f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4

Analysis

max time kernel
9s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
Size 5.4MB
Sample260801-2p47rayfjf
SHA256 f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4
MD5 7810e041cd14b785b0964de59c96a348
SHA1 9d06302962a68e9f78098ead46e6699cc3c13b85
SHA512 a8476388b7d9fea676c098b074616bbde1e88a67d2cf0cf9c73fe05f35fdf430e9ff5c6c5eda8a37452d747caba2de9a0931c4c0e6cf953c5db79a5f2f94558b
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uJ:AsTICteErownP0oTcMsABqljky
TLSH
T16B463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3r2d53.exe	h75jj20j.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4la5yj.exe	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4la5yj.exe	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3r2d53.exe	h75jj20j.exe

Executes dropped EXE 2 IoCs

pid	Process
3300	h75jj20j.exe
4232	h75jj20j.exe

Loads dropped DLL 23 IoCs

pid	Process
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe
4232	h75jj20j.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\6k92jrsj\\h75jj20j.exe"	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\7dvbwavy\\laqvinve.exe"	h75jj20j.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13905	ifconfig.me
14683	ifconfig.me
16160	ifconfig.me
1817	ifconfig.me
4284	ifconfig.me
5096	ifconfig.me
8797	ifconfig.me
13202	ifconfig.me
15684	ifconfig.me
1150	ifconfig.me
2392	ifconfig.me
3309	ifconfig.me
3808	ifconfig.me
5791	ifconfig.me
13358	ifconfig.me
583	ifconfig.me
13378	ifconfig.me
15426	ifconfig.me
15663	ifconfig.me
16875	ifconfig.me
17322	ifconfig.me
17932	ifconfig.me
19180	ifconfig.me
8216	ifconfig.me
10977	ifconfig.me
12855	ifconfig.me
15336	ifconfig.me
18809	ifconfig.me
18942	ifconfig.me
19726	ifconfig.me
19781	ifconfig.me
345	ifconfig.me
568	ifconfig.me
839	ifconfig.me
3269	ifconfig.me
3334	ifconfig.me
626	ifconfig.me
982	ifconfig.me
5505	ifconfig.me
15069	ifconfig.me
16360	ifconfig.me
16599	ifconfig.me
587	ifconfig.me
1405	ifconfig.me
10275	ifconfig.me
10468	ifconfig.me
16675	ifconfig.me
18394	ifconfig.me
642	ifconfig.me
1186	ifconfig.me
4516	ifconfig.me
6272	ifconfig.me
9763	ifconfig.me
15529	ifconfig.me
16895	ifconfig.me
18183	ifconfig.me
258	ifconfig.me
388	ifconfig.me
9275	ifconfig.me
10818	ifconfig.me
13649	ifconfig.me
14812	ifconfig.me
15083	ifconfig.me
16612	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4436	cmd.exe
1444	cmd.exe
6116	cmd.exe
6848	cmd.exe
6244	cmd.exe
3096	cmd.exe
5864	cmd.exe
5896	cmd.exe
6400	cmd.exe
6560	cmd.exe
9148	cmd.exe
5360	cmd.exe
5340	cmd.exe
5900	cmd.exe
12036	cmd.exe
5956	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1964	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3344	1132	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	87
PID 3344 wrote to memory of 4436	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	88
PID 4436 wrote to memory of 1144	4436	cmd.exe	90
PID 3344 wrote to memory of 3688	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	91
PID 3344 wrote to memory of 3068	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	92
PID 3688 wrote to memory of 1180	3688	msedge.exe	93
PID 3344 wrote to memory of 1832	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	94
PID 3344 wrote to memory of 1732	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	95
PID 3344 wrote to memory of 816	3344	f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe	96
PID 3688 wrote to memory of 2368	3688	msedge.exe	97
PID 3688 wrote to memory of 1964	3688	msedge.exe	98
PID 3688 wrote to memory of 2368	3688	msedge.exe	97
PID 3688 wrote to memory of 2368	3688	msedge.exe	97
PID 3688 wrote to memory of 220	3688	msedge.exe	99
PID 3688 wrote to memory of 220	3688	msedge.exe	99
PID 3688 wrote to memory of 4940	3688	msedge.exe	101
PID 3688 wrote to memory of 4940	3688	msedge.exe	101
PID 3688 wrote to memory of 4940	3688	msedge.exe	101
PID 3688 wrote to memory of 1396	3688	msedge.exe	102
PID 3688 wrote to memory of 1396	3688	msedge.exe	102
PID 3688 wrote to memory of 1396	3688	msedge.exe	102
PID 3688 wrote to memory of 3032	3688	msedge.exe	104
PID 3688 wrote to memory of 3032	3688	msedge.exe	104
PID 3688 wrote to memory of 3032	3688	msedge.exe	104
PID 3688 wrote to memory of 2688	3688	msedge.exe	105
PID 3688 wrote to memory of 2688	3688	msedge.exe	105
PID 3688 wrote to memory of 2688	3688	msedge.exe	105
PID 3688 wrote to memory of 2604	3688	msedge.exe	106
PID 3688 wrote to memory of 2604	3688	msedge.exe	106
PID 3688 wrote to memory of 2604	3688	msedge.exe	106
PID 3688 wrote to memory of 4172	3688	msedge.exe	107
PID 3688 wrote to memory of 4172	3688	msedge.exe	107
PID 3688 wrote to memory of 4172	3688	msedge.exe	107
PID 3688 wrote to memory of 3172	3688	msedge.exe	108
PID 3688 wrote to memory of 3172	3688	msedge.exe	108
PID 3688 wrote to memory of 3172	3688	msedge.exe	108
PID 3688 wrote to memory of 4640	3688	msedge.exe	109
PID 3688 wrote to memory of 4640	3688	msedge.exe	109
PID 3688 wrote to memory of 4640	3688	msedge.exe	109
PID 3300 wrote to memory of 4232	3300	h75jj20j.exe	112
PID 3688 wrote to memory of 1120	3688	msedge.exe	174
PID 3688 wrote to memory of 1120	3688	msedge.exe	174
PID 3688 wrote to memory of 988	3688	msedge.exe	114
PID 3688 wrote to memory of 988	3688	msedge.exe	114
PID 3688 wrote to memory of 988	3688	msedge.exe	114
PID 3688 wrote to memory of 2220	3688	msedge.exe	115
PID 3688 wrote to memory of 2220	3688	msedge.exe	115
PID 3688 wrote to memory of 2220	3688	msedge.exe	115
PID 4232 wrote to memory of 3096	4232	h75jj20j.exe	116
PID 3688 wrote to memory of 3060	3688	msedge.exe	117
PID 3688 wrote to memory of 3060	3688	msedge.exe	117
PID 3688 wrote to memory of 3060	3688	msedge.exe	117
PID 3688 wrote to memory of 2248	3688	msedge.exe	119
PID 3688 wrote to memory of 2248	3688	msedge.exe	119
PID 3688 wrote to memory of 4316	3688	msedge.exe	120
PID 3688 wrote to memory of 4316	3688	msedge.exe	120
PID 3688 wrote to memory of 4316	3688	msedge.exe	120
PID 3096 wrote to memory of 2732	3096	cmd.exe	122
PID 4232 wrote to memory of 5388	4232	h75jj20j.exe	244
PID 4232 wrote to memory of 5440	4232	h75jj20j.exe	125

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6736	attrib.exe
1144	attrib.exe
5932	attrib.exe
5332	attrib.exe
2900	attrib.exe
4808	attrib.exe
2732	attrib.exe
2972	attrib.exe
6988	attrib.exe
6428	attrib.exe
6444	attrib.exe
5180	attrib.exe
3644	attrib.exe
5248	attrib.exe
9916	attrib.exe
9696	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
"C:\Users\Admin\AppData\Local\Temp\f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe
  "C:\Users\Admin\AppData\Local\Temp\f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe"
      4⤵
      Views/modifies file attributes
      PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ff86d95c188,0x7ff86d95c194,0x7ff86d95c1a0
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16955351290168659891,13192584235212064523,262144 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,8009513390490118165,4254535922924815228,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:3
      4⤵
      System Time Discovery
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,15440509461615013446,10252071380419201437,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,8932962941465211058,1697732737485236857,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7051493771462203420,5119147606473512732,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12977344962416044101,1518303375666294591,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13654592128681816503,2787528499506708449,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4608,i,10571125753614063844,15535491303400379685,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4756,i,1246594133283103679,13781953232756069915,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4916,i,5448517748437250283,3116785321052751858,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5072,i,7037236256614071015,10522545580904179307,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8550616142061228072,12814229065946208742,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5780,i,7968141665347518874,5984331379523991538,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6092,i,6677139198086671216,10055559122913709860,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6252,i,1570678144147401198,13467064666746397910,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,10691261086961908704,10593272978022342821,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6604,i,7287266223863739981,12434364261728235269,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8288,i,14934231573140802636,757224685554412416,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:8
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8288,i,14934231573140802636,757224685554412416,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:8
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,16806827812662096524,9891507470834311305,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5946880940554304886,14091980626164989354,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:8
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,3773061038317555305,8002997278983060572,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7076,i,15188454482163373768,13887544573391058938,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6940,i,10417216960906049831,17840343557370852103,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7152,i,15453062985397136948,12223815112193518575,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7192,i,10144747585370460352,10446742083046883465,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7236,i,15064094572900097352,15278438515038298589,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7220,i,13199184394209143535,15436789521553567690,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7320,i,16624071870565281366,2958285925869710945,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8920 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7440,i,18027312934672971169,25236246797609778,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7832,i,8663458141241723335,16540564856490699188,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7816,i,15240655014770023725,6271633571584259513,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7784,i,2431249199880550065,7389307618537679020,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7864,i,2967002936303831171,6978609614923018305,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9020 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7892,i,10796688356524519002,5660542417724145155,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8256,i,7605780857363889171,13764374950593949268,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7916,i,12504711791812028383,1276029318891688016,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8420,i,5211308056637800028,5642144944730924131,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3536,i,5184853099845874169,13666765277316624274,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4816,i,17991628307641311041,9612169748997160937,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6184,i,18257384843895924124,17921298153262273623,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3520,i,14657887511729395178,5974263189807639624,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=3648,i,12745650978029089282,7957115212843538661,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3560,i,3830763251873386733,8380173624128117832,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5916,i,8740792823620141979,10680161594144778178,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4208,i,13317028767915274787,3928397257153736886,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4244,i,7439632646934590860,6153319571266740959,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,15290861872436046370,9256444608272790490,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9428 /prefetch:8
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=4336,i,11820145928385285066,2617642206346364929,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4332,i,8589298738211949523,17000794540070340748,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4352,i,2787733786909517829,9553386524439271376,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4196,i,9913727217830073886,13673450657284614034,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8452,i,17255634690117368039,12608586072741518379,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,9728678059711708034,5319563653296556159,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:8
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8424,i,14067424716993110883,10942112227302519115,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:1
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8504,i,3823013758265395564,4182164147548763015,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9676 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8512,i,10708211585305734022,12492514823662650674,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9696 /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8140,i,18021737190884617885,14331551378969681487,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8004,i,704109904479113525,5357111410602591264,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8548,i,3348025059096824707,16518340951325748349,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8108,i,17299586847664602207,6123199230529737028,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9748 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8564,i,297430393957195344,1702814779856970321,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8600,i,11921202836099514435,10022998524665053929,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7104,i,8167541160263879450,11348739560528071212,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=6280,i,4998951862680304922,469011283209895642,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=6500,i,432612963068775642,4778314465985434023,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
      4⤵
      PID:6692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=3672,i,5154221050766653297,9080896778124221922,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=4788,i,5254118516143710285,17888610402338651457,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4960,i,9668345639131477623,17079991732725159642,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=6440,i,17583663560449150598,15676063530555803986,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=6480,i,17756802644328332254,9129634592905363482,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:1
      4⤵
      PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5004,i,14619938475737904287,7780575479338198349,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10940 /prefetch:1
      4⤵
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6256,i,3977087764985751561,2592260815689808206,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10996 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=6580,i,8141213647394805794,18127593462244180699,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:1
      4⤵
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8196,i,937393296709514022,14680074222499724258,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
      4⤵
      PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4948,i,11263778163294471915,14466492921274858250,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11216 /prefetch:1
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=5032,i,10116719566257705804,3597847949386100896,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11044 /prefetch:1
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8056,i,16184009002250977089,3996894333679815713,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11220 /prefetch:1
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8608,i,18081503856236452194,6054880215857461682,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11232 /prefetch:1
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8616,i,5864799511411223427,2746187120708886139,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11244 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=7684,i,4976353027152290562,17433512973359531702,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11344 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8664,i,11013378962388171134,8424814133728242149,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11348 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8676,i,14163705619849576280,21407925920436423,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11436 /prefetch:1
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=8688,i,2968358346483597844,2999456567783666243,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11440 /prefetch:1
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=8708,i,10649533397887723083,10230501527538740750,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11484 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=7736,i,16566772608328835495,17661056991552420581,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11456 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=7696,i,14233691507028241298,2521631482208040398,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11544 /prefetch:1
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=8740,i,7878319103804504679,11216381913102374904,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11528 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=8752,i,15048627142147917599,9848878386441235419,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=8760,i,2777822182962885016,612756892681438100,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=11636 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10132,i,5611861429717480768,3775830780137923114,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15688 /prefetch:1
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10180,i,11337280927548487920,75175920100550621,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15812 /prefetch:1
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10220,i,12480498896700281327,5402938588369986080,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15820 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10232,i,17624932566754145489,10293067492819381275,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15916 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10256,i,4878805498335261013,5585499942836027009,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15852 /prefetch:1
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10292,i,15787415318900136416,8748636905842166286,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15972 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10352,i,32528292088259764,7976929737613078877,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15940 /prefetch:1
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10304,i,1121715267713071798,10637156720575932528,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16044 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10392,i,4482339745256183672,9520990637869713589,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15996 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10408,i,8336240239720839320,1183616148578090029,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16116 /prefetch:1
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10444,i,10618045091011692674,11720868785878036633,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16068 /prefetch:1
      4⤵
      PID:7156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10460,i,9667465109209562479,16607693734879993254,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16188 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10500,i,16240267762970466221,471238617924150646,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16192 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10512,i,1521413016118230779,12066842569453463274,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16204 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10564,i,2624307008011352726,14850017182007021801,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16236 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10536,i,2306399177733827747,6849629028483373933,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16216 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10596,i,3979439373663758170,15948656279358739800,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16276 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10636,i,5335422671704316494,11432009533811046887,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16372 /prefetch:1
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=10632,i,1668587005712577191,2406541350071206279,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16388 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10780,i,17602117082850318085,10594508395486960992,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16480 /prefetch:8
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=10660,i,5690582082672444967,3179120140371686584,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16356 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=10692,i,4130394436745011222,7159935957946358472,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16412 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=10728,i,12557037711786387170,12301484448089188263,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16424 /prefetch:1
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10784,i,2704716814447033371,18293648656705759036,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16636 /prefetch:8
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10788,i,14619878969502467291,9506288524976390313,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16680 /prefetch:8
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=10760,i,1628288752973838343,18366203483185677376,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16712 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=10824,i,6271553691207454247,10870359337761419000,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16728 /prefetch:1
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=10844,i,16385984240901509857,7996720381313724769,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16740 /prefetch:1
      4⤵
      PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=10860,i,15487978014989731177,14036474076549052493,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16752 /prefetch:1
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=10904,i,8913171025074455563,12483928539084200965,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16816 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=10928,i,7323023150289513444,14324440793206474608,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16828 /prefetch:1
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=10748,i,10500837712826304490,7449278377957143534,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=16444 /prefetch:1
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=7736,i,12683940765844874435,15223058420820408190,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16300,i,10252156327326173609,11682794895609625673,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=20928 /prefetch:8
      4⤵
      PID:9116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10564,i,13027665553147841129,605365000576061897,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:9124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=8352,i,11477853810368332683,15358379348551273406,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
      4⤵
      PID:9844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8288,i,13330792673994387410,17142077730536735798,524288 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:9976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=21804,i,877299944228646077,10417784622247431375,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10620 /prefetch:1
      4⤵
      PID:8456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=8368,i,5255623412077626406,3853745762137970180,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
      4⤵
      PID:9268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=15252,i,12343069689241361081,792089543338437521,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=15288 /prefetch:1
      4⤵
      PID:9404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=22080,i,1443836530575647561,17749057335776371040,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=9416 /prefetch:1
      4⤵
      PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=22200,i,8573570894046282687,16442024971141605406,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=19744 /prefetch:1
      4⤵
      PID:9732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=22264,i,454927278308622186,8207446573342953848,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=20516 /prefetch:1
      4⤵
      PID:10164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=22296,i,287038394863676393,18301145475628723504,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=22304 /prefetch:1
      4⤵
      PID:9620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=4688,i,2311833929816941742,5014935546805724945,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=22432 /prefetch:1
      4⤵
      PID:12148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --always-read-main-dll --metrics-shmem-handle=9848,i,18110870531678039123,1442448625262642837,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
      4⤵
      PID:11144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --always-read-main-dll --metrics-shmem-handle=9388,i,7805692544052030384,7694316050975190463,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:11152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --always-read-main-dll --metrics-shmem-handle=12336,i,3366454229729511489,13514945566491471956,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:1
      4⤵
      PID:10956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --always-read-main-dll --metrics-shmem-handle=8264,i,14099504416527018393,3187393592452245856,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=12176 /prefetch:1
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --always-read-main-dll --metrics-shmem-handle=12268,i,11123341786242259099,9953764879761496974,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
      4⤵
      PID:11160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --always-read-main-dll --metrics-shmem-handle=13384,i,8005381604608001424,17531646363918491257,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=13180 /prefetch:1
      4⤵
      PID:10972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=174 --always-read-main-dll --metrics-shmem-handle=12080,i,16715114981421656689,3588295759741650320,2097152 --field-trial-handle=2876,i,2398280767623716890,7813329640974037974,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
      4⤵
      PID:10984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe"
      4⤵
      Views/modifies file attributes
      PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5656

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe
1⤵
PID:5732
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7dvbwavy\laqvinve.exe
  2⤵
  PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5864
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe"
      4⤵
      Views/modifies file attributes
      PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1824

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe
1⤵
PID:5088
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jw47bmra\c27emev4.exe
  2⤵
  PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5360
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe"
      4⤵
      Views/modifies file attributes
      PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6036

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe
1⤵
PID:5164
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ywqzfkwy\rjcj11ty.exe
  2⤵
  PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1444
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe"
      4⤵
      Views/modifies file attributes
      PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5236

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe
1⤵
PID:6040
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2d7cfak4\6con9aks.exe
  2⤵
  PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe"
      4⤵
      Views/modifies file attributes
      PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5836

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe
1⤵
PID:5728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\woik9u3y\x7iep2o7.exe
  2⤵
  PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6116
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe"
      4⤵
      Views/modifies file attributes
      PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe
1⤵
PID:4148
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rd6w5mer\xa46zz27.exe
  2⤵
  PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5956
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe"
      4⤵
      Views/modifies file attributes
      PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5292

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe
1⤵
PID:4236
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\66281oie\gxvvbsyu.exe
  2⤵
  PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe"
      4⤵
      Views/modifies file attributes
      PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe
1⤵
PID:2528
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nlsr4uo\4kyyk5nf.exe
  2⤵
  PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe"
      4⤵
      Views/modifies file attributes
      PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe
1⤵
PID:6196
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\00svl5nh\23hrq1kf.exe
  2⤵
  PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6400
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe"
      4⤵
      Views/modifies file attributes
      PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6916

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe
1⤵
PID:6628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3xcj4y8h\03vyul8f.exe
  2⤵
  PID:6748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe"
      4⤵
      Views/modifies file attributes
      PID:6988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6700

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe
1⤵
PID:6292
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ejmolke\1c1ggaip.exe
  2⤵
  PID:6440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe"
      4⤵
      Views/modifies file attributes
      PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6416

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe
1⤵
PID:6968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yq5s26t\ttzmpt86.exe
  2⤵
  PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe"
      4⤵
      Views/modifies file attributes
      PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9964

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe
1⤵
PID:10144
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yd3ix6si\tzmqvbfs.exe
  2⤵
  PID:10220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9148
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe"
      4⤵
      Views/modifies file attributes
      PID:9916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:12096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11480

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe
1⤵
PID:11904
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wwi0pffw\dxq0uvk5.exe
  2⤵
  PID:11996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\awd0xp6j\w5cudph9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12036
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\awd0xp6j\w5cudph9.exe"
      4⤵
      Views/modifies file attributes
      PID:9696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:12040

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:6904
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:7412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8888

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:9264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6f18d3e9-f9da-4e5f-be86-76f98f7d3895.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f18d3e9-f9da-4e5f-be86-76f98f7d3895.tmp
Size 11KB
SHA256 40cfb1676ebc9bd492ebce47ee50d020d4584c2cf3fefbd638a74ead73916a53
MD5 8daa96b990fb70d56883dbb682e5e83c
SHA1 5bf87f66722e3ad52dd8ff9671fa34b32d416f4d
SHA512 714369aaf226cee9127d91612a6efe18d4f428b646a3c01af3d27ee7d191eff4c4508209c7b36ea3074904d64656d2c2d26162449487940872a50dcecda09cba
SSDEEP 192:zcsNSUJQKp9vUbBbh+QmiU1iZK1aGBPKpcCsmdb+233WN3qZdU8:zcsNSUJtvUlbQG8CsmF+232kU8
TLSH
T102321975BC74ED3A58E7B105F48B3B639FA8207BA9845F44F5E95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 149KB
SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
MD5 dc396e633ee01774f0f0b2f1071a566d
SHA1 46e628c30392dcac3b041b5bdfb5df890231d143
SHA512 5bb2742d2d0339e1958cf57c7f8f176a1eb7160436fba9ab43d8f9466a7b0f4a40c7720b03878802474778a5cd1712e68508c5cdf73820cf674341d1e99c1a98
SSDEEP 3072:cbzKhLEOClRbBX7XiCNVHkz9JHXslX76tejVBedwYEdidbKjcDO7MA:c36lShBrXLkz95slL6qvYEdu+jJMA
TLSH
T16BE312182A23CED690EF543E9CF37CA7762F6D902F50599909B3388C524CDE19B5B398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 90KB
SHA256 263020bed87acff73c7d214ddb889b6c47f9a3e95a2511a20f0893d68dc81ce2
MD5 5be32e7f14935ff980ce5d52f532d67e
SHA1 4b525077acc456bd15798bad58d42fa3b6def462
SHA512 19c544292ffa1d8e11ba331b894141f88404bd55fa7f76c29d4fafaa6eb5193d4e8f24ee5eed91a5fac15ec86e46c9962db6fc65c0bec1028037cbb0e50c6e9c
SSDEEP 1536:dOc80HUHZxmCk5REHO2kDt25/BtsF3tf1OMdJWjeCpe7f94tabF/+6wXay4Op9:dO100HGCk4u3c5/r+tf1OEZU4FG6wKOH
TLSH
T1A493028C4390237F9623BB115A716A7E4D2B86AE700BAD1D73D5B3743814FBCC961A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 48KB
SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
MD5 7fe007c57ea8a8682c097519166c4943
SHA1 7de32a85a9c2e094c62d5c393a44e9d4b0ee0b28
SHA512 298499a176722aee739bc846b96209ff4f618c7ce305acdb1f930d4e6be5961b411bed13363d1d766ccc5c470facaaee9bfcba11b1c04cf4e2de9b952df32d0c
SSDEEP 1536:KkUOL7TTaDZ3v+Whww93ZrTHjLgOoXRk/a:ZUGuFvnhww93Zr8hBkS
TLSH
T1962302E24F47584EA81B6BEBDC91564F3CCD00A519F06EAD143F81941AD6E858C88BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 105KB
SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
MD5 68b11256fdb00ea264efc414a3081289
SHA1 edaccbe8eb8e0326944b82d03d00be43460e2d7e
SHA512 f8db4fdd6d8315e3151790263a353bf89666dc675e13ef6cf3b084e05f6c03b596c8707fadfa43c42d7201fb86680e4574f0a0915518a5d5911c0d1a0bb0f9dd
SSDEEP 3072:ym0RR8FYstRkmRYjNUUetU+0Q+FgPv474lJstNMWL:SRR8Fz+UUSmQ+F6wVNMY
TLSH
T1D7B312969BE7F3DCC165A8F78949F361D01C6EC81016EB6691426337CFA9001078AFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155c9e653a65a409_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\155c9e653a65a409_0
Size 236B
SHA256 08cab472b95797246ebe5fc240047551a053593334f128db5816d95a5b971aa5
MD5 4d89152dcbffbf5cc9cd0dfd693f5e3f
SHA1 440c50386999f5b8c2f4937b5fa93cb835b0614c
SHA512 5a198b263a08669ec21753ec89ecb714f396e6b42633388cd809501bed6a831cfaa05e21040730a7b5b391c730bcb3b2242284b685c4d7cb38f2c3b69fa124c6
TLSH
T1C3D0237F911C0C05D41981F0D2E3F5999373E051398DD17580D0D773ED157E0D557451
MD5 SHA1 SHA512 TLSH

Submit Download

3d298bfd6b2d7e16_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d298bfd6b2d7e16_0
Size 545B
SHA256 51ff19142113b2c1b4b1c315ede497501119f6c8b0938dad781abe5f1e3606b0
MD5 9f2cd1093dc118bf5d1a6f5e37b2e77c
SHA1 cfffa9526c22a6ea261e6b25f7468f940caa6aa9
SHA512 b86068e2c0cf73d955354796e6b8b6e70f85671d709f3381c095df3cea67a48e021d47d10386815f675ebf4cf8fb11cda0838598fd517f3c674df77d2b7fadde
TLSH
T1B8F0E187959AB842E5260A78099AD3035242C0E4549C859A900821D23643C353C1C7A4
MD5 SHA1 SHA512 TLSH

Submit Download

4ba01ee326e824b7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ba01ee326e824b7_0
Size 284KB
SHA256 c515f8d539facf55031af4e4bd9e33641f034a13eb261fbb17f91c2040969308
MD5 5c1e37986dcd53a61269d74edaf1d74a
SHA1 989901e51c3a241126c0f6e4e80992bbe22749fb
SHA512 8f2c175efa3511323173d2207bcab5ee2761ec65185cefeb99fa1ff4dad1541bd1792022848e6185aebe66ba4fd89b8804b0587f9d9de14c86457f1736dd31c1
SSDEEP 3072:Qr3IyV6FK9UCMvaQ/qwgyX+ViN4sqQngG2BwLZ2BbEMOm+t0OWfs:Qr4yVYjui4TQngG2BAZkIm+tTWfs
TLSH
T1F954C6651B90EE15CF7663F51262C953A73591483FD7D31372E4A33A2C0A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 d92ce0580bc5810517091e51f570e0d8f7c77580e073622954cd473aec8a478d
MD5 e9730e1a6ebbcdae928072b4120da6a3
SHA1 6355086d4f8650113a69dc24d50a4c5f6e9ffb11
SHA512 b360227e7bbf6643cec75457efb76f20cf24515a3f5e37a8474805798b83dbc80c08df83cc74fe8f727c176b8c1204304393fdfd6ff9cfaccb7533ccf0f86717
TLSH
T198D02B4F44059D65DB5C6AF0D7F7A185822AC8668CFD4091C01131B325406B9DE4AA22
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 adc42118c5b11c44747442bcf23d7046c28f3cdbccec8de6f287c072f66bfec1
MD5 c8867c2df9df745f887f47d823fc150c
SHA1 3ade401eefc34d5e8cb9da9117681a717888383b
SHA512 db894e5b62afe2d53b34126a75c053fe073759087afcd37c3b101ad79060b7ca550f75ca5bb8060ef3c7de2bfb62f5b82cd84042d6216f1ce259daaf91984cee
TLSH
T1B1D02EAF1188A824DD308CF4E7BBA005C0E3A05D48ACD0E0A60620633903ABAEA9C214
MD5 SHA1 SHA512 TLSH

Submit Download

b3bc4c63a46cbd1a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3bc4c63a46cbd1a_0
Size 591KB
SHA256 0bbf9280ec80d3ab788b7484e84eae41c14d0fb1b59d78a06bb455fbd433d152
MD5 1d51b43d7626dbf397f82aa70ed7f121
SHA1 ef8de73af87e5d1cb56a0400684cb52e7295e485
SHA512 9d138168041e7d661b7b951c0a364f9cf95b2747d35d83ec7b3831731b0b51557cce0d40382d7f98c69098e92b9419832b021a61602530f0f4a6c475884aa73b
SSDEEP 6144:gOqOW1vbVK0IEDI9JZ2v1OrChomTCcbCJoIwoBxjcSXA3ZEA/52blfk:mvo9DDI6ChoijIwoPcSXA35/5glfk
TLSH
T178D4F9090790EA59CB7623F401A38917A73581483EC7E727A1E5B7363C4A3E15E9BC9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5ec91db49a04372_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b5ec91db49a04372_0
Size 103KB
SHA256 bad62e045edbc675e3e92cbc0a290a82ff4b3109e74aaed6aea7b92562427516
MD5 3c6b64e021548a8074841ba0b256bb96
SHA1 ac8b993e1163bda4bba49a4eb228b3886e845760
SHA512 8d412a18eba03e0d02b9fef3d70a84907b962aac287323e321c6675942a685ea1d91fc78162617a96f4563620065c59de6da9d3bc2ea6157d7e18e262ab15845
SSDEEP 1536:k2LLS8NUU8OkTIsu4s4KagWtn/aBc1PaBsOSsPN3on8SnFgK16oUGbUg0btW:kgLStUrCzKY1kBl3XK16oUGQg0btW
TLSH
T139A3E8756F90AC75CA3653F041A38C17A636444C6ED7A31F72E49236380DACA1FF6D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba00cf7a06a7173e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba00cf7a06a7173e_0
Size 472KB
SHA256 98b1883f433dfbceb8eb35851c5f6934e3b112b230202a243fc410dc045b0e0f
MD5 7582fb0a4959647d4a79f9b8f55a6f80
SHA1 22ccef3f3f89a98a5bd2a917ed9eeab2cc82dcbd
SHA512 3e3af8496a4ef3238baef7c9ad03c47259b31ff6fcd5bb8c72a5740cec6cac3e319f1e2e42f0ab7b4f17f49b9e28add025fed74004f790c110c8107157d6c4d8
SSDEEP 6144:ulr2mEKyuwwh+dvZkqM9Q3eJE32rMAgcovzBQnXE2xHZ+f7D6:u7ZyFC+1AKuJwbv9QnXv0f7D6
TLSH
T178A4C5491B90EA55CB7623F451A2CD63A73544483EC7E72371E4B73A3C4A2E15F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 31caba0ddaa3970fb0dbb2aad24e6cc473dfb9ee37de9d220fbcc5a1b6de864e
MD5 df57f53c839d3f4a0f4f632b31356641
SHA1 158d6d96b522ae069bb5d7bc637167f30d4b93be
SHA512 e84990f4650ee4952ecca745612280ad439e6f66441cd4da0c4be81eccdf68190819837a67cc7911d5ee8d4adce8beda4cd1bb6373b04110af5c52cabe55a2f2
SSDEEP 96:4H02LeWNAtheII+Gg/oBvGc68v7Dl0AqrqvHLRHD25VPg8EeY+F4h:415V+GCoBxt7AqZ25VPtEeYM4h
TLSH
T18C919534456D15E3DB71007351F28A057036C6EAFA077EB316F088327E09F9A83759D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c913.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c913.TMP
Size 3KB
SHA256 dea6ad481884dd53649fa71926138e379a44dc006082c613829b54600e141114
MD5 ddc05a0d734bb4ec437c2d269c70a04a
SHA1 975c3b804104d29ef22290b2e7254d6ae992a4d7
SHA512 01a15437abb0796e47b36f96e6bfaa8c3de5183134a0c9dc434cc7d5c74d351a381d972c5d2d2a2903d4396db7c98ec79b1c085df6b0bd9c1c3b2adea4faf52b
TLSH
T10E7184390A4E04B3E3714173A5F2024A713ACAEBFA1BAE7725F40D763A14F6183B81D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir3688_1382544413\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\manifest.json
Size 2KB
SHA256 bbdc79c9ab2f2514cbc298b3b7fb7506f9e746b597b132c59ad004619c7b9a87
MD5 88668a1cd61c9f5afac6c089f45d6244
SHA1 f064a4ddb0e8110f87a7fc90c9a914e98f6d4ace
SHA512 03db2f0c91ff68a9c3f9e75c728b76599cf786c6f414607601c53987d6c1f9ab42fc234c058d09cb31f00095ed6d054b201a06cc638413e2e45bf66f86f7d65b
TLSH
T10F516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7793d54ae8f47995e1391cce7e55cf22171cc508576731e5f83e9ff4f8653512
MD5 51cbdfc60a44e2bc33c6e3976588a1fa
SHA1 0e5c854b1a0fc0ccad9303ffdcf5a287cf680797
SHA512 ea35656169602fea07995d87804700e8e24faf4dbcbf60a5e009ff430c99081da09ec7ed2d785ced488df2437d09d4d7be3be65f39d15075749bdc94d128d775
SSDEEP 192:sxZ/RYyM/jK1Ml8MjZ/f6sTXokEdpLTMlFu/W6+WNiRPlbpPLdQGfYBr7Ha+thIf:sxZ/O7Z/f6sTXSwebkbvf78O
TLSH
T19752D852AA345A778CDBD219FA51BF63D2F91462D2940E54EAFCD91C00E2AEC3207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4034956244c150c151fe6e53ed5321b3f317b73a5ab921a0b127390023193333
MD5 06fbf5746809a27a317bdd8035c6ee87
SHA1 5267f6cfb3ecd3ff8fe66d1019ef3c569bfa833e
SHA512 076aa7d7a70806cf4097e85ecfb175aba61cbf9894d3741e3b7245b9e12e1317de39a68ca562e94f407483374230e0c8e9ac6de827397876fbb580876bae964c
SSDEEP 192:sxZdLRYyM/jK1Ml8MjZ/f6sY7IOx/Ywq9qokIdpLbLbGbebmbDbMFu/W6+WNKbx+:sxZ1O7Z/f6s6pO7zzebpDhhM8qq
TLSH
T1A672D846A6345AB78CEBD219F541BF63D3F5187292900D54AAFCDA1C10E6BED3207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d952e843c5697e5fd1d31a3ca036ceb921d6a9b7523ed2f9aa9b4093759e4d79
MD5 38cb5c67a35ec4e4a5d5609a2c79ace4
SHA1 756dbc211b60d8b1974dedafe3c818ae52ec6b8b
SHA512 503d03d1dee47dcbac1644006bc6fc27a8b05080510d76d4afa01b16bb7940964250ab62fb5dc523da82fc83c8441d8bd062cdb6ff756e0d27d65540a88b2cb6
SSDEEP 768:D6W7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP5LlWYSjEroIbnWONYS:D6W7k+0Wvqidau1jaM5LA3jPaPWS
TLSH
T193E2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d31024d5b6007a35ca5f11c78703d0e19c6b7d7ed42e49e2e13e049314d634e
MD5 7a8237b6e30c0d3c5390ba8f60a4d9b0
SHA1 b4634d5dde86d904555d9b914b54b64de40b0777
SHA512 a5b0d1441b6d782454c3cda0637024a3f83a5a11dc8e399e6cbe0324719b7a19a5e9446e55dc72ecf43089a080ece6e4bd07a51fb4b4e108d8dc05670d01616c
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcoyI/KXR:KIbCKcbwQKxKmmH6KEIXyQKXR
TLSH
T19591891AB07B0A9238BE2C89A15595375F4231633214B4AF7FF404660D6FE625DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ba5a0aad61be55511ae0dd311c6f28835abc29aab43aa171840d0719c124c313
MD5 bb3e01a5e01e44d86e62582fe5cef3e4
SHA1 5d21bb233b86c8c6cbc65a5a0f23804b645c2ec2
SHA512 c9c31a8c0fbfda6e1004bb17c67b5255ca34c811135a45416360dcb998ad2933826ebf22a3f99510894fe6a10b76957eb5a3419194407acd290c5b7059ec94ec
SSDEEP 192:uuCSZsNSUe+QKp9vUbBbh5LQmiU13HTu6aGBPKpcCsmdb+23sdN3qZdU8:nRsNSU7tvUlbL9VzlCsmF+23+kU8
TLSH
T1F3423A75A878AC3658E3A105F48B3B639FE8107B99845F44E6F99B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a6bb1626ac9897abd650e13b7efea9b880fba6c2d665acdb1344d4f748600d3d
MD5 9e969cafe1d0f0c3ac5cc2903a0b5a5d
SHA1 175568b3b54384e92112feac51abb9e485d17025
SHA512 1d3db2c24fe516e3e108b45bab6f15909785a6bd1476d73df57aea767dcf33ff0e13c20a631cba4dfa1e472e7f436768e747137769030815dafc87567166d733
SSDEEP 192:7ONw64BgQmiUyd9D5GBPKpcCsmdb+233Ww3qZdU6:7ONw6egeD9smF+23jkU6
TLSH
T105122A75A869EC2B5DA2B114F4CB37635FE8217BA9849F40F6E86B1C04DB34C3B0A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fdd3e489ef86ee0a4cb0d4f7a812045df39dc18b1d9178a1757a52a47ef00f5
MD5 39b36e8277adc466af6aa325bfab495e
SHA1 671c4020ca50c4e7c993736f0dc0b6b8d69ec300
SHA512 5753c4f6bc499b6a3d273ee86c9e5453fa34f9869c0bb5c99d6ebbd8ab034afd07f00c482f77eff9169c46569a8bf8dfd781ac6a1a70dbef80e7d9ea20c48ec5
SSDEEP 192:MONH64BAQmiUyC19W5GBPKpcCsmZaDRFU6:MONH6eAVjW9smSzU6
TLSH
T18D021A35AC796C7B9EB3AE05F48637175FE8112FA5905F44EAE82B1C00D764C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c58a0a378c6f6d0cdca67deab49ada6b4a6f925d51cb3675595befb577504dbb
MD5 755b9b0ff8341cd63bfa860b24c7037f
SHA1 7f7fd63275be3807e55d759590145bb4343e4d33
SHA512 259116bae9bcf4fb30ca695ee6fbcda84cae1a9d59bcc642231923a108026f21b745974d94e64906ce87785ebc9ac9ba9ec1d1a71b03222adde62b15c87e5858
SSDEEP 192:zCjsNSUJQKp9vUbBbhnQmiU16Zg1aGBPKpcCsmdb+230WN3qZdU8:zEsNSUJtvUlbfKYCsmF+23zkU8
TLSH
T1AA322A75AC78EC3658E7B105F48B3B639FA8207BA9845F44F5F95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ecfdb467f6020b767dd44ac0b44fc455b9a07f455a246c2432f60cc09ebd428f
MD5 daccdbf5d8de3b42d015bd5ff6b5cc86
SHA1 e618d6fe69199dd8632fd85cab2bfa7b95721a6e
SHA512 50a8e811a6b62e73ec6aed16926d195216607768124c0931cee0aa0b236cf4f2c74dc82a8cecfb915bf14810a232411200f3dd0ae6f3fc0d545169869b899af1
SSDEEP 192:zCisNSUJQKp9vUbBbhyQmiU17ZLraGBPKpcCsmdb+23jdN3qZdU8:zBsNSUJtvUlbUv3CsmF+23LkU8
TLSH
T17A322A75AC79EC3658E7B105F48B3B639FB8107B99845F44E5E95B1C009B39C270A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1bba88105b2e2ddcdf5a95cb911691376721a291dc85e54e9b8f62ee588d74ca
MD5 8b5d5d11900cb3de4394ba77c3200ad5
SHA1 0a813c3cbbd19b83fc899f458230581ea84a2931
SHA512 9ca1f999b5a8f653bc9a1fa04e084e91a1936148feffab0d98a31b451b6d95acefd402c0c818650c95e47de64b1191fece3692f119ab9a5e845c68fc9686a0b1
SSDEEP 192:uuCisNSUJQKp9vUbBbhyQmiU1VZZBaGBPKpcCsmdb+23jdN3qZdU8:nBsNSUJtvUlbU1PCsmF+23LkU8
TLSH
T13C322975AC78EC3658E7B105F48B3B639FE8207B99845F44E6E95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 56f4fedbb0be02d2769e5b5f7e71c6c51f56fc34be2ccd11e3fff092eebc7f62
MD5 e0d4413830fa3232862309e7e34e6d6c
SHA1 50d39de3df2a45d8b7f7a1dab242e03496525a4e
SHA512 1ee7bb2bc171eacf3b71d127b9124d1f2dceaf23b0678428e6087b95128b13a8637d45ad134a87e88550b83e53395717200bc0d65897b36153e5934a6434d577
SSDEEP 192:uuCSbsNSUe+QKp9vUbBbhyQmiU1RZ3baGBPKpcCsmdb+23jdN3qZdU8:njsNSU7tvUlbUNLCsmF+23LkU8
TLSH
T1C2423A75A878EC365DE3B105F48B3B63AFE8107B99844F44E6F95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 18ced48016b455da756fd6a95e5145eb6695ce662f501007f22d542f4be1f6a7
MD5 d7f207e1e475e34790a1571118ff6d3e
SHA1 2beb45e840ebcf0bb6d1775e475bfe41e8a53f38
SHA512 1060fec3d8299a1c3f920af3f30aaf5ff81156d2dab7ad0474ce53e9df3fb29a3d10628d345c5f2d51608626eaacb203c931aae6bc742a0a686b019c84d221eb
SSDEEP 192:uuCSWsNSUe+QKp9vUbBbhFQmiU14TUkaGBPKpcCsmdb+23YdN3qZdU8:n+sNSU7tvUlbZQtCsmF+23SkU8
TLSH
T12C422A75A878AC3658E7B105F48B3B639FE8107B99845F44E6F99B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8fe342d8e0a65538a33447a82e889e22e9c0aaefde46a071a8fbafd6dc1e0f26
MD5 77ab131247f172e8ec2f0278dc5b3cb8
SHA1 1f0e9059323980185cbcef3cd2cc6bbff596728b
SHA512 7f595add9f0852a72f580f6b67ebc3ef01abe2bae44e617636769ea801ade60246fd3b4325c2cd960283fc3059f3af312bf1d0b91091d1eada5bdc2398407fa1
SSDEEP 192:uuCSKsNSUe+QKp9vUbBbhuQmiU1uTwAaGBPKpcCsmdb+23YdN3qZdU8:nSsNSU7tvUlbMiVCsmF+23SkU8
TLSH
T115423A75A878EC3A59E3B105F48B3B539FE8107B99845F44E6F99B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8f20c9a5dc63e454aa7438c9df3b6037ff5f08977ce12af6b27a3cf8d2919098
MD5 e3d665db4ea761c26ecd18f075fe06aa
SHA1 5f538008a2109c438d26de88fbdba6002fd55bb1
SHA512 52c91fd4d2406d5e52b3f48967a700c0ddd5027f66a744a6ade1fd28fbc797bd276cc30737e91112a3861883b439a5eb157a24bfb9d29050ab39dfaa71bc322e
SSDEEP 192:uuCSjsNSUe+QKp9vUbBbhSqQmiU1oTmstaGBPKpcCsmdb+23axdN3qZdU8:nbsNSU7tvUlbJcmMCsmF+23OkU8
TLSH
T107423A75A878EC3658E3B105F48B3B63AFE8107B99845F44E6F95B1C049B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d7eec0974e121f76afc2bff14cbbef1e6ce879a9cafeaa71ca830cedb0a648a3
MD5 6fe0520754dc8e324647fdb351485471
SHA1 588bf2414235d9e1f27597b70d1d3aaaa626cee2
SHA512 466da74b396ccfcbfc60333675ee9b518360761d105d523835df0e13aff20600371bf7ea4704d3f7ee4d266aa8342b9da42df1054b77fe34e1c442beadc7d402
SSDEEP 192:uuCSZsNSUe+QKp9vUbBbhgQmiU13aTNtaGBPKpcCsmdb+23sdN3qZdU8:nRsNSU7tvUlb+VYTCsmF+23+kU8
TLSH
T136423A75A878AC3658E3A105F48B3B639FE8107B99845F44E6F99B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e2eb30ec3dda4b64acae1144fb3fe270a5ca8f6eaadb7a781d036916326c0bb0
MD5 d21c20e706a47a5fe857c335494b9b93
SHA1 5a2d6776f0fdcb77a27374b7ab97d825c8d82bf5
SHA512 35b91b5ad24fc918c523e3bd1aacec47d145a368032fbd28fe3fb3f0084020401a056edd855f112dd8129d37e33db271689704a1e2b9b2221919edb2a4cf80f1
SSDEEP 192:uuCSRsNSUe+QKp9vUbBbhEQmiU13OT5haGBPKpcCsmdb+23sdN3qZdU8:npsNSU7tvUlbKVErCsmF+23+kU8
TLSH
T107423A75A878EC3659E3A105F48B3B639FE8107B99844F44E6F99B1C049B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 17e145ff3b3b40ff371b29961a47e2623bc5bff1ac978e38ddbfd9abf13de128
MD5 a9bef6358193cf9a17e3010682fe7666
SHA1 0747c57856be2583a6ba5d5ccda843a25008ab3c
SHA512 4dd0c9e10939ac81bc408ebd841576df194b7a10f08eb6764dd4e413bb69075645f177fe57eba8a496528383dccce3c56a72caf3aa05bb58d5ee99e5faf0e2f5
SSDEEP 192:uuCS+sNSUe+QKp9vUbBbh7QmiU13bTKuaGBPKpcCsmdb+23sdN3qZdU8:nGsNSU7tvUlbHVvlCsmF+23+kU8
TLSH
T11C422A75AC78AC3659E3B105F48B3B53AFE8107B99845F44E6F99B1C049B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f40a7dbb4255165a3c7fa31d0a5c3806ddfdd32ac762b3b418e7528baf73c7e0
MD5 0d3f65ad5f1040c61675fe4655120684
SHA1 a7d213f40667302184a058e5882d49848dd2995f
SHA512 f830118bb4fe45a30cdb605abd639f5a5b73fd6a78d5d51c17ac6386d8cc5d72d6cdebe53a1cefde467180411d4a1cfc738fd2966a1cacd9d5c2ca0fde55407f
SSDEEP 192:uuCScsNSUenQKp9vUbBbh5QmiU1FT1laGBPKpcCsmdb+23sdN3qZdLqyepOr:nUsNSU4tvUlbJvjCsmF+23+kXem
TLSH
T17A524A75AC759D3759E7A102F48A37639FF810BB99840F14E6F9AB1C00DB398370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 a97d69725967c91918699ea3e6cbf9a58d897b417c7bacdbd1803d6e48db04b3
MD5 fbce881746e0cf52cffe764df6d7aa70
SHA1 cca5cf430b94399ad84b4ee4333d2739259ebd54
SHA512 68d0a5e251b3443d1b7f79c16f470bf27f098c51a31ce37e6e55961ae3a1ff4847fba8213d2a8bbb08785965aae097d6e3a129682689b2d3ca9e7586d811f0d2
SSDEEP 384:nGsNSUxtvUlb6p9CsmF+23+knTKwBODNZOCHWW:GgvUlm8jlOknewBKZOmWW
TLSH
T11F725C75A839AC365DD6B205F49B37579FF810B7A9841F14E6EDAB1C009A388270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c73da9d07fcf91a265e964d35a6055744ab257585a49c3f0f541a3128bcac754
MD5 f0dfe6108a14156abd31c70db9982825
SHA1 ceda743fe9a919f468878299d3fbfa2ce60bbda9
SHA512 f942cf2a77c32c38cf213d6b5d1be2534c9c2d0a353be29eb73a651d74660b309a6c0854e888e4f12bb83ab787229f8022700c41a04659eef58231aa5c7f7bd8
SSDEEP 384:nGsNSUxtvUlbo2/CsmF+23+knTKwBODNZOCHWW:GgvUlX6jlOknewBKZOmWW
TLSH
T1F3725C75A839AC375DD6B205F49B37579FF810B7A9841F14E6EDAB1C009A388270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f5a1a3ed7ab3859cdf1454feb537ddfe214a8734751352358481c27497c23b1a
MD5 79202033932e6d079d83de929b520bf3
SHA1 fbbbf6339358781df2642a1ccc0ef5624923d407
SHA512 c2c7a8c80aa241fafcb462af2b1674bdb724d7a1eb3c5ffbc511aeaa11d94fcc1e121154b8c7f2cf75e551638babe7954e66128204adb44c0eb6e19dcf8f1ca2
SSDEEP 384:nxZcI0sNSUFtvUlbzqXCsmF+23+knTKwBODNZOCHWH:Z0MvUlaSjlOknewBKZOmWH
TLSH
T1B8928D756C39AD369DE6B106F88A37174FF850B7A5C41F14E5FDEB2C00A6298270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 28bcc0309611320b583d02d85abfcf1b2fd790234f4d2bd3eb981783083f9d6a
MD5 8ff487324a31942ca8f749b5064d8729
SHA1 166735e065072253d4c41c0d536ce5d13cca990e
SHA512 0c36ec0de4addeda25130716f9dd25735b47ffe0bdcd94754d523f10786ff4aca8558b4b7ed2ccf1d443b425131031d9adaaca575e51a71680d07a09f65ee02c
SSDEEP 384:nxZcIDsNSUFtvUlbQo7CsmF+23+knTKwBODNZOCHWH:ZDMvUlFWjlOknewBKZOmWH
TLSH
T1FC928D75AC39AD369DE6B206F88A36174FF85077A5C44F14E5FDEB1C00A6298270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d0295a09c920088f7ded88def76cb7319301f11ee71f918a3feee406a329850c
MD5 fdbb5610a593dce44b9cfbc545c65e8d
SHA1 096c07d255465d7ca8ba28061832d98033262ae7
SHA512 a66562134da18940907dbbccbea8c06b8b46544cdddb2b869319ce9ab883afd82938987c990d8ed4b3da5936c8b423a1e432d9b091a33a386f3bfc06e4c436e5
SSDEEP 384:nOZcIdsNSUgtvUlbw/lCsmF+23+knTKwBODNZOCHWH:sd1vUlGkjlOknewBKZOmWH
TLSH
T1E1928D756C39AD369DE6B106F88A36178FF85077A5C40F14E5FDEB2C00A6698270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a2569b6ede5831f49d6d084249852169d6ffeb72785c4d817318be17196b5ffb
MD5 a8eb4a976864acbf88dee7f9c0be7041
SHA1 0d364775b876e2d224f792fff072c2224e894c16
SHA512 f38765c5f06ed1b9cf1af9fa03773894842ec32e1d4c6d8431165100053e84837c98dac5b7dad43ebe7af4990705e10f6a9d4aaf115282cd89db94a049d8ddc2
SSDEEP 192:uuCSpOsNSUe+QKp9vUbBbhSqQmiU1BTWuaGBPKpcCsmdb+23axdN3qZdU8:nksNSU7tvUlbJrBCsmF+23OkU8
TLSH
T126422A75AC78EC3659E3B105F48B3B53AFE8107B99845F44E6F99B1C049B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 dddfdec036609d2bc1d1ccda580b3e31553d631c90e301309847f92647fadd6d
MD5 f2cdfd92257313acef9c835586667533
SHA1 5dfb33ed13e8c6c09959ba0b678bd004ffd1d933
SHA512 c2646c36ca7195f44277155cec44df3b44560576463b8f7e9762cf615785dbf6c92bfd5cdafb7aa548e828cd0e6f9c56685bcb05c101989c87894a0a66df04df
SSDEEP 192:zQONSU64BbhIQmiU1GZA/aGBPKpcCsmdb+233WN3qZdU9:zQONSU6eb66oCsmF+232kU9
TLSH
T11E220A75A865AC379CA7B115F4CB37A35FE8107BA9849F44F6E85B1C009B38C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 cc630fd4878342b6a48dd60f665b35dccd21bac349cbecb153dc3c98b19c8805
MD5 85b9439ea9ee7cff9ea88e58510f4e49
SHA1 286456200d75a52ee17197ec36ba288a03936052
SHA512 4baf6e07b37382d142137df3c0723bb6d8d2294feb87ffcac33f92932c7417708d1c83966034c5886249051c7251eac0500dc89a912b9e67b4385d9db8f681b0
SSDEEP 192:zQONSU64BbhIQmiU15Z5yaGBPKpcCsmdb+233WN3qZdU9:zQONSU6eb6NYCsmF+232kU9
TLSH
T1D6220A75A865AC379CA7B115F4CB37A35FE8107BA9849F44F6E85B1C009B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 59c82bff18e7535fb52b0465b76a9277e1f68e68a41c37be968cbd78d68f2951
MD5 974e6c4e28a40746bdcfd948b55adcd4
SHA1 500d981ad2385f4b46456a25813c8871fcafec6d
SHA512 ba8320d37336b630f3805a06ce72fda1aa2b2c09f0cbfe9597a9e6eb21e1d875530ef5d30e9c6d2901cd691d4c81a745cb923abf68aa17d092747bac5824f10b
SSDEEP 192:zC/sNSUJQKp9vUbBbhRsQmiU1sZ8raGBPKpcCsmdb+230WN3qZdU8:z8sNSUJtvUlbn8koCsmF+23zkU8
TLSH
T17B322A75AC78EC3658E7B105F48B3B639FA8207BA9845F44F5E95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1b9b0ac5c88a8461e0b916b2eb7a4d918dace0355c92c8c5452ccf9dc900db15
MD5 b4a2a7824e805cd236d847133dc2f134
SHA1 1739000e3db0e9ccfc680ea74bdde78a4ea0124e
SHA512 ce7ecc2d135570f8e2ea15af93f5772e19e034fcb8a772a746c08eee47fda1b6a19c00c0e5b0015a8621e6069abfc8bd78f9866d1ae55d501d7dbe24d9ed3633
SSDEEP 192:uuCSvsNSUe+QKp9vUbBbhzQmiU13ZlxaGBPKpcCsmdb+23jdN3qZdU8:n3sNSU7tvUlb7fHCsmF+23LkU8
TLSH
T1F1423A75A878EC365DE7B105F48B3B639FE8207B99845F44E6F95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d049a939a8adc3a9aba0e2855d111bb7d36085fbda55fba385d69b1f903a97aa
MD5 dbe7b4a01d28cecfce0450a1d8e3081c
SHA1 727ac472623f6792a8d1899b56d6af686489529b
SHA512 ce5643fbd6dfb3891693c1e0e67b92516d23abcb22ab51cec6548a09275fc8ec43eaea5661e992fdec571a8df3abe680efcc53b995e59355df767175468e1365
SSDEEP 384:nOZcIqsNSUgtvUlbw5lCsmF+23+knTKwBODNZOCHWH:sq1vUl0kjlOknewBKZOmWH
TLSH
T155928D75AC38AC365DE6B106F88A36179FF85077A5C40F14E5FDEB1C00A6798270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 030c8c44ef15a4bff35e9e89a4a8c44e728c636990cd472ba132403ace14adeb
MD5 171a5acedbc5fa7542c447fc5caa1dd7
SHA1 71aa89fb0287f8ad7c3c1b803c83f2c0331e4acb
SHA512 e19c74d217f1a562e624775b8af855b4dd52317c1698a774bed7e8307226a47e7d8e105f61b3fa4ad28fc56c41c076ffff1126bfbff09ac055d2aaa599dd8f1a
SSDEEP 192:uuCSRsNSUe+QKp9vUbBbh5LQmiU13hTAUaGBPKpcCsmdb+23sdN3qZdU8:npsNSU7tvUlbL9VplCsmF+23+kU8
TLSH
T1B8423A75AC78AC3659E3B105F48B3B53AFE8107B99845F44E6F99B1C049B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 757dbae3be5988015136a4121a85bbd2ed8dbb41c21ef2644ad5bf7c30ca07d6
MD5 716b1b26301165493a4f9664ad735a86
SHA1 a9164ddf32d6f274ecaa62661fd523c2262add34
SHA512 a4414b8619e9cab0d76b362b32fce644650729004ba9299aeac02086a175c6af3b81b8cbe2c7385849aa07ad2e10781f972ee86a4cf3ec5c1363cd867ceeeb2a
SSDEEP 192:uuCScsNSUenQKp9vUbBbh7QmiU131T8YaGBPKpcCsmdb+23sdN3qZdLqyepOr:nUsNSU4tvUlbHV11CsmF+23+kXem
TLSH
T113525B75AC799D3758E7A102F48A37539FF810BB99840F14E6F9AB1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 11b7f0ea03ccf752d6e700bc698f77619421f8c9fa32f4748ad2e7fd308dab5f
MD5 6ed42226d24689223f3e4d16dd4943e4
SHA1 eda3ca5a25fd50253840e5a12a8a7d91af2f99b5
SHA512 0ecbb33790048ebdfb9b3ef93d5769a02e3d3123d2c240c44e93683a961e5da3f942e90ff225341fed9f6e9d2b81fc361824d1f1a600ae34cb36e22bcb9c5731
SSDEEP 384:nGsNSUFtvUlbotVCsmF+23+knTKwBODNZOCHW/:GMvUlg0jlOknewBKZOmW/
TLSH
T183725C75A839AD374DD6B205F49B37579FF810B7A8841F14E6EDAB1C009A388270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5a19a0b2817fa2dd962f876b693bb39a8e3fc661faab90d309ebcc4820c8b10f
MD5 bf2320c41111f00823749fd55618b55e
SHA1 e33bc0171d16e70c8a658000e6baa160a866188b
SHA512 1db36d4eeaf3bae88238e38202e0b570e72341f43a138aef04252425aec520941b9bd121256fecc992e068fd125b06136b3cecc96cd79244b814c6c6d554a8bf
SSDEEP 384:nOZcIKsNSUgtvUlby/hCsmF+23+knTKwBODNZOCHWH:sK1vUlIAjlOknewBKZOmWH
TLSH
T1E4928D756C39AD369DE6B106F88A36178FF86077A5C40F14E5FDEB1C00A6398270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 28f49cec75fd09573d91f323555e2f000977b88a00943434d9cbce1cfc7b03cd
MD5 dbc069f90313034c45238f544e40f644
SHA1 fb2dc60fe8e3add22f8f760193840b119cac8ca9
SHA512 b3a7395387b01bc501a3e86fdf309461b7942f312040c0ba05de19bc768833dd5886ee58ce8d1fbc72252114d37744875f0aa99f0cdcfed0b2223bb2775bb5cf
SSDEEP 384:nOZcIWsNSUgtvUlbZj5CsmF+23+knTKwBODNZOCHWH:sW1vUldYjlOknewBKZOmWH
TLSH
T1A3928DB56C39AD369DE6B106F88A36179FF85077A5C40F14E5FDEB1C00A6398270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 95a31716eac0ccbfbfe033325c8e7afdd55e150e1479ecd1f3e4a59e7a2aafa1
MD5 36d358e11dc3a9d512d54d92b6aefb7b
SHA1 7baa84821d8f8fc943e09cac77754556bf324354
SHA512 3990f1c3cc1eed599e9a9f6f8956ba53667f41a05c33c76a44d0e6fa5ffdf13ccd6f129d4bd832ecc4688128c8004f778c4ce814dc5377f1fbc0c9219319c1bc
SSDEEP 384:nOZcIbsNSUgtvUlb6FtCsmF+23+knTKwBODNZOCHWH:sb1vUlWMjlOknewBKZOmWH
TLSH
T199928D756C39AD369DE6B106F88A36178FF85077A5C40F14E5FDEB1C00A6798270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2ed9b0a1c2ba2d97cf199f6ab5d6d4c1626e3a8b94402d1337d93fce2371a1d4
MD5 3ff3f7c1d8d2ba4f5c2f28ae55d87a58
SHA1 075e4a29ad47243ebe6f6e6b77484c70278b317d
SHA512 d2686441945218041089321dda6e9ddae5e1e20585c2fdb2d77835fe3ca6691dc044f34816a38bcebb14e47d9dceb882d5ec08cc7b5ea18d57995a95502cb215
SSDEEP 192:zcsNSUJQKp9vUbBbhRsQmiU1xZrgaGBPKpcCsmdb+230WN3qZdU8:zcsNSUJtvUlbn8tUCsmF+23zkU8
TLSH
T107322A75BC74EC3A58E7B105F48B3B639FA8207BA9845F44F5E95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bb78c47bf8774d0afdf4375a7c4f787c92b0818f1a74e3fc2d39e9cd8f92d8b2
MD5 7e5f3bfae51a255213a9b52f07e748a3
SHA1 ccfc9817ebf67a0cc2905df7dd93d596e8f07c65
SHA512 e0a25537ab2e9b3c149ce27cca0be5be0ed7593a2c4a0baeed4a60d627d6658fcbe4e88e8db870f0cb0bbbf69d44de8df0fb041a7fccfee90bc04aab1f8fc152
SSDEEP 192:zCBsNSUJQKp9vUbBbhRsQmiU19ZWxaGBPKpcCsmdb+230WN3qZdU8:zWsNSUJtvUlbn8dUCsmF+23zkU8
TLSH
T11F321975AC74EC3658E7B105F48B3B639FA8207BA9845F44F5E95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e4d8dd4b5dd1aa218ec1d428d055a38b78d32ba91cd5a30e8f15b73a5ca9c771
MD5 1ba8c9e462d05eecc79cc60f38bf5a8e
SHA1 269a9b71ec641ec6c30ca67648c7bf8801e8fa93
SHA512 21361a87f04ea4f6dbfc97d40c1642508d47b17f9eca9d5d6f7ca9c0d605d3b05550d701b06decdbe74a798e50af2f439a46ba7fe7316f6c9536066b7e892137
SSDEEP 192:zCcsNSUJQKp9vUbBbhnQmiU1BZtNaGBPKpcCsmdb+23jdN3qZdU8:zDsNSUJtvUlbfhHCsmF+23LkU8
TLSH
T1F0322A75AC78EC3658E7B105F48B3B639FB8107B99845F44E5E95B1C009B39C270A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 77f3c3859bdc3431de5d1f05ef86182419faa06ed913aa91131ca04bb9b43795
MD5 30774e46a101a4ae93abef86eb4ed9ca
SHA1 71feada2ebe9edcdc2634f5c7e953648a154205a
SHA512 e8f993097f470ba4be639912e823cb11cf0385f77f890cfa1e5703ba7398907630dc159c94f75538dd9c04bf8c6c07df1501de7441159ac0eb35e5ddbb8939e4
SSDEEP 192:uuCSvsNSUe+QKp9vUbBbhrQmiU1MZYoaGBPKpcCsmdb+23jdN3qZdU8:n3sNSU7tvUlbDEVCsmF+23LkU8
TLSH
T1F9423A75A878EC365CE7B105F48B3B639FE8107B99845F44E6F95B1C009B39C270A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ff87eecf3aa2fb887e473b159a4062d0e8c2f5c0d2180d766478c0d03088e170
MD5 acd49190044248f6ccf3b2d59b5dcdf4
SHA1 dbcca1b13392eeddbde80276413881503a060dfc
SHA512 5cd51ad8ee904d74c22d0824b0c7cc1997f7f20a4be96263db6b65f9299459eabef40e8040ca709535039b2e015e37d3c1ac8a97ea3f40645fb838034cfca01e
SSDEEP 192:uuCSKsNSUe+QKp9vUbBbhFQmiU17TPTaGBPKpcCsmdb+23YdN3qZdU8:nSsNSU7tvUlbZFbCsmF+23SkU8
TLSH
T1C8423A75A874AC3658E7B105F48B3B539FE8107B99845F44E6F99B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9ba2c7bf06a60e8a936c3ab716341ed8989a6f63fd3375b6afd5350882c71588
MD5 4ef50344e5569c125509c14b5c30676b
SHA1 a0f959871ac665cdb13090e91285c5457b79b759
SHA512 a09882b6c1e009967408b489e2180d008201f13dc444e9a8ee7a5c77eeba2ade52745d06697b51f9d69ad7a8b97f449f94a830ba8d6a495b3b279a460f9aab9d
SSDEEP 384:nxZcImsNSUFtvUlbs9fCsmF+23+knTKwBODNZOCHWH:ZmMvUlEajlOknewBKZOmWH
TLSH
T141928D75AC39AD369DE6B106F88A37174FF850B7A5C40F14E5FDEB1C00A6298270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c8d47d0cf8234a19231f733f842e4608d97dff674dacfb78c5ad496b9d1044ca
MD5 1c77b522e58f06ecac32e4a0fe41d162
SHA1 5135940318ac7ca855b62ec833e40ea989cac1d4
SHA512 bb3d7391a757f1364631cd5e0cb3f1481a34411a526e492ce05908d82bb00145bb4a79803e224c62edd4234b3e0a55ef01aa0093f21c5af955b480573fd5e722
SSDEEP 192:zQONSU64BbhIQmiU1TZ68UaGBPKpcCsmdb+233WN3qZdU9:zQONSU6eb676HCsmF+232kU9
TLSH
T15D220A75A865AC375CA7B115F4CB37635FE8107BA9849F44F6E85B1C009739C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fcd64b07148a5a2d347eb51744c80206547fca31d25a56eb1dc6b0bf9e5ad2fd
MD5 d662ba39cf2204d41999104fa45a9db4
SHA1 193608309bc9c8bf723ec886aafc11eb88dad07d
SHA512 de3f102191a5dd5373a47cf606c711d829787ba3f5c20edb5887100e3fb32793934ad94b4459400f0690795501b40e64e1dd5d082af8a423e0f9666372bf782b
SSDEEP 192:zQONSU64BbhIQmiU1gZuZaGBPKpcCsmdb+233WN3qZdU9:zQONSU6eb64ECsmF+232kU9
TLSH
T18D220A75A865AC379CA7B115F4CB37635FE8107BA9849F44F6E85B1C009B38C374A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 260ae56c021bc2197a97723f2683469a11b902bd4c6bd41904f1c2b8784a2b7c
MD5 a228e7ebed1a7fd3d762c436262d821b
SHA1 b6131457dbb441c350880212bf081fff8111e9dd
SHA512 dc080f86fdb916eb7f38ec1f140a6686bff2e7f3587fc708174dc7989136bcd81ae55da0016e605f195952e634038a56e6013250a53c48d6bc26c587bed9db47
SSDEEP 192:uuCSjsNSUe+QKp9vUbBbhgQmiU1TTkUaGBPKpcCsmdb+23axdN3qZdU8:nbsNSU7tvUlb+9tCsmF+23OkU8
TLSH
T1AB423A75A878EC3659E3B105F48B3B639FE8107B99845F44E6F95B1C049B39C370A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4220726c6475e5d09a625ff0e4b6ba060e6b5e29be0c4b924816376fdd10c267
MD5 733f4390fcd502afd76dbe29d21fa908
SHA1 3724efa8f092608c381000c896839e5e0911dbdd
SHA512 e737955bd50d750208eb49715a06b813e5c850a61bbca8370c611e23b629b9c067119ba18e34177595b3064b2d16ff1faa6c3ef12b084f592924371e1dcf482a
SSDEEP 192:zCcsNSUJQKp9vUbBbhPqQmiU1uZc4aGBPKpcCsmdb+23jdN3qZdU8:zDsNSUJtvUlbE+dCsmF+23LkU8
TLSH
T19E322975AC78EC3A58E7B105F48A3B639FA8107B99845F44E6E95B1C009B39C270A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5efeb88-b724-43d2-a760-2536a3eebc33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5efeb88-b724-43d2-a760-2536a3eebc33.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AppCache134300980947162596.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134300980947162596.txt
Size 79KB
SHA256 5ba2b0bfdc540654e6299c92005090c96d2b3cf04c7125ef98f31d4875ced6aa
MD5 7dbba18a894484c4ba3b590aef1ff0ac
SHA1 b460940199e3697b6487def792c36b97163555ff
SHA512 9c3c8af2c348059c4652dc75a8109c3ef11653d9af85d5bc7a996f8869e9ca2aa70ca53ed55f57f84ecc1a36737fe31dbdfa4a2f658b6c95d360c848b484dae6
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/il:vYBXMxooRy1D
TLSH
T18C83A4A53281CBF3313966A0BCD9E435E13926B1E0A88F4561FA9613FD5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bf169fd-5f59-4365-a44b-7ab7b442c44d.tmp

Path C:\Users\Admin\AppData\Local\Temp\1bf169fd-5f59-4365-a44b-7ab7b442c44d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa4e98dd-7f9f-4dcb-8cec-c64889af3acb.tmp

Path C:\Users\Admin\AppData\Local\Temp\fa4e98dd-7f9f-4dcb-8cec-c64889af3acb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_1411488558\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_1411488558\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

3936d0bd-6c86-46da-95e2-a766e0ae97a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_374083444\3936d0bd-6c86-46da-95e2-a766e0ae97a9.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_374083444\CRX_INSTALL\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_374083444\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3688_374083444\CRX_INSTALL\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h75jj20j.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6k92jrsj\h75jj20j.exe
Size 5.4MB
SHA256 f5e49f40f4016f590f99ea462b82d6fe6a97e5697a5e80ce96aa50bf1100d7f4
MD5 7810e041cd14b785b0964de59c96a348
SHA1 9d06302962a68e9f78098ead46e6699cc3c13b85
SHA512 a8476388b7d9fea676c098b074616bbde1e88a67d2cf0cf9c73fe05f35fdf430e9ff5c6c5eda8a37452d747caba2de9a0931c4c0e6cf953c5db79a5f2f94558b
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uJ:AsTICteErownP0oTcMsABqljky
TLSH
T16B463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3740-2210-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2392-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-1534-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2233-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2242-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2251-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2438-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2179-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2437-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2436-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-869-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/3740-2218-0x0000028813E20000-0x0000028814294000-memory.dmp

Download

memory/7412-2267-0x0000000004690000-0x0000000004691000-memory.dmp

Download

memory/8888-2296-0x000001DA1E530000-0x000001DA1E550000-memory.dmp

Download

memory/8888-2297-0x000001DA1E940000-0x000001DA1E960000-memory.dmp

Download

memory/8888-2262-0x000001DA1D240000-0x000001DA1D340000-memory.dmp

Download

memory/8888-2266-0x000001DA1E570000-0x000001DA1E590000-memory.dmp

Download

memory/12036-2197-0x00007FF723D60000-0x00007FF723DC7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads