0d6d7ab09b7f2f39632ca8cfc05744018c6
TLSH
T167D02BBBA9107C00E91FE8F54B63505EE262401C045482E5D00AF0DEF085CB62415356
MD5 SHA1 SHA512 TLSH

Submit Download

10aab25135d21943_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\10aab25135d21943_0
Size 298B
SHA256 9b2f959ada1e96d4747da6ea4740ae3fca5cfae36f58718fa7ec66d4e8a16cf7
MD5 c23e9c5805f7ba932d06aa845c30af7d
SHA1 7b9b00556deda9d6a258ef3f91e2bb9a1102e0fe
SHA512 a4ea35b66545061dc415151c02b18993697149ab20993a78dc2c927b3b62e1b62683c142b7a76e49df3948608a521bed18bcd88835185dd9cf38b42769463e88
TLSH
T128E0C2B389119850EA4D4BF1DBB6668EEB82C09C4CCD82A514C7C2D322866E529844A2
MD5 SHA1 SHA512 TLSH

Submit Download

12c758bfe28191c7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\12c758bfe28191c7_0
Size 75KB
SHA256 57f23652d9c27a2b193c055bf59491397da6429f96bd5f396eabde320bcd0030
MD5 ab1a5c8c487313d905e4506fb7a8f018
SHA1 25682ad4e2a2f98d3fdf321c823901826bbed0ce
SHA512 3cd67d39949a9bccc7dade1c753b20861a70ecacc796712e0a7a2497e517704b4d7d5d558b470b3591217e2ba1e05aa53fbbb36dd7a0d34a0d655d85564db049
SSDEEP 1536:TRtqM5wpNXDxRzMpez6Z743BvDCxEFWX:TRtipNlFCezyGvDEEoX
TLSH
T18A7363A5B790EF66CB3357F842128A767731845D2ED7921732F0E2351C4E1DA0E6AC8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53740f1aa4a91137_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53740f1aa4a91137_0
Size 2KB
SHA256 b46a352039eb8eb88eae31b5d72c3115767fe6c73d553dc15a0dea4e4890b6bb
MD5 cec82be8327fd114421eca3dc9fce13d
SHA1 b57d29595110118d4066921f622b5ff6d42e44c5
SHA512 ceabbb943fa6468426db1b21aec6688b41823bb5319ba90d20800ab752334763f159fd762d26ed5ba6cd04714d0dff3e56366f9e07bcb78e0e21071d99b8497e
TLSH
T147415392FFB85C04CF36ABB440A6D515A3B6CA1296C7B763604472583C5C6E10D8550B
MD5 SHA1 SHA512 TLSH

Submit Download

53740f1aa4a91137_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53740f1aa4a91137_0
Size 2KB
SHA256 3d5526d6731aaeac252b7c596238f905f81d82f8e1c21408f548eaf8fea26751
MD5 d65e1e6868959529698053e6a228c29e
SHA1 3e9b30a8e4ae6bcfd4251200006a9e0c4b85e865
SHA512 64cba28e3a9cfeba50ce5a93970b547e8afae19290f70230682f6b6f8ce09197ac5a723110f09054db801771df331df8bdb0894545e750d581e3c626dfa09f1c
TLSH
T106419492FFB8AC04CE36ABB400B6C815A3B6CA1696C7B7636048B2183C5C6E11DC250B
MD5 SHA1 SHA512 TLSH

Submit Download

53a5eca1a554f76e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53a5eca1a554f76e_0
Size 44KB
SHA256 5d739d09e8ec580251da79b06d39b9eef657fa16e259f57a453c3754bacd9b42
MD5 fc82862548d5e7896d9620f2c1e3dbad
SHA1 53c31dd2b9f64867205e1499f6331ef7496e83e9
SHA512 fd109a8bbbf1666fe9d8754cc408ca4a593117a4f1ca080ad00bc95fa7b92a44f219ed119918ed537ab6a78c4913e1123306a2581a47bcb7b786af885928b600
SSDEEP 768:uq2g7oT+MEsvvp123TibQnaxiy9lmgVUNzskzIXB+oi/2Bhd0qHCSgKk:uq2PNEcvp1262i/kzOBhWTK
TLSH
T1DE13D864AB90EE19CA3713F49162CA23673244483F9BD31771E463262C4E1D54FEAA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f957dad2bca2cd6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f957dad2bca2cd6_0
Size 9KB
SHA256 8795e0d8ec6b96097a23f45f889fbd3393fd8d6af80bdbf7fdae9b73fd076d15
MD5 42948ae5c29116cf3e279592017bd139
SHA1 3c5a2e2a02547bfa973c96a6e423ed402a61e4ee
SHA512 fcb64d0b76695d153a5a0de909e9b93ce4eb4b66a0723688c4a45d27d04857f354239e4bfc26531c292fec004c881a2e44b7a447bc2d29f94f8488dcb4c283a8
SSDEEP 192:8x+aNPUe7B0UShRdInEbhnSXoxsDTOjejKa9IXvPPvbgzpMd063bGp9YJ:iFNMe7B0UShXpbRcoGBhiXvPPvbgzpMJ
TLSH
T14F1243C6EB90EA89CF3357F94161C6A27731459C3A83D32761FCE3282C451E68D9AC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7094be46a95bdbf0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7094be46a95bdbf0_0
Size 9KB
SHA256 07bdef28735e0598a6cd5d8c58da79a7e6ec64d9f242579b75e28a02c3d9c9cd
MD5 096eaad2996f3a811800d9618c040153
SHA1 014e41ffa79ce82ec8d494bb0bd05c5ce83fb20a
SHA512 f524be04b780b3f848211566f673fd620f386e23406d77265feaeb008626f44b9ad2793d5e16b485b157b0f6258faa8c6e59e3235627da31127f45e4da778bb6
SSDEEP 192:fH4Ii/ovNBpzyrCFvUW8ZM92zgI6G0MHaeGmZErJHbp:wIDpzyrChUW8Zp8I6GN6eG2ErJHb
TLSH
T1301230EA9A536AF3D4B44A7A00C3D32EF62720D86ED66107872570A178137D558FCBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3eb10ec8b29c6f9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3eb10ec8b29c6f9_0
Size 322B
SHA256 bfe25ace8d765c732b83411569744cbc321e95483470a0102b66b0905bc7c617
MD5 f10f0b501a38ea4a00ac2c9234fb0749
SHA1 139c9ae74c47a383b331cb21def071f019a96bca
SHA512 c39d6ae19d39d106aea8443036478b6a57c92cbf95a2ac97a90d8b92f8847529d3aa979d108a7db94cd86b4cd6335760da65b40939964d5108e958c5bb21bd7a
TLSH
T194E07DDF95007E00CE2659F0D976D689D716CA844C9845EC703AC5675964960029A1DB
MD5 SHA1 SHA512 TLSH

Submit Download

ce024f381d954153_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce024f381d954153_0
Size 9KB
SHA256 d5961dad08b5e44febe06a28809fb6edf135fdef5c8320456c20b38a253c5871
MD5 40bb2d72bb51e08f3da4ebf6a7aff399
SHA1 863df26ea71802ed9933831ddf1e4acf162ba4f0
SHA512 b661ddcf5cd88117b91d2a323212e3da088a138f0da8b0ed32436cc9711108a0916c3b6b6ee775e1987135b23eeee5c181565f983a79dff8960c41900cb02a91
SSDEEP 192:/9ZmTTypp3B1mLQwQ5sAgFXifirWlVtFYLLpNMN7EPvvPRR0hr:vmfqp3B17F2Xifir+qPPMJEPvv5
TLSH
T14E225145A7E2EE2ACF2B13F54251C967B63545086ED7C61F30E0B7381C9B1E7098AC8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1124286e33d5a45_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d1124286e33d5a45_0
Size 3KB
SHA256 1146e29ef869c57c3bcd8ab9fc09abf2795982bbe61fa3145647cc53435c09c7
MD5 4f7340d4c89bd0c87f0179a741c0a2cb
SHA1 f83c6411b51455cdab7d5ec2b09dd62c219b4ab9
SHA512 69b0b721cd3bc8ef3aee6695c39b69931f91cb5c43df4c165047af296128111ce96ee4e251a319295be9a4b8018a001f6ad80850b3fc5126d7a16b316147319b
TLSH
T1B681DF41FFC4CF19CB2727F00166C672A336448E9ACAC62771B856292C5A6C15ED6D4E
MD5 SHA1 SHA512 TLSH

Submit Download

d2868483c421dbab_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2868483c421dbab_0
Size 272B
SHA256 e6f63444c7e253fa1b5e955bb880c8fc12b3b1d8c104b679d1f934cd7ce26a92
MD5 823223df4169f60233ccd60fb0469e33
SHA1 40f7ecd363c02fd7717b1c4e27a5a9bffd0356ce
SHA512 241ebaafc56c502a42146b1c387297c3edf411cb4e0f1b6428b2afd9f8cac4c67a1191592095bd74b1db79c5bb95bce3657f8e08601d3c1760c77efe5bfec229
TLSH
T12CD02B5BBD144C85CE6567F0DAF9596E4292578844C8C0F40146D45228416726529852
MD5 SHA1 SHA512 TLSH

Submit Download

ed07ac08a6728eed_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed07ac08a6728eed_0
Size 2.5MB
SHA256 2f10d8b3001ee9138fd023ab0af47385f7944f8013a68b2a059679bf285696de
MD5 4c215ccc2473add904971ecc51a3646b
SHA1 b59e0323327cab50594bd9a679f41c1e89397ff1
SHA512 162edb015295a0415ded6bc10245cc480dcacf5d76fb5151650ed1b42efd9247a02ab697d7940e0617272ba033e852294c0a7d116b76f601ad7a3c0c99221bc7
SSDEEP 24576:kDvOKuh1bcobBqKUQ4bsjyvTTvQID8eKb9ECAYjY22Neowrbw0u07+N:dN1zVqKksSTvQID/0HY2Tow
TLSH
T116C5C68193C47B6ACAA653FA46539EA3F331809D3FC3D30761E0DB282C5D2E54E59E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a7f45e8e37db7c19c825d762d2d31cb12443f41a93b530762a720b8704805be
MD5 7d4f48cb4ca193b1b05fdf1ed9e8f6e6
SHA1 334c1819dbe15e237cd1b6d0962cb0a998e30d99
SHA512 8d1a538c9e70f85f53d46debd8dacfdef36501fd9d26991ad73ada9b063b734c919dfd2a001aba69dec27e9508b4ffae22afd0aff0fb4488a3a8f4f760784dc1
TLSH
T1E051916383E219C0F7A3A6BAB2F42B553BF0A4AF44476A1343D06D740802F4ADCDB583
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bcaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bcaf.TMP
Size 2KB
SHA256 3f261a4ec03dfa961c78ab8c74daf86abee6701e3860e4afb48a606c46afc269
MD5 af255fb5a781829b3ded2f706538d152
SHA1 e19eccd964cf460bd13419e5648cc4dec59563f4
SHA512 ab80f133f47da5653a79334cc863d7b94bc215fc6749b1897a9bc3821968725fd5a560d712a1e623e3096071071f148ba9897fc8de761c3ef09cfa7ef51dec9f
TLSH
T1FE5170A383E21AC0F3A3A6B6B6F06B5537F0A45F440B6E5343916D744842F59DCDB243
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e8025af7d79d20856f598e013559e3f5bee52342f30e6f2d9a1108cb916e97ef
MD5 2197c19799db1ac91e5217edcaf29760
SHA1 7ee57eb20fdecf1303754e4edc5a64853ac5a68a
SHA512 290524fed642d428042056227ac972683166d2633c1606df5a6ae00a0d99ee6077dd80d5c23ee39b77dd14643952ae420938d0d7fa7fd6008ee43f9188e32c81
SSDEEP 96:DlOuMEVuNulufTVuhBjB6jhnczL/4u6uJucTZwUufuP/x:DooEgIEBjB6jhncH/4NwT5ekx
TLSH
T1B4A191F3C3D8862DC91156F4EB143E2FDE2D0D6483683D2AC9E4AE1BA3E6471D24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0d4b852906461b90d51b7424b234c1683440e9b2f8765078084fba5378ce9326
MD5 2977100f24afe4cb431c7f5cf2a49ecd
SHA1 c6630d9e7fc6b512dce675c22b2a9e9552d5aa09
SHA512 6df57deea6fb59a11f386eec648f130504799736d7d1baa14989876c490126342fc7410f2bbd5e16e3633e35ae468a5fd96c5fb0efbbb4407606256d162f9e15
SSDEEP 192:DooEgIE5puNh0jB6jhncH/aGXlKkAcaIkR:DooEgIE5puNh0jB65cH/aGXlKkAcaIkR
TLSH
T1E1D1AEF3C3D4822DD81156F4EA143E2FDD2D0D6483283C2AD9E5EE5B63E5471D245A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0dc79b2669ee0a9c923851806588fa427cb6f50346dc31983619459ad6a673dd
MD5 bce56b0e27fe826cd0212dd1be5750c6
SHA1 f0e14395918f09e89e032c924018c6a84ce1ba09
SHA512 f85530ed5be4ce53c52314306213b022a7ed73aa58e73c16a289ea2e6d61102e246ba2053b134de5ddedb8d720810a124cdf56a8a91102e1d433a92136e4d134
SSDEEP 192:sxRnRMCZ/f1sKw3AtozoA8pfjZ/g6+WNlt6JYMEgFL/HGBIgDKLJ:sxRnZZ/f1sKw+V/5eJcAEm
TLSH
T18142C716AD28997B8CC7D25DBB55BF53E2F95032A1901E48A7FCCB0C10EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 37dc9a36aff0685023f6549eb85bb6e557218f0adeaa23f2f5f04e1c3314272e
MD5 00e42d9ac9b3886ccccd6e85152a58a6
SHA1 66635476ac4d20469c4c1465ad326e3fa4155afb
SHA512 873cdf7fde3b9e02f0475fa19cd5130009a1f09e265dd3091cc4b7800ea39b449fe702c7fcf6cd772c54176f4757b0061655beb8d1c05cbdb18a2bb038157e41
SSDEEP 192:sxRnRMCZ/f1sKd3AtozoA8pfbZ/g6+WNlt6JYMEgFLZHGBIgDK2J:sxRnZZ/f1sKd+N/5eJcAyn
TLSH
T1BE42C616AD28997B4CCBD25DBB55BF53E2F95032A1901E58B6FC8B0C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9a7622b164024b689c4222bb323a65ce73371dc073fc2af047463ff6f9e261aa
MD5 f2756fd3bc98085d38761243bc6169f5
SHA1 8a7ec3abae396f0926ed8a5d4367ed7437e1f1fc
SHA512 fd88beae549cea6f1950f8e7566540a482270a05541337814926090354e880b1aa7fb4f86108758d36c820a52c90a5b478a98a83131544d670f2d4c03f89d84e
SSDEEP 192:sxRURMCZ/f1sdd3AtQzoA8pfsZ/g6+WNlt6JYMEgFLZHGBIgV2J:sxRUZZ/f1sddGk/5eJcAyk
TLSH
T12B42C616AD28997B4CC7E25DBB55BF53E2F95032A1901E58B7FC8B0C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e3ee54d17383675495c0401795135a48adcf83e5269143c1758af2dc44ae2bda
MD5 815b16fa9d96a0285f9abee7cf2c04b7
SHA1 ca0c246088c8b27b7f425796f9795171d07ae620
SHA512 b614d54d4a7505a96e97fc2f73ecd03b2b76a477068c2e2d7ad575f7b53e661247d5656fe6cd49a63d3a3eafe1838a2d2ec839e33578c26ff68921cfa68604b6
SSDEEP 768:K80Ep67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuwLWTroL06zj:K80EpSE7FwWgNhfVNu1jaXgWgLDzj
TLSH
T1DFC2D87B740CCB7E4F804ADDAC197E9B6DA802CB96D8CD8047FE951C02C6BEA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 30fdd9500d2d87b0b4e39399202f602f33c1c77500549dd68048222db867a5e8
MD5 b49d2df799ca9a9a68f534824407f2dc
SHA1 507880a7c2bf6de791fd67c563ef35808592f0b2
SHA512 470bde2907a8a87599b3d0c1e0555311696c3032aab2150690314ffecb0925d2dbe9eb0348cabd77c1bcfea71b60a6ba39d1aff11776990b56db21e6ad686062
TLSH
T17F412300B27A12DA3D3D7A18D3758C6AC6C2B26A7555F46FBBA905610F37E024CFC9C9
MD5 SHA1 SHA512 TLSH

Submit Download

c3ee2616-f093-432b-b678-a1b499a8381d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c3ee2616-f093-432b-b678-a1b499a8381d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e5b45e9cbff17fb99ba8182b440b8bfc308c2e57d347ddaffade334205e7891b
MD5 499ef8a9476385871dfc83e8366ffdd9
SHA1 8b82e3290bbfb6508b07ab847d5d9a0546b50f86
SHA512 3605baf966982484c7978d329f26896c2c56f2f1a0689b7e148b508c5508f8c1af67c591b0bf5c798580d87f663ee37b7d78b2d7f8f815df9913ceae30cce2c4
SSDEEP 768:Prv+4UNbde3JE5VW+LeSFOUyUtKmxX4fouOToPvB2thtA9VAgLeVH1Sl1:Pbsb03JEHsnnwthttiEH1i
TLSH
T11B13CF72A8AC8E33DCE6E298710B76932FF4512359840F88DDD95B4D0657ADE070FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f0adcd513f342c6129fef9a89749f6a5d7e2eb98bf2f9e37ff3355a3ab01f453
MD5 b9db28f27c81a3890b55f01e47e2f240
SHA1 a8dcf8c691bcd3c4d1d063376ff3fddba570fc42
SHA512 1fcc3236ba1c4004ab6e6194279ed0efe61f38e3be2c675a28d7c5b4601d321042315d8b2b6496c0009ec47164c400ff033baac6115331f966b95babd8332c95
SSDEEP 768:9rv+4UNbdf3eEtVQ+LeSFOUyUtKmcX4fouOToPvB2thtA9VAgLeVH1Sl1:9bsbV3eEWsnnwthttiEH1i
TLSH
T1DC13BF72A8AC8E33DCE6E298710B76932FF4512359800F84DED95B4D0657ADE070FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 bece2e6813d2ee9be916a7092612e78da5919cf52be52598e9da2eccbaea75f8
MD5 b415e914fe571981d73231da6291621b
SHA1 30211c056ba024c74edd98624085b19bef95d9f4
SHA512 46b955a31844871d8156ed7e477b7e9f26b2dfea1ad34a8b40113ad573107f5532acec2560313972927394092455749151e1cf4eb1569a40fecbf3fe8d78a3e7
SSDEEP 768:Urv+4UNbdb3eE4Vm+LeSFOUyUtKmiX4fouOToPvB2thtA9VAgLeVH1Sl1:UbsbB3eE/snnwthttiEH1i
TLSH
T12C13BF72A8AC8E33DDE6E298710B72932FF4512359800F88DDD95B4D0657ADE170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 938feb5b6ad114fc694b61918ba78cd4a2590643705954111bdb4224024f2258
MD5 0faa692933a5f79d6c075e66cd217637
SHA1 64ac6be7cbe42356e198a6721d6679c9c65b7f0c
SHA512 6d1f7f6053795583f9909bdf47519ae437b0e4aba071c3331c29ad380f230a30ef842be490cd8b29ecfed86bf43415b5bc03b460663d1a2f665b113f05aa2547
SSDEEP 768:wrv+4UNbdN3eEMV2+LeSFOUyUtKmcX4fouOToPvB2thtA9VAgLeVH1Sl1:wbsb33eE7snnwthttiEH1i
TLSH
T1A513CF72A8AC8E33DDE6E298710B76932FF4512359800F88DDD95B4D0657ADE070FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4ebc41f662bfc9ef8154908acc05f8388757a190891c5853c93fd7ce1f45ad1d
MD5 459ba61e7903c29f2ac3f713e4bf3d3a
SHA1 cd48277d342e79cb29df01521e713e5b9d906bc2
SHA512 c1f495ad1c3f019781157f80266ede369ff82031846446c670c74f160f3c7853a7e76ab7bde0ae4b9b0cdad4cf5f0def3e0d4fdb0f981fe6ab783852fd032b44
SSDEEP 768:lrv+4UNbd/3eEnV++LeSFOUyUtKmGX4fouOToPvB2thtA9VAgLeVH1Sl1:lbsbZ3eEYsnnwthttiEH1i
TLSH
T11213CF72A8AC8E33DCE6E298710B76932FF4512359800F84DDD95B4D06576DE170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 44726aaddcc1f6c7d80ae2982b8d15804a130969d631fe6ee3e154bc36ca9dca
MD5 30b051a69b256b5168877ba2c40271b2
SHA1 7306fac29f73a32183fcca95a622446501a2c5f4
SHA512 265ec5cb6ad9250f7bcc0df3d7ced6e173b25e0dae98dcc9f5bfed931d9e498af5dc66a09a2c2820096f34ab7a96662431bf6ca6092911f6e6e3a9dd92e7fae3
SSDEEP 768:JFZrv+4UNbdf3dwgKEXVLc1OUyUtKmNX4fouOToPvB2thtA9VAgL53DI:xbsb93uEKsnnwthttiFI
TLSH
T19D138D72E8ACCE7BECE697D4B20A76836EF0016389C44ED4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e7c7609fe6dde41cccfec68a5a049876ceb3e43bf04576ad2869d5ba24cd695b
MD5 970438d5884e2f7a7e98091a4ef5224a
SHA1 005aaa4789f4ad01e2a0672cb6ebcd7885d9ed44
SHA512 6fd6e0e6937816d8d9f4a9f41177d6d68cfb4a3605f3f002fd1ef4654f36563e947b8eb1eb411936e51fdbb28714a5517142afa8f7346dddc3fbe2c372bf8e2f
SSDEEP 768:JFhrv+4UNbdV3dwgKE1VJc1OUyUtKmfX4fouOToPvB2thtA9VAgL53DI:pbsbb3uE4snnwthttiFI
TLSH
T16A138C72E8ACCE7BECE697D4B20A76876EF0016389C44ED4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f58a612374fb13564dbdf6be1f8c30ad35491ca82d181d2f80f97727f9c17dcb
MD5 cba357f1462b57cc07a46dca3ef1f887
SHA1 fd38b62a420906a074aab5f01fdfbb92a73265d6
SHA512 5d21cb87498e58e6bd7e8f8a24239f9123e1c5093272f697c027e369ff3fa2123ecab85f8b670bf84e936a674e1cddf7caed3f3af75218c2f0e960a558d0d2eb
SSDEEP 768:grv+4UNbdH3Uc+LeSFOUyUtyX4fouOToPvB2thtA9VAwleVH1SlX:gbsbh3nsnnwthttgEH1Y
TLSH
T1D303CF32A8AC8A33DCE6D398710B72572FF4911396900FC49EDD2B4D069B9DE430BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 44c27413c7d2554a042d3dbccf80884f89474670af3d2f51787fe7dac7e0edaa
MD5 e008312d46e83edf717106f6a1e099d0
SHA1 d861cc0f7a6d3084eb6eefbaccf0f0232a96dd82
SHA512 a131318de7eab741f7ac6dc8dbdf500613f02da1e37478a38aab41a649e861cd03e0e138a5adbe4d1b97cd9b6aea1173c991a84cb39b275dca683a82ffd2f872
SSDEEP 768:JFyrv+4UNbds3dwgKECV/c1OUyUtKmGX4fouOToPvB2thtA9VAgL53DI:qbsbW3uEesnnwthttiFI
TLSH
T11A138D72E8ACCE7BECE697D4B20A76876EF0016389C44ED4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d9093b6f1ccba9924300d61485d2bc9c7598d7e86825d0b4d971aa9aa159ceba
MD5 54b3d1c96c302b09d0b4bd8ddddedfe5
SHA1 c5aaa9db4603020dee24687117df99c15a28b2bd
SHA512 2ebe185329dfe89d6b2c2297819a5fe6f484bec7dcc5a41e7208a81fbbb8a8bc215bddce67733722174001d97d7339268191a82d1cf388572b8c6308e906ea80
SSDEEP 768:jrv+4UNbdw3JE4Vm+LeSFOUyUtKmaX4fouOToPvB2thtA9VAgLeVH1Sl1:jbsbq3JE1snnwthttiEH1i
TLSH
T15F13CF72A8AC8E33DCE6E298710B72932FF4512359800F88DDD95B4D06576DE170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7e984c1e6c1ef694ff90f258fcee2ca065babbd4090fc4757973b126c93816f4
MD5 dd91a65479a6f785f4773d34f339df94
SHA1 10a4f6cf190b42571ee098b5d098794ae6c324fd
SHA512 af42ddf81ad668ea65ccbc248e5b1c4fd8bc845719aed6d05fdfd7e14638c31c6b034e20fd4a8030e8519962e6df495a244784724697c0e30dd87832d3f260c9
SSDEEP 768:JFWrv+4UNbd13dwgKE0mpc1OUyUtKmlX4fouOToPvB2thtA9VAgL53DI:ubsbb3uEIsnnwthttiFI
TLSH
T1D7138D72E8ACCE7BECE697D4B20A76836EF0016389C44AD4DED95E4801975DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8289b6cc740066149f254bfa1c2155c0e8f9a6bfbf6b0c82f0cc819970738b32
MD5 3c587a14fa26f23b1646b81870085e00
SHA1 23586b5272d4333afd00feea204575250bd7b53f
SHA512 bd17383b22d0def7ce3d15523003cd0ed5b220f84fa43929563a97be2170f89ca3ec5d8b8be450015f86752268cac02c4fc6dfc369b4d827c674f6334e51933e
SSDEEP 768:JFxrv+4UNbdW3dwgqEqDvc1OUyUtKm/X4fouOToPvB2thtA9VAgL53DI:pbsbY32EJsnnwthttiFI
TLSH
T1FF138D72E8ACCE77ECE697D4B20A76876EF0016389C44ED4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 388f0170013bce9e8352b34c96bd1a52de983dfa1c084a31c6e1dbbae915ab2b
MD5 3ec722caf8de13522e0628242d75eaf7
SHA1 3e8379ae1aa6b55c332a829ca5bcb06546649a02
SHA512 6a7b333120e093c0cdb318c4540adfd0cc2d1f463d01598819363285448e27f38865f29f4e3f4a64577a62478059cf8b419e07ff9ee9a9e513625daa4a57fa72
SSDEEP 768:1rv+4UNbdI3eEDVu+LeSFOUyUtKmGX4fouOToPvB2thtA9VAgLeVH1Sl1:1bsbe3eE0snnwthttiEH1i
TLSH
T17113CF72A8AC8E33DCE6E298710B72932FF4512359800F84DDD95B4D0657ADE170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 c048ebc5c8ef7de0d83f8169dd91707af3731a4183cab734ae73043fbbaaf2ad
MD5 9938dfca0dab38cfe727ae3672999f0c
SHA1 f59dc4c91f5e30b7618c896cea9731ceb9e6e4ba
SHA512 08804812e63840f4124c3e6c8234a2f0dc37cc9fe2f112c9764c9fbd49d7c852c72c7c75c32e22e65b4a06a7178086f4c33c17e76265893de0d1ce691371c55a
SSDEEP 768:JFRrv+4UNbdE3dwgXE3V++LaSCIjOUyUtKmbX4fouOToPvB2thtA9VAgLeVH1Sl1:Jbsby3bEfsnnwthttiEH1i
TLSH
T1E313AE73989CCA77EDE6D794B20B72936FF4116388804B94EAC95B4C06576DE070FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ae580b62e8a85580df973ca33e15e46a22227208fbfcd9366449ca110a34e466
MD5 5736d387722d81e79469b93f4ffb514b
SHA1 55d451ae7b6a5b34d685c190e18a5de682e24839
SHA512 83286221abdbfe91ae539cd1d45b2d581cfec281809a30a4af9a904f233245d426908c2f5b13c9e3cffcc3e1ce4229d7b4dc60d1f8f1e34ca9efa6c9a016f0eb
SSDEEP 768:Krv+4UNbdT3JEqVA+LeSFOUyUtKmuX4fouOToPvB2thtA9VAgLeVH1Sl1:Kbsb53JEBsnnwthttiEH1i
TLSH
T11013CF72A8AC8E33DCE6E298710B76932FF4512359800F88DDD95B5D0657ADE070FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 aff4bd7cc1b22d63858b577f06b483b571c9fd9071ddfc70bd15a50f2a86c5ad
MD5 b8b28353ee1b990c205437736e14ddd6
SHA1 bf56e10d7e33833b80a71ae20afc775a7852f472
SHA512 e9c28b95634b76f528dab2e133c28bcb5e16a6280d417571d8d63d63dac5f776efd60cd01decd504245c2fb67b62fb2f68e6c5d02ee5aa93d67db8865f5179a2
SSDEEP 768:JFdrv+4UNbdC3dwgKEemfc1OUyUtKmLX4fouOToPvB2thtA9VAgL53DI:FbsbY3uESsnnwthttiFI
TLSH
T1C0138C72E8ACCE7BECE697D4B20A76836EF0016389C44AD4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 90cbf6e10ba88723b5f01e0734d3f9aa4ea5180289b55f827ac3ecbef6eabc81
MD5 454bca61e86ecdf6cb6467e2d4ee777c
SHA1 74dddf6772aea52c83512f6153ce2a3747e4aa8a
SHA512 cbddd9e7781f3f09df12e2873adf1f29d2d57c5897d807087c1f08985b0ab54cedde3176cb86035da118036c8588866629cc14f0d2fc566ecdb1983b5da72308
SSDEEP 768:4rv+4UNbdK3JEmV8+LeSFOUyUtKmxX4fouOToPvB2thtA9VAgLeVH1Sl1:4bsbU3JEosnnwthttiEH1i
TLSH
T13013CF72A8AC8E33DCE6E298710B76932FF4512359800F88DDD95B4D06576DE170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 615dcd1259ac3bdd09fd9f7a9c672ef22692ae3c0bfba71127660e2b9c169dbe
MD5 dc31040fb5e778ccb9e667f01a7fa82c
SHA1 100ea8b6eae07d1139c01ff722517ab0f77f840f
SHA512 bce8ab15a18f905186d70041264ca9180efa1228e97b9f06e98b925573f52e8c48c70ce4835dbfe48003733fae383ad5116d9671442666dc2babb064e3463ffb
SSDEEP 768:Mrv+4UNbdD3JElVQ+LeSFOUyUtKm3X4fouOToPvB2thtA9VAgLeVH1Sl1:Mbsb93JEzsnnwthttiEH1i
TLSH
T1D713BF72A8AC8E33DDE6E298710B76932FF4512359800F88DDD95B4D0657ADE070FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 75066dc75f8bd294449338ea73317bae0d10a1d00316607557dbfb7ae522e7cf
MD5 5f374385282036f27ce56aeaa27b69da
SHA1 b5aabeeb881a5b827baac4d31ababb1cc06e2300
SHA512 640f892038695ebfc0b94f5f699e4eb256fc2355bdab9a5e4884d94c87cd030a069bb9b79c33b588c688c3fdf5a7b1751719a94cdac205e48fc609d768c6f4a4
SSDEEP 768:JFLrv+4UNbdd3dwgKEBVZc1OUyUtKmbX4fouOToPvB2thtA9VAgL53DI:DbsbD3uEYsnnwthttiFI
TLSH
T14E138D72E8ACCE77ECE697D4B20A76836EF0016389C44ED4DED95E8801975DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 478821422592d58d3f26e7afb525aec7d8404edfc9c3e3f878bccff6eb48d261
MD5 ed6e2397579b61caa3954344b3ad3018
SHA1 8e27b606e48f346b1689d6a054a22d567bba75d2
SHA512 7f51cf1bd288dc338428015b4f3a53af880f77bee8e22a5f0499e9266fd9963d082ebc69010da8d3dffef6cdd0e9b6630ab938890610bfb90165a8cb317c9881
SSDEEP 768:JFSrv+4UNbdP3dwgqEXDVc1OUyUtKm8X4fouOToPvB2thtA9VAgL53DI:6bsbp32ExsnnwthttiFI
TLSH
T193138C72E8ACCE77ECE697D4B20A76876EF0016389C44AD4DED95E8801975DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 56cef602adc6274e575c9836985b479b4acfca90783e05d4b69ffc0ae146368a
MD5 1624e69446d6774f5115a6da330836bf
SHA1 2b38f52acf27eb64612039f9a8d724e652c5a2ae
SHA512 281d80852844d96a5746184c9efdd7e1ece37b332e79fe497d06b6db362682632c811366299d93defdfef093baa8de8000d7f2186ab280aa084f523d4b423785
SSDEEP 768:JF5rv+4UNbdN3dwgXESVY+LaSCIjOUyUtKmlX4fouOToPvB2thtA9VAgLeVH1Sl1:Rbsbn3bEksnnwthttiEH1i
TLSH
T14E13AE73A89CCA37EDEAD794B20B72936FF0116388804B94EAC95B4D06575DE070FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfdf441c-1a95-42bd-8d9a-713f6c2e64b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfdf441c-1a95-42bd-8d9a-713f6c2e64b8.tmp
Size 39KB
SHA256 be092527a8f34a9598d6fa2cbcc4b0ba7fec4104903a531d92e3b783cb476fbb
MD5 1bb0eacf3333004284c0c9c66e2bd368
SHA1 75dcbf7ae1e227f909f441a8e4e22144d69562dd
SHA512 dffd0b61306048f4b8570168a3c0ef9d31aae7a18ba5875876219682bbb1d9436e47e281caa70dfed9a9e42a8601184f8bc7a994be52add326fcc6dbe2598d39
SSDEEP 768:Wrv+4UNbdH3WVS+LeSFOUyUtKmiX4fouOToPvB2thtA9VAgLeVH1Slo:Wbsbh3ZsnnwthttiEH1b
TLSH
T1EC03BF72A4AC8E33DCE6E298720B72832FF4516399800F84DED95B5D06576DE170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62aff8d3-c50a-465b-baee-5fac8587a674.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62aff8d3-c50a-465b-baee-5fac8587a674.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads