3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8

Analysis

max time kernel
5s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
Size 5.4MB
Sample260801-2pft6ayerb
SHA256 3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8
MD5 68a142423e4c4b5757af73e855bc7da2
SHA1 6cdb6b5dd2e10d97c0b51e7250405178eb1e64ce
SHA512 8c5974a97f6faf8a9f517775efc24cd327ccdc9f205ffedc30002b2340ffa4e047a901961d815f7fa57e838144b4a623a6461949aaffb00222f40297bb66e21d
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uR:AsTICteErownP0oTcMsABqljks
TLSH
T125463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x8v8cb.exe	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x8v8cb.exe	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe

Executes dropped EXE 1 IoCs

pid	Process
4420	zz5mt5bn.exe

Loads dropped DLL 11 IoCs

pid	Process
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\7nh0sgx9\\zz5mt5bn.exe"	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
10767	ifconfig.me
15291	ifconfig.me
2119	ifconfig.me
5418	ifconfig.me
2838	ifconfig.me
3155	ifconfig.me
3427	ifconfig.me
11520	ifconfig.me
14446	ifconfig.me
464	ifconfig.me
2357	ifconfig.me
2494	ifconfig.me
6337	ifconfig.me
6690	ifconfig.me
10440	ifconfig.me
15225	ifconfig.me
15315	ifconfig.me
1421	ifconfig.me
1687	ifconfig.me
5005	ifconfig.me
14845	ifconfig.me
1	ifconfig.me
2995	ifconfig.me
10476	ifconfig.me
484	ifconfig.me
4541	ifconfig.me
4637	ifconfig.me
12271	ifconfig.me
12667	ifconfig.me
4132	ifconfig.me
10369	ifconfig.me
11625	ifconfig.me
15229	ifconfig.me
101	ifconfig.me
397	ifconfig.me
549	ifconfig.me
1437	ifconfig.me
1522	ifconfig.me
5354	ifconfig.me
10162	ifconfig.me
11519	ifconfig.me
331	ifconfig.me
355	ifconfig.me
2335	ifconfig.me
2461	ifconfig.me
3099	ifconfig.me
4557	ifconfig.me
11459	ifconfig.me
1786	ifconfig.me
3089	ifconfig.me
7859	ifconfig.me
14192	ifconfig.me
409	ifconfig.me
978	ifconfig.me
7236	ifconfig.me
9428	ifconfig.me
13291	ifconfig.me
1223	ifconfig.me
1303	ifconfig.me
2905	ifconfig.me
5255	ifconfig.me
6723	ifconfig.me
11816	ifconfig.me
1699	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5284	cmd.exe
4108	cmd.exe
2892	cmd.exe
2320	cmd.exe
5156	cmd.exe
3080	cmd.exe
6676	cmd.exe
6612	cmd.exe
5728	cmd.exe
7000	cmd.exe
1176	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5332	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 5936	2708	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	89
PID 5936 wrote to memory of 1176	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	90
PID 1176 wrote to memory of 4264	1176	cmd.exe	92
PID 5936 wrote to memory of 5332	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	94
PID 5332 wrote to memory of 5544	5332	msedge.exe	96
PID 5936 wrote to memory of 2064	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	95
PID 5936 wrote to memory of 3360	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	97
PID 5332 wrote to memory of 204	5332	msedge.exe	98
PID 5332 wrote to memory of 2076	5332	msedge.exe	99
PID 5332 wrote to memory of 204	5332	msedge.exe	98
PID 5332 wrote to memory of 204	5332	msedge.exe	98
PID 5332 wrote to memory of 3708	5332	msedge.exe	100
PID 5332 wrote to memory of 3708	5332	msedge.exe	100
PID 5936 wrote to memory of 2244	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	101
PID 5332 wrote to memory of 5824	5332	msedge.exe	103
PID 5332 wrote to memory of 5824	5332	msedge.exe	103
PID 5332 wrote to memory of 5824	5332	msedge.exe	103
PID 5332 wrote to memory of 2056	5332	msedge.exe	104
PID 5332 wrote to memory of 2056	5332	msedge.exe	104
PID 5332 wrote to memory of 2056	5332	msedge.exe	104
PID 5332 wrote to memory of 4944	5332	msedge.exe	162
PID 5332 wrote to memory of 5556	5332	msedge.exe	106
PID 5332 wrote to memory of 4944	5332	msedge.exe	162
PID 5332 wrote to memory of 4944	5332	msedge.exe	162
PID 5332 wrote to memory of 3716	5332	msedge.exe	107
PID 5332 wrote to memory of 5556	5332	msedge.exe	106
PID 5332 wrote to memory of 5556	5332	msedge.exe	106
PID 5332 wrote to memory of 3716	5332	msedge.exe	107
PID 5332 wrote to memory of 3716	5332	msedge.exe	107
PID 5332 wrote to memory of 4336	5332	msedge.exe	108
PID 5332 wrote to memory of 4336	5332	msedge.exe	108
PID 5332 wrote to memory of 4336	5332	msedge.exe	108
PID 5332 wrote to memory of 2148	5332	msedge.exe	109
PID 5332 wrote to memory of 2148	5332	msedge.exe	109
PID 5332 wrote to memory of 2148	5332	msedge.exe	109
PID 5332 wrote to memory of 5300	5332	msedge.exe	111
PID 5332 wrote to memory of 5300	5332	msedge.exe	111
PID 5332 wrote to memory of 5300	5332	msedge.exe	111
PID 5332 wrote to memory of 2664	5332	msedge.exe	112
PID 5332 wrote to memory of 2664	5332	msedge.exe	112
PID 5936 wrote to memory of 1996	5936	3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe	113
PID 5332 wrote to memory of 4700	5332	msedge.exe	114
PID 5332 wrote to memory of 4700	5332	msedge.exe	114
PID 5332 wrote to memory of 4700	5332	msedge.exe	114

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2292	attrib.exe
3832	attrib.exe
2644	attrib.exe
4608	attrib.exe
4944	attrib.exe
6732	attrib.exe
6688	attrib.exe
6752	attrib.exe
2796	attrib.exe
4264	attrib.exe
1512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
"C:\Users\Admin\AppData\Local\Temp\3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe
  "C:\Users\Admin\AppData\Local\Temp\3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe"
      4⤵
      Views/modifies file attributes
      PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x34c,0x7ffe4f29c188,0x7ffe4f29c194,0x7ffe4f29c1a0
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,10441860637822862618,11489634301605215640,262144 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,16805451390427256559,8677054642995383738,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11837454554760840636,1870375898212810264,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,12890111421576705497,486769438234524754,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,2710350658897221329,5580029266399413781,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,7219543268005102394,1469313261445490830,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,10873927858454750007,10785512056477777004,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:9
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4408,i,17116888601249137618,15492691915114354431,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4512,i,6296366880907150370,15460973233239159700,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3876,i,4044754739932771890,11038571808657359103,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5740,i,12667105773439840978,10766082454195110439,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,735327750689449810,5363960602245351409,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6088,i,16615871805689429316,17371197309202313240,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6268,i,8602110014320504316,9213904588788586577,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6096,i,17343686164970648720,14217399901413514574,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,839835620186909654,6738763899891573645,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,839835620186909654,6738763899891573645,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6188913291008724614,176981831898889089,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6856,i,9957089294050110663,8795489046954032744,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,913261180375369075,2709827416582541391,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5980,i,562981070621665540,183670198590638948,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5332,i,14120228163171984547,15596306761880590632,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6932,i,1804951143521896374,7205979827438532636,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:1
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,12266722844769222949,9171952157572063728,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,3877716779425748853,1879528064782463327,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7156,i,14586978725749396315,5916927207781570681,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7200,i,956023179798481237,6974005873294624538,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7144,i,11033653461921798372,10201241534112037980,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7216,i,5566928565793528612,10427975585004128750,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7412,i,12020535253609416270,12236734987363499869,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7416,i,357104532899867323,18057332322082676899,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7488,i,4727620035036275795,17225269843037800103,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7240,i,18101941515430179530,5017175108937236978,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7444,i,11489775723937206672,17567402731436694251,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7512,i,11497674822915541927,829089694548572477,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7344,i,5795049411464458020,735757283683885778,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7864,i,14413806731611386031,7632338467184776554,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:1
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7876,i,3780830498127680636,9597061263019794344,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9156 /prefetch:1
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7816,i,5020533045235487648,15175711239656122890,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7460,i,2508913008896650244,10132366919822704449,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7840,i,13912921942783467407,2796762762775003798,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7856,i,13032547827373245665,4805800794160070813,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9236 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4532,i,7616711856360103781,15268909259740355747,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:1
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,12084314545528631388,4619597957335238899,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:12
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7476,i,10454752255599724565,12772684754071929340,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5868,i,6816182008055370124,1828723007259494555,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7924,i,4258308059448036209,2686810111428529998,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
      4⤵
      PID:6192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4728,i,6154930030500770951,10165333665732701323,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7392,i,13438989234786091994,5305597355730955774,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7860,i,7180882567059160707,76817636443895302,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:1
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7656,i,6505526644756031342,13971819116397931497,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8024,i,645880492820590738,4255950236425465085,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8056,i,3638681335935337208,7040902189135253636,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8088,i,10741803593556205686,1560938133084265681,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7664,i,3982992735495983040,14633030022500489132,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9384 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7648,i,9721681842628507893,10342112332171401088,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8104,i,4243297750472271936,9176439081016528535,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9568 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8124,i,9756498321312801712,4305490794204137082,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8032,i,5787414834677521776,9811775031703896170,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7576,i,17485294344177276047,4810864104940803790,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8160,i,16494781422605793354,9093041337825840368,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:1
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8224,i,11801391454819522034,8714623672519732582,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8176,i,6242941955388316299,10607713192962667157,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:1
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8216,i,6814248432875436411,15435785063416699256,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8236,i,15294630131564652020,2675776156196658538,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
      4⤵
      PID:7884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=5340,i,4434327513140117471,12362235502619836599,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=11068 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8256,i,16998823942980095251,3091092374842429351,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:7900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8260,i,12956052928931078355,3860878396651250757,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:7908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8316,i,3041514896130740583,7610112419491468722,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=11072 /prefetch:1
      4⤵
      PID:7916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10164,i,1604253771005721756,10846672220038004962,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:1
      4⤵
      PID:7932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10264,i,4495479601729249949,353633501501536727,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14816 /prefetch:1
      4⤵
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10408,i,11489752748290026641,7735663259955567777,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14888 /prefetch:1
      4⤵
      PID:7956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10596,i,9278794959088109445,8576835829205067387,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15028 /prefetch:1
      4⤵
      PID:7964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10584,i,1870951620261353970,17670315349207205318,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15016 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10452,i,13593120502314548340,931408582054262093,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15008 /prefetch:1
      4⤵
      PID:7988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10336,i,17921531630887793326,2396953423992182568,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14908 /prefetch:1
      4⤵
      PID:7996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10276,i,11432473646658531548,4001927761088377003,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14804 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10340,i,4030580515850017521,14535284602196668584,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14848 /prefetch:1
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10268,i,553061916293050920,16632649409785109587,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14868 /prefetch:1
      4⤵
      PID:8020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10604,i,8212908592135403748,1711526779678627307,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14792 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10536,i,18292161696733734569,14564089146573668571,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15272 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10156,i,15509194384027167572,1004549726674485308,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15268 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=6848,i,5207228976947096841,7363860941798928762,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15280 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10668,i,2022223357319600104,11786511187547853415,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15252 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=4452,i,529579928576919912,12702382364979822400,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15328 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10312,i,14204364339481539323,10096291681200702797,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14828 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=4524,i,17247954466270149324,1417749772362379645,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15400 /prefetch:1
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=8692,i,6783477514443504876,15610479491805890170,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15404 /prefetch:1
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10588,i,5122173942860795146,12869620855345238083,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15012 /prefetch:1
      4⤵
      PID:7972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=8672,i,11710255324568454634,7856092884396002138,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15416 /prefetch:1
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=8688,i,16090307748127661579,9810819339472858637,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15428 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10752,i,10900181354801880557,2414308077585781120,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15484 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11000,i,17393640539980511374,18393856823244920601,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15784 /prefetch:14
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10780,i,16622646059019491084,13924259802625859222,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15572 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10456,i,14263823767769691613,6346659406051848372,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15264 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10712,i,10039278873999683935,6453570705935879578,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15468 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10236,i,18348480487959473258,3799318047331265997,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=14800 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10868,i,16338498517812618159,10020354979565355681,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15648 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10772,i,15433376108343492609,7308381014931386328,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15636 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10784,i,18369692599357775889,17006966823394626170,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15552 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10948,i,14606832858499569423,10141470243104379700,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15756 /prefetch:1
      4⤵
      PID:1012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10980,i,16390620883703501276,1623326262862529223,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15760 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10916,i,13387310584110434306,16860263531464690551,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15744 /prefetch:1
      4⤵
      PID:8188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10896,i,1254254254546164001,11895820006299137087,2097152 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15680 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11004,i,2091535001918790036,17292308799581038249,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=15884 /prefetch:14
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11008,i,9142378878268615974,5967010429938923395,524288 --field-trial-handle=1816,i,7712066771977940219,1992824670600020133,262144 --variations-seed-version --mojo-platform-channel-handle=16068 /prefetch:14
      4⤵
      PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5700

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe
1⤵
- Executes dropped EXE
PID:4420
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe
  2⤵
  PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5284
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe"
      4⤵
      Views/modifies file attributes
      PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe
1⤵
PID:360
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1uwc4wn6\hxvmfagr.exe
  2⤵
  PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe"
      4⤵
      Views/modifies file attributes
      PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3508

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe
1⤵
PID:1148
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmexw7if\ynjdlb0f.exe
  2⤵
  PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2892
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe"
      4⤵
      Views/modifies file attributes
      PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3600

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe
1⤵
PID:5472
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\73jhrzpk\ni0tvr79.exe
  2⤵
  PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2320
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe"
      4⤵
      Views/modifies file attributes
      PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe
1⤵
PID:4984
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bba4d4qd\awc9sv8q.exe
  2⤵
  PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe"
      4⤵
      Views/modifies file attributes
      PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe
1⤵
PID:5920
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az302q6v\u3jxh1ap.exe
  2⤵
  PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe"
      4⤵
      Views/modifies file attributes
      PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5236

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe
1⤵
PID:6560
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7beiosda\pp0xcoax.exe
  2⤵
  PID:6632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe"
      4⤵
      Views/modifies file attributes
      PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6988

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe
1⤵
PID:7112
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xou9f87r\iu5lmjly.exe
  2⤵
  PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6612
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe"
      4⤵
      Views/modifies file attributes
      PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe
1⤵
PID:7160
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a235j8vh\eceort3v.exe
  2⤵
  PID:6628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe"
      4⤵
      Views/modifies file attributes
      PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6668

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe
1⤵
PID:6496
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmdxbib4\g9dxiqqy.exe
  2⤵
  PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7000
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe"
      4⤵
      Views/modifies file attributes
      PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6476

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe
1⤵
PID:7408
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1smyqsi6\644b90tg.exe
  2⤵
  PID:7516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:10724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:11032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 216KB
SHA256 56bc7ac6acaa25afe838f2ca32f7a72beb54461b58f55b2f28c3488746870087
MD5 410cf275cd7f9d362200638c5afa80f6
SHA1 6cb36380133e39ae49a36e3008b6f407ac1e0307
SHA512 c3ef1f1824ded1788eedbf642ecb2fbf63d67a5eb9a4f2b00b777e5e824002b182187bfcd31dc1e5636257afdc3255b5851e05b750d9ee00428dde11d16e5687
SSDEEP 6144:l3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5geoV:l3s6GMsNRQsejEqgcMhGxmioI
TLSH
T152242335FD796A8039B2D6CFC6176349E1F2AA1BD4D4826E1E6F481717843C9B2CB0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 149KB
SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
MD5 dc396e633ee01774f0f0b2f1071a566d
SHA1 46e628c30392dcac3b041b5bdfb5df890231d143
SHA512 5bb2742d2d0339e1958cf57c7f8f176a1eb7160436fba9ab43d8f9466a7b0f4a40c7720b03878802474778a5cd1712e68508c5cdf73820cf674341d1e99c1a98
SSDEEP 3072:cbzKhLEOClRbBX7XiCNVHkz9JHXslX76tejVBedwYEdidbKjcDO7MA:c36lShBrXLkz95slL6qvYEdu+jJMA
TLSH
T16BE312182A23CED690EF543E9CF37CA7762F6D902F50599909B3388C524CDE19B5B398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 90KB
SHA256 263020bed87acff73c7d214ddb889b6c47f9a3e95a2511a20f0893d68dc81ce2
MD5 5be32e7f14935ff980ce5d52f532d67e
SHA1 4b525077acc456bd15798bad58d42fa3b6def462
SHA512 19c544292ffa1d8e11ba331b894141f88404bd55fa7f76c29d4fafaa6eb5193d4e8f24ee5eed91a5fac15ec86e46c9962db6fc65c0bec1028037cbb0e50c6e9c
SSDEEP 1536:dOc80HUHZxmCk5REHO2kDt25/BtsF3tf1OMdJWjeCpe7f94tabF/+6wXay4Op9:dO100HGCk4u3c5/r+tf1OEZU4FG6wKOH
TLSH
T1A493028C4390237F9623BB115A716A7E4D2B86AE700BAD1D73D5B3743814FBCC961A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 105KB
SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
MD5 68b11256fdb00ea264efc414a3081289
SHA1 edaccbe8eb8e0326944b82d03d00be43460e2d7e
SHA512 f8db4fdd6d8315e3151790263a353bf89666dc675e13ef6cf3b084e05f6c03b596c8707fadfa43c42d7201fb86680e4574f0a0915518a5d5911c0d1a0bb0f9dd
SSDEEP 3072:ym0RR8FYstRkmRYjNUUetU+0Q+FgPv474lJstNMWL:SRR8Fz+UUSmQ+F6wVNMY
TLSH
T1D7B312969BE7F3DCC165A8F78949F361D01C6EC81016EB6691426337CFA9001078AFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 48KB
SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
MD5 7fe007c57ea8a8682c097519166c4943
SHA1 7de32a85a9c2e094c62d5c393a44e9d4b0ee0b28
SHA512 298499a176722aee739bc846b96209ff4f618c7ce305acdb1f930d4e6be5961b411bed13363d1d766ccc5c470facaaee9bfcba11b1c04cf4e2de9b952df32d0c
SSDEEP 1536:KkUOL7TTaDZ3v+Whww93ZrTHjLgOoXRk/a:ZUGuFvnhww93Zr8hBkS
TLSH
T1962302E24F47584EA81B6BEBDC91564F3CCD00A519F06EAD143F81941AD6E858C88BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 25KB
SHA256 702565d9a2c68ef25af3e9e6cd8df0a7807cf1baf503b378908cb10f7fc3d7c7
MD5 d146e8b7de85fb77925dd0ab09ac35a4
SHA1 4c0ceb3c88e64edfbeeb93e69db7e076f7beeb50
SHA512 0abd1e8121b0317251bbcc71356bb2b10b238c2cee875982faaee728d78254b4bf4f96814f696fbed11c58fbecfb29931b86aa6571a33cef15ee92a57dc8809d
SSDEEP 768:9kBKg8b31hjeo2b/46KjQCtsHbls7q/m4qQQ/o:9kx8jj1xHWblBNqQ+o
TLSH
T1E0C2E03977576132F73CECABE39168E065DF15F2703A3AEB079E4917205074D6880ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d298bfd6b2d7e16_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d298bfd6b2d7e16_0
Size 545B
SHA256 18627e64e974a97f9cacc4ab6d9d1d6b52af9ee739f5769edb1977214f888be1
MD5 062eec742c88d43dad11afabdce4a77f
SHA1 1666bcf0b9a235031203eaa63a82ce9bf9ad6c1e
SHA512 18834a0f01e026b403f645cb93fab3b435971652f9bd759e5d08187e4bd08a771e63006e393deb9204d6492e118f687963ab9ebf9dcb64c859512e5650c503ca
TLSH
T192F0EB87C088A856FA240ABA4DE693239383C0E089A887E7801820D33647C313C5CBE5
MD5 SHA1 SHA512 TLSH

Submit Download

645b050eb5de9cfb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\645b050eb5de9cfb_0
Size 591KB
SHA256 16de0228cbbdfd1d95ed32a9c9aecce74b7f65bfb9c434f7cbe398a2295a896b
MD5 68783e2d02920c33ed0362e1ee3f9dd3
SHA1 49aff8dab4901d5ca280c4fb23bf0bc11db44383
SHA512 ef2f399035f869f38f4f698d34aa2802c58b9e362fe9584263eeb4eaee494f00dddba4a95648bd245ea4f5bc92cd3a0e4f576f2bcfb6e6ec2ceeb694572ade9a
SSDEEP 6144:GeY4kPM7oRKyZWJR2veWeO0pMEKquiwVTtoE2QFOC/ZEA/52blfk:sP7E60wwO0prATtodQFOC/5/5glfk
TLSH
T163D408491790EA59CB7623F401A38913A73580483EC7E727A1E5B7363C493E16E9BC9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 b33b5f9d8925cc8da844f19bb07020a61b39a4f057fb11c2216cdf0536c60314
MD5 317314db93d0b71d49ec262986632433
SHA1 68582e628aedb9637d00ebc64c0305750e421dff
SHA512 95d931ff50eec2d9ed3898bf8a0f0819c96a522d53045d6b4996146b913bc5fa8e668e207f14d497fd318f597bf2086b170ef9ba98596cd6008c4556b3a1b514
TLSH
T178D02B1F8D59F873EB589BF0DBA25106C21398655DAC80918016727321097B4C945511
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 31f73cc1459005fc5676683e476cd89b787476a4d548619236d41882ea7c4dcc
MD5 b4c3b9428bbe3d6eb81ea4c30cc1d0ec
SHA1 9c4eadade1453ea7e19c2e345135134f9d46e244
SHA512 de283892ad9a7fd7e30ac498a412e8393a79597435336cec6a882879301d214b1752a50aa6f86916ad91e8be813df459edf529937321905d911f3f045235b51d
TLSH
T10BD02BAF05685821CD7859F5957B2101C1D3A0280CAD54B18A0424737C5267095AC215
MD5 SHA1 SHA512 TLSH

Submit Download

9f375989af22cc47_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9f375989af22cc47_0
Size 284KB
SHA256 52ce88a6a82f66cc9884645622bee72437c3ad0b6ea0dbf784a44c74acdd4323
MD5 8a1186c51a5fdb788d4cbc917a17565a
SHA1 fcfc11b7bd97417988a1d803298081f6111b4bc0
SHA512 ff7bd603718e83cf1c2a5ada72538aba52aca8f5142eaf5e32bec3f9bab1f0c03f4a2c845bc2da3ae19e0be414880ad39975218dd02560802d10f64871860037
SSDEEP 3072:3r+Iy46FKuXCMMZQOqwgyX+ViN4sqQngG2DCL/2BbEMOm+t0OWfs:3rNy4Fjui4TQngG2DK/kIm+tTWfs
TLSH
T12154C6651B90EE15CF7663F51262C953A73591483FD7931372E4A33A3C0A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdf8ba3b9607cb8e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fdf8ba3b9607cb8e_0
Size 472KB
SHA256 30124f09ac5bce9afd1038c456e84cb95f2ace772981b2231fea46a95f94c51e
MD5 84200364db7cfa0e8ba6a5e3a79b9be4
SHA1 a10297d72ed866142db84e32281067f2c741c363
SHA512 1439ef5af8739ac034e4bc019198b138ad6e26d9a6d145e5771e6c8aa1887342bd776cf657dd244413c840e8c87cf21f779442ab7f1b17cb0655ec607e4b2d36
SSDEEP 6144:QG5fC/Jn/a2P6HN4riYzevaq4wa9LeKQUFgMD+dxsA/1HZ+f7D6:QGCt/XiHOlQSwI6Midxsq0f7D6
TLSH
T1ACA4C64917A0E955CF7623F442A2C953A73144497EC7E723B1E8F73A3C4A2E15E4A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5311bde9b562e2ae07c4399b105e885a44826c306b1be0e48c4e2433f361f39b
MD5 4864f6416e240479e39e7f29c90ae745
SHA1 a82468da1c862e35ca0ac6c551b1f4c653583ea1
SHA512 e2be3f5b57b2a62215024180e82ca983ef909e3420420d9518f7093b0c02c1874a91a27e5fe65a55d6971dccbb402227850deebc02e81ab71b7719ce8ac62afd
TLSH
T1CA7146588BE51FA3E79418F2D4EA44ADF6F1D1E820075B6A52A93DF48C0EF9810D34A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59af22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59af22.TMP
Size 2KB
SHA256 15847f95499caa5ee9e16fff0a750260560ca19410c203599b02751e945368d1
MD5 dabf9140fb0613a4ae93cd9eefac290e
SHA1 841ab9a34c8e9d664f8f891da2f4609cea5393e6
SHA512 8b3b6a7dce581038c971e29423ce0ba9d498dd7ee8a97301a6d1ff927d4c8a709ee068855814378d3f1320be92517794748baf373e29f04f00ac0a5e6ff80a74
TLSH
T192512C588BA65BD3F36058F1D5EA84ADBBE0E4E900076F1A53E13DF8490AF0920D21D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26b383d3-7269-4584-9605-0084e0cb679e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\26b383d3-7269-4584-9605-0084e0cb679e.tmp
Size 5KB
SHA256 66a02a83261dc3fb5ef20fe6ee115b0b7853221c13316d6dd3de2321628f7862
MD5 631e528a8f27fe14ed5a27aa86c666fd
SHA1 62e47ae73571a1dd24aba0a8eba277bf1e68fc96
SHA512 1a31252124035296e410ff4f9004deb6862b3e62ea3b1675f2f8807a898f03e3e4eed6c8c80d39cc04f9b95a6c13bbf5d7c94e46125b8a536bf15746dfbfee96
SSDEEP 96:DcOEir0Oz23uaCzLZzZocozBwBQiFVCFQ9bL9BmgW:DXEir0Oz23uaCzLZtoco1kQiFES9bL7G
TLSH
T17CC1ACF7C3E4962DDC2196F0AB146E2BCE290915532C3D5AC9D4AF5BA7E2870E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ceb7590e979e6cc4e7a9101d9ef50a01cbc48a6fd36a4448cb1a1a6ac6223a84
MD5 b281e1b5de121641b1bad478b2d293bb
SHA1 274d3dd43d88a299e1fc79300d1d0b808aa09530
SHA512 6002a9c21b4f581f053c99d4045ba3155e0aae7db5fb05e2f6a84a93b20344171e18a8b11a74bc20ddbb933d3efefedeaf88377edc1f6e24530491e427c9442f
SSDEEP 192:sxRbRKCf/fqs4n+KHm2Sm7apyjzoD8pK1UjFGTHg6+WNscilul9f1fYBkBLJGzIG:sxRbvf/fqs4n+K2jY9g75OCLfjAp
TLSH
T1BE42DA17A928A93B4DD7E219FA15BF23D3F9102261D11E58F7FCCA1C11EA6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff340e0cd912bc6b0ae7f5197e6419a51425bc6bc7d569dfa7603d7982e4988c
MD5 f731343ac1760764f5001a5133f26d80
SHA1 6faf705e0df80e06655bec3e165f143ba9f065b3
SHA512 550935ea6ee244fa37b34ce178e7020b042ea6bc073c485c57984bea3f5d961d171c34adb59595688db7e5beb4e2dff61e0b9c11c0f516402928f2f24b30d2d9
SSDEEP 192:sxRgRKCf/fqsyn+KHm2Sm7apkjzoD8pK3XjFGTHg6+WNscilul9f1fYBkBLJGzIs:sxRgvf/fqsyn+K2jyeg75OCLfjAB
TLSH
T1CC42DA17A928A93B4CD7D219FA15BF23D3F9102291D11E58E7FCDA1C11EA6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7ca9cd4877242e54a330b75ddaeb72b61b0d5c21fb015c249649909021b0dce7
MD5 a048e569983e673424380e4ca289a3e0
SHA1 831ea9e0fedba7549a2f86595274c5da237bc0b8
SHA512 50756e555bf05bf605df5a9580883c35d7d8c520e9e907435d0fec820d3ab08c019d63940b1f45aea78704628f588ed104af4b37a3562440c49521c2edceaaee
SSDEEP 192:sxRgRKCf/fqsyn+OHm2Sm7ap9jzoD8pKc1XjFGTHg6+WNscilul9f1fYBkVJGzIs:sxRgvf/fqsyn+O2jxvxg75OCLfwB
TLSH
T16352DA17A928A93B4CDBE219FA15BF23D3F9102291D11E58F7FCDA1C11E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ad079802266efe2abf6ce390f03d0f79da3b8c78ea8c995ef30dc404e3ead909
MD5 8d1035b787cd68bbbe7b0f0cebe2d073
SHA1 175696b54fbc1fc0dd5ad779711e52bdb66c335b
SHA512 2d7f48e2e03e32436ff6d66bf1717e07866d534e06e4a1e7b9710f9e62e70ef6f9a70606133456af3fea75d54a072ffe3f863d15f38124b6c38f2c1e74ff65d8
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHEFw0Oy2UWS/fg8UK4Rg2Uc00/uUJmzuKY:C1i7PF/DWrwfX9mgpct1o7zsHEFw0Oyq
TLSH
T114A15352B07F02403C7E6D5C85B9A81B96C135A73518A56B7FE811A20F6BE034CFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8d5179f-7bc4-4e38-a1f2-276502c8c7b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8d5179f-7bc4-4e38-a1f2-276502c8c7b9.tmp
Size 27KB
SHA256 7deab781db43d3760bf9f1d7782e44b02917ff7855f62783e4721edb1dde8cd0
MD5 9e582d2c10a9bb28e395fc8321975a20
SHA1 7d8fe68c4bdf41bc49fc5f94cf57dd2622a5f10c
SHA512 11c20a2f0c5168e6cb191fb2bcf057cbf9e5dcbf302bf9eefead5af9ac9dd613faec8e73c6f9fefdc6cac974e5cb9df7a2dc1a22bdb3ec90cb638ff38d9ca24c
SSDEEP 768:GTEbGo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9MWcEroS6yiX:GTEbGUE7lkWg0CfKsu1ja2FcPSwX
TLSH
T172C2EA7B640CCB7E4F804ADDA819BF9B6D6802CB5A98CD8047FE951C02C6BFE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1b3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1b3a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 78965e323bc61bbcef5abb30a68154db156dd74619bdc86047eddfe772255273
MD5 0f7d3f345836a596492b0ca4620bdc13
SHA1 fa351090abd39e60e1d70fc5b947e776e4555d71
SHA512 da186bd9beb219fb313005d22e93545f57ddee0b2b87f35bd6118d134d53c6764f197d094f1a4d6bf7e5ac4d1f14d4ca99f6935a0ebf84413077818476926462
SSDEEP 768:Y+3ivSc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Y+3vwfXfr6WfL69vSZ2evZ5x
TLSH
T1B9F2BFB1EC7429739EE2D749BA466B03BEE49223D1C41658DAED5B0C01C379E230BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 741f187123df07dc84fd1c295df53f9ef97f1745232e321b77d27bb6b285d196
MD5 04ae7b8a562a1971deacb1d1f32a7b31
SHA1 ae7cb4e8fcf0f22b0133573a3a9b08bf8688e340
SHA512 e0261a8fdb0b863fafb396bbce552c5a78fecbd1e3a25212aa180096f4d23747db29c08608bdc001bdd3f7da0c84d40374ff58445cd6c3ea7294663ba8ffc7fa
SSDEEP 768:5FQW3iLwg4eAtfZO8f466WfY66lvShCQRV2ewBKZOCWQ:4W3zfXfr6WfL6lvSZ2evZ5x
TLSH
T193039E72DC649A77EEE29B89BB067A07EEE45263C5C855D8DADD5E0C00C32DE130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 be61b3f6dfbad4e341a3ddf5147c91b7c830227098e1354c719d261fe32c2d6f
MD5 2538be5c9f348e2934c702407db07cf0
SHA1 71f2afee6ed50674e7c900471e2fb2ceb4cc629b
SHA512 3ca8e09144b4ebdadeb162625c5bdd52e7e28d05a75ce584c5ddd24a80ce81f7caf817241b89915cdaea09aeeaf350940b1a96566314e98abebe43f081406a59
SSDEEP 768:YF3ivEc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:YF3RwfXfr6WfL69vSZ2evZ5x
TLSH
T123F2BFB1EC7429739EE6D749BA467B03BEE89223D1C41658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fd925f671948a48aaf42c254ffb1db24ec0e1f5d9653d7b3cc162dfe7125cbfb
MD5 0aa76bdb9ab4a5eb4556afd60d231155
SHA1 b8db661d664b32b9a2f8566126178284f6dadf32
SHA512 1e347701dcf6c787e67fd5247b3b222845b1c1c793c2fb100e70cacf9dcd1b21860b20ed4b1c9db32f132bfbac1806fc4af2b1d3cc27bd182c15d76537860428
SSDEEP 768:Y53iq0c+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Y53cwfXfr6WfL69vSZ2evZ5x
TLSH
T101F2BFB1EC7429739EE6D749BA067B13BEE49223D1C41658DAED9B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ff6c51003cfb35c553fcfb8407a14a917e9c8704fbc62b24ac693f08979c65ff
MD5 ab808d8604c02a1e6e0fc2825cdec296
SHA1 f6091887bf07464adca64be6bbbfa50c1cfbbf8e
SHA512 35c574659da0f7bee3d6584fa9e53ed8f95110deb2c268fb322260152f5416094e2cd37dca016d7b16d8ff1d88a72dc031d05f6823d496b7f3003da99bfeb443
SSDEEP 768:M53ikKc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:M53+wfXfr6WfL69vSZ2evZ5x
TLSH
T141F2BFB1EC7429739EE6D7497A067B13BEE49223D1C81658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fd719877f0badd2f78f03982ba66f712208d7faf3b32f5347ab89c0856938ec3
MD5 c054703325a9cf79de185d23acda7ddf
SHA1 1b27296a3c166b95063ec5ff6ba7b5129fbe2f9d
SHA512 5a11e6b86604dc11c047760a25d2765cca1edae70a5200a27c8fc99e46048168358ff7e3a0358e957ec466ca586ccba1d215e33fd521d10660ab04f42b7d7ac1
SSDEEP 768:Rrv+4UNbd43qEkc+wfZO8f466xvShCQtb2bwWV:RbsbO3qJwfXfr6xvSf0wO
TLSH
T1AB03D072E86859339DE782487646BB53BEB85173C8C54784D6DD4B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 457cf9ceed4c3edc47371ffa9168423310a5423e47899746bb2d59fce842781e
MD5 60af081be75f32b8f69b60c819dca356
SHA1 db1a6bd8998dc4f6575790ef821cbcda218fb224
SHA512 a07f97273a4cebe729900f75a0012c4954aab976f791986268af39784293120e28a5e891a7cbee04b7e03a88b4d629ec8c503d92c59ad2f3f2433b16cc0e2ea1
SSDEEP 768:8rv+4UNbdK3ibQc+wfZO8f466WfY66uvShCQRVot:8bsbg3zwfXfr6WfL6uvSZot
TLSH
T10F03BF71E8786A739EE28748B6477F13BFE86223C5C54654D9DD4B0C01C36EE231B866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 74f12ad27cc4651fab5ffbcc73cc5173221c84567641afcbcd9e42e696d44dd9
MD5 7c72161242cc5daa77c760fc7488b24b
SHA1 562e298ddf3910b6fe230b45eb40034c22eb75e6
SHA512 b0090070201435078edb2e2172e078e4bc55eaf87bc957197fd66b0078c5a3aa29ba39dfc120a04f9656da90174bab33b13e83bb6c23f1f70ff970d9e0a3c9fa
SSDEEP 768:Yk3ie0c+wfZO8f466WfY66lvShCQRV2ewBKZOCWQ:Yk3uwfXfr6WfL6lvSZ2evZ5x
TLSH
T1F8F2BFB1EC7429739EE6D749BA4A6B13BEE89223D1C41658DEED5B0C01C369E130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8a05445b73b5bf56c9432be0bb808dd9f0cfdd08d2a7ebe0b45a1cfe20500d9e
MD5 16b701ba7dbfd613ea4788cbdf0cc1b5
SHA1 f809bd9bf33a86d4025f4aea61b4674d1743ccd8
SHA512 86a888150b40c65217a90fcd885b7e9bf1bca73f52b4d29e10ae59ed05e034392853038beb86e69c108aa60716ec523e5227b34152555f9c451d5a13e1be7da9
SSDEEP 768:Yp3iFcc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Yp3XwfXfr6WfL69vSZ2evZ5x
TLSH
T1F5F2BFB1EC7429739ED6D749BA467B03BEE89223D1C41658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b642d27794134cd23a4daf53855eedfe81d21bd02b0c2185361871b098c0e003
MD5 8aa45a7629b7af63dcb5dc4d37a1061a
SHA1 d0b1f5f9bd53a26c1bb446f8255399581148a619
SHA512 d9937f0fc5ef8f641d25e98667cae1102300b5805e5f369aec02a5555780953d1c2ba116a6ef9cbb6a9454ab764e361097c9ebd798007a94770227ee9c0b98c0
SSDEEP 768:Y73iAoc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Y73awfXfr6WfL69vSZ2evZ5x
TLSH
T163F2BFB1EC7429739EE6D749BB4A6B03BEE49223D1C41658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d62ac9b46cd11c49103e11cdc3f101d4ce1aa935abc82ca16aebe6d66b7f1a0a
MD5 0c9ea9d653f635e298d495d443c03858
SHA1 6873419f45824fd9797028a97d16116778542aae
SHA512 86399ebbec72948ef1584635ea5ae2e7256c07ba6fa052e0375b04e4ba37f8048fbf3e586dcbfa38a121861afe1ced8571a978b22eb1df825f326099b2bc27ee
SSDEEP 768:Y+3iL+c+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Y+3HwfXfr6WfL69vSZ2evZ5x
TLSH
T139F2BFB1EC7429739EE6D749BA467B03BEE89223D1C41658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d8a36058f238eb65bffc41da5d656dbab3ae6b818dc795bebc480335517d03ee
MD5 1e124d592a8d51bf54435cf550fe0155
SHA1 91f8da3ab1fd4e451182de347848e0c1b12eec38
SHA512 16bd3d1bf5461118fa7295b67d90c0bd9b22a3df383f5d143602b3ee88aa8e5ae90e2f56d84a97afab348d40e7179df6950cb97452de63e7774761d25eb59dbe
SSDEEP 768:Yt3iTuc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Yt3zwfXfr6WfL69vSZ2evZ5x
TLSH
T170F2BFB1EC7429739EE6D749BA466B03BEE49223D1C41658DAED5B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2a0da0fc1f6933b983ffb57e8cc7161da3e649228db2c67ae2c12575f9faa259
MD5 3a734ad7ce6f24fe21106dc2f66523f2
SHA1 3ece2adb319af4ac57cb21ea53db14d2ee0608fe
SHA512 37a1a38b9ba6115f088f9ba9a9e42f9a6cbd4dd5f4eb3f85534ef685301c3d98bba36b42e9595743be0ad78af9d522d8b260ad9460b46c187a9e01f0fced4514
SSDEEP 768:qrv+4UNbd43i5wc+wfZO8f466WfY66UvShCQsV2bwW2:qbsbO3HwfXfr6WfL6UvSW0w5
TLSH
T1A703CF72E86866339EE78748764ABF13BFB95263C4C54684DADD0B0D018769E331BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e1fbdb5ab9e86d3c703eae46855b457e82eef01fac24bf1a15b97c761ba316e
MD5 00c857d611480a6d3ea3549752a9359f
SHA1 498bda38b7f4da718a666d62004e5764cdf423d3
SHA512 c3261ee060debdb5eadfefb084fe82e7591d63aa6f47b44c5a0e29c9043fd50693ceb58eb19f969c4f8b69f4900c36ad711e9e36f9f0734049e63ce4e2e8fd9a
SSDEEP 768:Y93iEWc+wfZO8f466WfY669vShCQRV2ewBKZOCWQ:Y93kwfXfr6WfL69vSZ2evZ5x
TLSH
T1C2F2BFB1EC7429739ED6D749BA476B03BEE49223D1C41658DAED9B0C01C379E231BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4617b99f6b8318b0ec35fe75ec646595e073e99cd922e1c32212dc2b571097b0
MD5 89e97c15c264ea1fdac333631676e9af
SHA1 c8e1586f0ed3cf6f3ff0768a9b61b15acc0c24fe
SHA512 7920a868385e5f26df820af9d01f9e13e1665bbb89f82604459f76b229064efc8f36b54b11efe53daaa7caec5ed6b5217dd234cff46dff80e521d7d3c565645d
TLSH
T188E00217930044FBC02C173410C316103B73C53403C303575D5011756C103441D30C90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ae52d4079dedef8072676a725d1b15a85a30865f371f92a87ffb9759fe1d7564
MD5 3f17258269f2990fc0e68d4bee03c664
SHA1 027ea3d6f2443e1e265a1438f5daf56432a15943
SHA512 28cd1df1efbc56e568f8c251e266856c01a9ecbfbdc3fff27150fff4752c68033f7693433e2e405770b29ea0cdd474bd9bd6df705afaee50995ba0e7a5588a92
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe596102.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596102.TMP
Size 392B
SHA256 5f5cde7d7a24dd6d2d375f7017c7d63785c65ef661c8374be8714387ade8565e
MD5 bc5ddc65e4d20d5811006989357c767e
SHA1 93613b14a6fc8cffd33c296e95a4ab51b2574ae9
SHA512 d42daa9f30f1909ce7ed77a5d3bc6b09575401333846ab6273bce07be141358014eb54d9462ef0e95b8ac36b4e419160c677ea8aa7e213af1be78e73e13c32f2
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4e617b60-0543-4a1e-a931-aa435ab67bf4.tmp

Path C:\Users\Admin\AppData\Local\Temp\4e617b60-0543-4a1e-a931-aa435ab67bf4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27082\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zz5mt5bn.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7nh0sgx9\zz5mt5bn.exe
Size 5.4MB
SHA256 3676bc40c2da8846b442fdfc16d11676bbc62bda0bc6c41446e6c6cd6c6c95f8
MD5 68a142423e4c4b5757af73e855bc7da2
SHA1 6cdb6b5dd2e10d97c0b51e7250405178eb1e64ce
SHA512 8c5974a97f6faf8a9f517775efc24cd327ccdc9f205ffedc30002b2340ffa4e047a901961d815f7fa57e838144b4a623a6461949aaffb00222f40297bb66e21d
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uR:AsTICteErownP0oTcMsABqljks
TLSH
T125463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-548-0x0000018EA9E80000-0x0000018EA9F2D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads