8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21

Analysis

max time kernel
5s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
Size 5.4MB
Sample260801-2qey9aaa63
SHA256 8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21
MD5 bbe8b3cc30987971e68be0d905ea5d08
SHA1 0bad6ba6865fea3e7354ad01fef744fbe5178690
SHA512 7b967527a3c5dd97563fe7474848c1d36ae1b95342ad4c572fc9ec6afd1ad58b417c51232b7ea80812cf048a39bedff3c2fbb3afec86aa0471f77e86696bb40e
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uT:AsTICteErownP0oTcMsABqljkW
TLSH
T1DA463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fw80tf.exe	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fw80tf.exe	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe

Loads dropped DLL 11 IoCs

pid	Process
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\qunojksx\\sqxwtlgl.exe"	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1755	ifconfig.me
4323	ifconfig.me
6464	ifconfig.me
6977	ifconfig.me
12555	ifconfig.me
168	ifconfig.me
376	ifconfig.me
475	ifconfig.me
1083	ifconfig.me
234	ifconfig.me
1548	ifconfig.me
2008	ifconfig.me
4639	ifconfig.me
6309	ifconfig.me
6176	ifconfig.me
694	ifconfig.me
1490	ifconfig.me
5385	ifconfig.me
635	ifconfig.me
8379	ifconfig.me
11263	ifconfig.me
108	ifconfig.me
1289	ifconfig.me
11119	ifconfig.me
1330	ifconfig.me
1336	ifconfig.me
2969	ifconfig.me
3404	ifconfig.me
4344	ifconfig.me
6067	ifconfig.me
125	ifconfig.me
1577	ifconfig.me
2109	ifconfig.me
8335	ifconfig.me
1545	ifconfig.me
4655	ifconfig.me
416	ifconfig.me
436	ifconfig.me
667	ifconfig.me
1516	ifconfig.me
1795	ifconfig.me
5662	ifconfig.me
7023	ifconfig.me
8786	ifconfig.me
546	ifconfig.me
206	ifconfig.me
2464	ifconfig.me
5527	ifconfig.me
8092	ifconfig.me
12766	ifconfig.me
663	ifconfig.me
4415	ifconfig.me
5635	ifconfig.me
8171	ifconfig.me
9449	ifconfig.me
626	ifconfig.me
2169	ifconfig.me
3591	ifconfig.me
3786	ifconfig.me
3847	ifconfig.me
4854	ifconfig.me
7472	ifconfig.me
169	ifconfig.me
880	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3104	cmd.exe
6168	cmd.exe
7096	cmd.exe
5344	cmd.exe
8684	cmd.exe
4484	cmd.exe
3564	cmd.exe
4896	cmd.exe
6700	cmd.exe
6708	cmd.exe
1348	cmd.exe
2656	cmd.exe
4508	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5536	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4020	1040	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	88
PID 4020 wrote to memory of 2656	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	89
PID 2656 wrote to memory of 4508	2656	cmd.exe	91
PID 4020 wrote to memory of 5536	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	92
PID 4020 wrote to memory of 1136	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	93
PID 5536 wrote to memory of 1472	5536	msedge.exe	94
PID 4020 wrote to memory of 4944	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	134
PID 5536 wrote to memory of 688	5536	msedge.exe	96
PID 5536 wrote to memory of 5320	5536	msedge.exe	97
PID 5536 wrote to memory of 5320	5536	msedge.exe	97
PID 5536 wrote to memory of 5320	5536	msedge.exe	97
PID 4020 wrote to memory of 3580	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	99
PID 5536 wrote to memory of 3876	5536	msedge.exe	98
PID 5536 wrote to memory of 3876	5536	msedge.exe	98
PID 5536 wrote to memory of 4876	5536	msedge.exe	102
PID 5536 wrote to memory of 4876	5536	msedge.exe	102
PID 5536 wrote to memory of 4876	5536	msedge.exe	102
PID 5536 wrote to memory of 4252	5536	msedge.exe	101
PID 5536 wrote to memory of 4252	5536	msedge.exe	101
PID 5536 wrote to memory of 4252	5536	msedge.exe	101
PID 5536 wrote to memory of 1760	5536	msedge.exe	103
PID 5536 wrote to memory of 5732	5536	msedge.exe	104
PID 5536 wrote to memory of 1760	5536	msedge.exe	103
PID 5536 wrote to memory of 1760	5536	msedge.exe	103
PID 5536 wrote to memory of 3288	5536	msedge.exe	105
PID 5536 wrote to memory of 5732	5536	msedge.exe	104
PID 5536 wrote to memory of 5732	5536	msedge.exe	104
PID 5536 wrote to memory of 3288	5536	msedge.exe	105
PID 5536 wrote to memory of 3288	5536	msedge.exe	105
PID 5536 wrote to memory of 4268	5536	msedge.exe	106
PID 5536 wrote to memory of 4268	5536	msedge.exe	106
PID 5536 wrote to memory of 4268	5536	msedge.exe	106
PID 5536 wrote to memory of 6092	5536	msedge.exe	107
PID 5536 wrote to memory of 6092	5536	msedge.exe	107
PID 5536 wrote to memory of 6092	5536	msedge.exe	107
PID 4020 wrote to memory of 3024	4020	8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe	109
PID 5536 wrote to memory of 1356	5536	msedge.exe	110
PID 5536 wrote to memory of 1356	5536	msedge.exe	110
PID 5536 wrote to memory of 1356	5536	msedge.exe	110
PID 5536 wrote to memory of 2696	5536	msedge.exe	153
PID 5536 wrote to memory of 2696	5536	msedge.exe	153

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6904	attrib.exe
948	attrib.exe
3564	attrib.exe
4120	attrib.exe
4428	attrib.exe
6220	attrib.exe
6756	attrib.exe
6016	attrib.exe
8876	attrib.exe
4508	attrib.exe
2460	attrib.exe
6928	attrib.exe
7124	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
"C:\Users\Admin\AppData\Local\Temp\8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe
  "C:\Users\Admin\AppData\Local\Temp\8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe"
      4⤵
      Views/modifies file attributes
      PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x300,0x7ffb528cc188,0x7ffb528cc194,0x7ffb528cc1a0
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,3566532176159369863,8076723532546417708,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
      4⤵
      System Time Discovery
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,6673149822865845185,5183571173779382962,262144 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14543308929357229721,3138698384843215711,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,6242927296038466617,9039858071674842500,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,7629316255370313740,17013976972507109843,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13253551764121767752,11217304282663084921,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,797456825206482530,12587700214500648073,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4420,i,12494935733766737558,11895546350850122226,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4816,i,11192108360102919178,16218566742850673974,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5436,i,17713560607192879893,17381439136458567727,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5756,i,6507650507194932629,16125590319051185690,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3102811851739773847,5716105580880217127,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5576,i,15207078348106715006,16080292223737358439,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6264,i,1731540812933170190,18187736067620887837,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,925735168447177010,13571126963355228631,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,925735168447177010,13571126963355228631,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5696,i,8407825953319312443,14156921720468095046,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6444,i,14441299768611730788,14670190516488591521,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,3636477213134980203,9824078701063107032,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4057206701005085019,9586784493196050483,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8284 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6780,i,2117149702903081142,5664658176965402060,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6792,i,5389877263960757863,5492051914906971014,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6828,i,5647615847556741396,10557919482098710245,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:6188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6864,i,13321512303646250752,2665033696602739650,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6888,i,13523295502007662034,8640902146656605823,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:1
      4⤵
      PID:6212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6944,i,13942339133964393474,8580187290959281184,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6916,i,8880180654312396411,539466003866863890,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7204,i,5460758666429012023,11751633654635976397,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:1
      4⤵
      PID:6252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,13405318821071429123,2093549669572656409,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:12
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5500,i,16859550996127096226,13221194262935654849,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7440,i,14708486522740812131,6673520827847990599,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8920 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7388,i,11129038627759346278,101767245200239129,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7428,i,6276503090096812424,15522558371807499587,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7468,i,6281010672445655491,2368424630798777194,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5956,i,4494112280546462825,867712040206412275,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5984,i,13252498779916734607,4760262648844010514,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5988,i,14361184536945924143,6786056264446130624,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8932 /prefetch:1
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7584,i,18262702377671396830,4732168368942423988,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7572,i,4426653703150435569,11549584944200394678,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5672,i,16561398341617230994,5195294337831723483,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7648,i,5852623338442378336,10663345499419429160,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7672,i,11241941632428592486,4389429304836342822,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:1
      4⤵
      PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7628,i,18050966576082240793,4103110127671312691,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9224 /prefetch:1
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7724,i,8061115048189842420,6801819030834035695,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7544,i,8090055985842572991,16848380988346336969,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,3234627241179377145,14642986258465854719,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:14
      4⤵
      PID:6420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,13468204331859735425,14753878420128239571,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:14
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5532,i,15675427822245346486,8899679598812813444,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:1
      4⤵
      PID:6452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5520,i,7277867550258181663,10079352335820300313,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:1
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8092,i,16948536222301158241,6613161753554534962,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4880,i,12371024644715186007,16422607115334195765,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8112,i,16022959165212550877,4285125154101974633,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9944 /prefetch:1
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8016,i,10365374780773391061,754578724901378986,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9964 /prefetch:1
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8108,i,16027539079805201850,9176251013756630105,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9976 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8168,i,625808355466381406,17194226093140928464,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8152,i,17427249811569028943,1552605815724670079,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5540,i,14573197356151420024,10919059894345164049,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8132,i,14696887118279735455,11178315097198871818,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9940 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8200,i,10682964044620957930,7556542312301218608,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8064,i,18080469101280588615,8894581826651795459,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8264,i,10179023637539630353,14450135510353894203,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:1
      4⤵
      PID:6616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8304,i,4236154626239916668,4587374506053557530,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:1
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8240,i,8276800695300632622,3976245948402340455,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10148 /prefetch:1
      4⤵
      PID:6620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=4520,i,12772103026541395427,14864706244337827486,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=4772,i,15467774366144423477,11026186828027744072,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=4760,i,281729070568028204,14359778344459287767,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5596,i,1101055734381472463,11497819797846614867,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8440,i,5915971812457703159,403046583677393769,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8404,i,7541880415712684552,5860262082690162787,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8384,i,5095713036509146594,5029159807293361914,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8520,i,15177145940938930333,13418704243777507655,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8588,i,18031604332480562677,15001560490024359495,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11384 /prefetch:1
      4⤵
      PID:6892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8484,i,13993830725626546269,637000993112600721,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8564,i,14955307720999510735,9837400775755448018,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11312 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=4744,i,4125897829188319889,9074390558318827883,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8640,i,8253119897583986140,3164034506292499600,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11452 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8668,i,6632898381363371426,2656301215447320794,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11320 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8688,i,7401501025175688439,7676928305498084353,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11276 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8412,i,3434351452431931485,488610746981038709,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11388 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10700,i,4344369835853733639,5976666299042397244,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15664 /prefetch:1
      4⤵
      PID:8464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10676,i,16567510546279631804,18014462106249142331,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
      4⤵
      PID:8508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10720,i,1135435500161605601,6825600053252339502,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
      4⤵
      PID:8480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10788,i,13468980488849112784,6862210239731799463,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:1
      4⤵
      PID:8484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10688,i,288368026220208768,12277148656734182,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:1
      4⤵
      PID:8492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=7384,i,1919041616484957640,16342564891978590612,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
      4⤵
      PID:8468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11104,i,16978462197017582411,15163739932265669790,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
      4⤵
      PID:8404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=6016,i,14763253304952171197,13558956480881391589,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15720 /prefetch:1
      4⤵
      PID:8520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10856,i,10527666531399630782,7591218258247192614,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15888 /prefetch:1
      4⤵
      PID:8608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=4924,i,9240271369496699328,8350701270128710494,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15848 /prefetch:1
      4⤵
      PID:8496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=4484,i,10470471979131235822,16298496306529538568,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10600 /prefetch:1
      4⤵
      PID:8560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10808,i,9057652785951213545,1829048241868104887,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=13396 /prefetch:1
      4⤵
      PID:8536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10864,i,7215019978519298535,4693040945739090125,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:1
      4⤵
      PID:8568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10748,i,4749591750097915281,9273646264668410279,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
      4⤵
      PID:8488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10940,i,12006989093201548237,3998462363009947734,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=14164 /prefetch:1
      4⤵
      PID:7668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=4944,i,3564577641607611935,17275090709872897392,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
      4⤵
      PID:8544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=4908,i,8699512472480690863,18313557390476445946,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
      4⤵
      PID:8616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=7312,i,8900849916349587014,10637232329749314485,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
      4⤵
      PID:8580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10828,i,3293027332267355516,502424642572716434,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15868 /prefetch:1
      4⤵
      PID:8552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10876,i,5414410750884594928,9442534951587939822,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=14204 /prefetch:1
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10956,i,6792476293322371772,9440485638669143820,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=14144 /prefetch:1
      4⤵
      PID:8588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11088,i,7369121892563651734,3906854547977183189,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=15256 /prefetch:14
      4⤵
      PID:8628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,8838009852513618938,524140868051325861,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:14
      4⤵
      PID:8632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10852,i,10412326476976061822,2175460558176052377,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:8672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=1268,i,15514216198377094716,14946065001403750768,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:8716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11024,i,16621409241328641843,10507608192435099413,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=14172 /prefetch:1
      4⤵
      PID:8644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11124,i,16579102127119317650,11280049879357207792,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      PID:8676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11092,i,12106543261662775887,2068888867416470709,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:8604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11056,i,7397891995551304584,18125548462689203401,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
      4⤵
      PID:8600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=1368,i,9942486216866173217,17172259377398345515,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16356 /prefetch:1
      4⤵
      PID:8680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11176,i,14204752312196868947,15468684257155447515,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16376 /prefetch:1
      4⤵
      PID:8660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=7580,i,13790195852626782665,3499631545335982099,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16424 /prefetch:1
      4⤵
      PID:8640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11236,i,16122207914482822068,11680754674090131049,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16404 /prefetch:1
      4⤵
      PID:8724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=1260,i,11560616093009711065,12240986099993309364,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16372 /prefetch:1
      4⤵
      PID:8692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=11208,i,15944973260664575344,3255244014545820541,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16392 /prefetch:1
      4⤵
      PID:8652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=15684,i,6611273316494057081,6475152143831549837,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:1
      4⤵
      PID:9948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=17044,i,1545960951595257835,16941771783721483641,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16916 /prefetch:1
      4⤵
      PID:12244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=17124,i,1132958914686707641,2961584749247125006,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=12764 /prefetch:1
      4⤵
      PID:12276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=17180,i,17006829912429662191,3546761358651422568,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=12796 /prefetch:1
      4⤵
      PID:12284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=4244,i,2212404403036917316,5911164708290501735,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16900 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17052,i,2056225099646278012,13794788552973302545,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=21048 /prefetch:14
      4⤵
      PID:12260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=17016,i,5292855414903022494,17505635540688670608,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=16924 /prefetch:1
      4⤵
      PID:12252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=17092,i,2888965189393292064,15719420188327119625,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=12792 /prefetch:1
      4⤵
      PID:12268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17932,i,5477371639086725123,11613504290092508491,524288 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:14
      4⤵
      PID:9164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=16876,i,3247914388622999800,12784534974035350787,2097152 --field-trial-handle=2276,i,7156422125397027682,17648862030515457604,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe
1⤵
PID:1244
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe
  2⤵
  PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe"
      4⤵
      Views/modifies file attributes
      PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe
1⤵
PID:4200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\raajkl1z\kq3ns0bk.exe
  2⤵
  PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3104
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe"
      4⤵
      Views/modifies file attributes
      PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2676

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe
1⤵
PID:4288
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gu5aodrd\oad2p90g.exe
  2⤵
  PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe"
      4⤵
      Views/modifies file attributes
      PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe
1⤵
PID:2976
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cidz2oxx\4rjga72q.exe
  2⤵
  PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe"
      4⤵
      Views/modifies file attributes
      PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:500

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe
1⤵
PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bg6jwnrq\j4vy6shd.exe
  2⤵
  PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe"
      4⤵
      Views/modifies file attributes
      PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4116

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe
1⤵
PID:3276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3rvfqtt\0yqgwrcm.exe
  2⤵
  PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6168
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe"
      4⤵
      Views/modifies file attributes
      PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6524

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe
1⤵
PID:6596
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d521avxr\4nrepps1.exe
  2⤵
  PID:6672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6700
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe"
      4⤵
      Views/modifies file attributes
      PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7072

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe
1⤵
PID:7160
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogbw22ov\5fn4ndos.exe
  2⤵
  PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6708
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe"
      4⤵
      Views/modifies file attributes
      PID:6928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6232

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe
1⤵
PID:6824
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wh2t9eqq\3j219nd3.exe
  2⤵
  PID:7048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe"
      4⤵
      Views/modifies file attributes
      PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6864

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe
1⤵
PID:7140
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7pjyiq5\ty8kb4ds.exe
  2⤵
  PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5344
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe"
      4⤵
      Views/modifies file attributes
      PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1212

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe
1⤵
PID:6720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y7wakb7\7e7bdeao.exe
  2⤵
  PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe"
      4⤵
      Views/modifies file attributes
      PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4680

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe
1⤵
PID:480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8x6arpi4\o7lddn9j.exe
  2⤵
  PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe"
      4⤵
      Views/modifies file attributes
      PID:8876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9456

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe
1⤵
PID:9984
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9xay5izg\q38xbxeh.exe
  2⤵
  PID:10228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 243B
SHA256 2f31ebcc65abf37847f5fc0a265e74407df29dc3a141916c95151f75131691e5
MD5 5c79b4e0cd8e65552507caddc0cac3c3
SHA1 8086ee77da65b49ef9c9bcd358ed892a4885ddf6
SHA512 69ef1211cbbc74030fac6d3ecb49ed8db54a92ed8208ee8faab962ad9d928072c9a8964672bd58a132684631672f58e7548710f3a89a88c35dd69c572670e346
TLSH
T1A1D0A70F990D9862DFA95AF4DBBB610AC122C4694CBC81964020B0B37549EB0A54D502
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b16e7ac9b8c7c336c63a3dbe1790140f6d7f0a59cbb451f3bf2d7a39acad9dee
MD5 9a573e2bf2e6f564823c2374e9476b4a
SHA1 5506962d46f9941ce0bec690254f90524c8f617c
SHA512 b7fd45f9025aac361f9a416e325c37e231e40853f65f61ab3cd4f3b71094d2210ee2ae224900ef3f517aafedfb0cd739b4bc98ea53ee1e75ded7ad6d47532591
TLSH
T13061FCC7432704D7DBAC48755DD29C6E3E79C5F911CFAEE0AD4869B84E4670B68C0052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba63f5730458fc706989dfb88bf6ca8d98ba2d57b247b9b75fe434437d7539ae
MD5 9ff3413b75fd20f7d1064c164b0d0022
SHA1 4d07ad08fec2485fa4313793f40f9ffdc5ecd583
SHA512 a17585b55266676be5b16330466a17f4bbcdc6e391ef1a464a607de4be899b48b17f010744beca252495329b1bd28383df548b28ba26eea3bb471ae89d60e72d
TLSH
T1E461ECC7432B04D7EBAC58715CD29C6E3E79D5E911CFBEE06D0869B84E4B30B68C0052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7fa49af2da95e4adae178797c28d4cfc0d3687904cbe802a9a0d316f67844643
MD5 88d5a852ef314041c611e97f187e0540
SHA1 4b5538f64cdd30c84f7cfc63aa2f19e5efff37be
SHA512 edd4b93013aaa8c853b1430d3f0dae42017262bb9dd488ce58b110c4e5f81a87391b24b7cd660970a6c89f7eede6ce0cf1877927b9a6d28d35de5c78225a9958
TLSH
T1D261ECC7432B04D7EBAC48705DD29C6E3E79C5E911CFBEE06D0869B88E4B35A6CC0092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 00a1274adc05405afd8d3ea57785791783521e90623188b195b659d6a5f3e249
MD5 7c2a191d286d32bff0ef89170af97cc0
SHA1 e379b496aa1f5d22cdbde65cf471b7a323037edb
SHA512 5abcbf258070fff585525dd179562e088624464cd448a29a7d94f1bce609c7c6d2aa6156f480c7f0374110116d58dfcbb9a882fe30318e3867188187e52bcd01
TLSH
T1D761DCC7432704D7DBAC48755DD28C6E3E79C5E915CFAEE06D4869B84E4774B68C0052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a782f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a782f.TMP
Size 2KB
SHA256 046f57c7ae28dac93e3d8dd05e342e4cb1f06a8c75afbbe0570717da8535bc55
MD5 173d621f9d22d86d3e938a8c32e409b8
SHA1 fc14c46b9de4b1f47ae3be30744ec6d8369bbcff
SHA512 c0be261e90df703aa58a494925eaa7083fbb91ca943a05f5f328b2e2587f35fd1d2f356b14358f74c19b6ac78d4be174280787d86d4726048e0474fa40c3cc9a
TLSH
T13F51D9CB432704E7E3AC48756CE28C6E3E75D5E900CFEED0AD4865B84A9A31B6CD0092
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 036877e3c80554687fd4bd75f1f7ec5f1ae5f01053bb7dd71734541a15b81329
MD5 d85511847269bf3d2484060e0ad08c4d
SHA1 1c00d7cc67fea39a8c2aff3ce00cbc280d0c7ef6
SHA512 20953efd25caa73fc681db52f176ddbfe2e4b9dfc382ed8e2c0a5834d85c88ce5c52e333e53d143763614a537c2853ab7b21541fd37a90201880126c0d2e172e
SSDEEP 96:DL9OYncbZ999w6g9apziBqziBIowBQiV85bzGMx:DLQYnWZ999w6g9apziBquBIokQia5bzX
TLSH
T1FCA1AEF6C7E8962DCC2156F0A7147E2BCE1D0919932C3D2AC9D5AF5BA3E2470E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1b8a9d2-ef52-450e-a6d1-0ae2e088d15e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1b8a9d2-ef52-450e-a6d1-0ae2e088d15e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b3f25a582c285696a49e9bbd9aed9ae5d37ded762e18a341c88282d5868137bf
MD5 818f40784ee28becb473c5e76fe67ebd
SHA1 7c46366e0fb339b6d501ec14ed0cf1e6c236fae9
SHA512 4e8edc13bad7b7f35f54ea88c57dd2aa956c3f66e47b3c287ad57c131f44af0f159f8e3f2cbb5a55a6896a462c94f4e9f108b7b6d1fd0a72e09c0b0d2f79b442
SSDEEP 192:sxRbUORIZCYU/f24stsVrprQ5g7HzoA8pKbAbNbrFbHHg6+WNsbOPR9bkP5fYBbG:sxRtf5/flsterCht5/0fLRFIub
TLSH
T1A642E716AA28A93B4CCBD219FA55BF63D3F95022A1D01E54B6FC9A1C10E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ced2539ea1c400c913ec750f59d5d43895efb16007240b6aa10c3bf9c10fd9f0
MD5 1062b5f67a2ba9d94b830e072d6fa48c
SHA1 e1ffe3b92ac350255f1eef346b0e2e7614190b9b
SHA512 8abd35f7b2b44ba568c7d85ed316a7b43cf72de770dc2ce358c4c89dbbed0c0e7cf79294c5a9e98800257b7dce6c6894b51e25872a00c44bef9cf268aedcd446
SSDEEP 192:sxRbzORIZCYU/f24sYGsLLrprQ5gkHzoA8pKb+bKbrFbHHg6+WNsbwP2DbkPG9bU:sxROf5/flsVsr3St5idrhlmFIu7
TLSH
T1E552E856A928AD3B4CCBD219FA55BF63E3F95422A0D01E54B7FC9A1C10F76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 88543084b025076c672cda2d38aa78af330bbbe8e520139ae583f6f93ffbca7e
MD5 9f6abe614d5860bec08da75890599753
SHA1 79bc363de759a917d00176fead2ce7a51068e7cb
SHA512 c2156611fa03fc106bc7ee6a085e65029a90ad8c99910ddac492b37d91076e1632186d4c8443003b2ecfa6b263ceb0c222afd9c395af0c4e4536c71fe7d3c5aa
SSDEEP 192:sxRbzORIZCYU/f24sYGsVrprQ5g9HzoA8pKbubRbrFbHHg6+WNsbOPRlbkPG9bkr:sxROf5/flsVerojt5/P0fRRFIu9
TLSH
T11142D756AA38AD3B4CCBD219FA55BF63D3F91422A1D01E54B6FC9A1C10E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9eb90d44da394a0cd22742208e222410be4494cfef28cd7b2ad7a513bbca97ca
MD5 4e5a1ffba70117b1463ac23fb9db199a
SHA1 fff51ce0e0dc5a5bb9d76d72788f9886b190260a
SHA512 790e47a990517f5be3ecf0c2a729c5a35d7b88c4b3d98b8b6430d25816215fde96ba323c459a4eaf7604cac529408f09e099bb9b78264079fda34447a5a457bc
SSDEEP 192:sxRbzORIZCYU/f24sYGsLLrprQ5gHHzoA8pKbvbWbrFbHHg6+WNsbOPRlbkPG9bV:sxROf5/flsVsru1t5/P0fRmFIu9
TLSH
T13352E856AA38AD3B4CCBD219FA55BF53E3F95422A0D01E54B7FC9A1C10E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5be4d051af7cbf60f4d848b962af2176b86dcf2acdbfd5028b0b1d11f4a4a806
MD5 26e7014c0b8ad8d08d2b9566953cc955
SHA1 8829bb3d47fab15a92de9640fd23eb9b3b8f3917
SHA512 b3468d4cf0a983218fd81e03d1a9c907587d25e5bfe12b28594f36b919a3f122dbd9c4668fda359f731c26fe8b0cc481c289f075bb55d1445e17ca921539d5af
SSDEEP 768:wb8d2g7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlu46yrohDY5V:wb8d2sE7r6Wgouf6Mu1jamV6pyf
TLSH
T137C2D97B740DCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab382.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab382.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4b860f8c68b02030ecb3dd2f31d0af7f5c3120b7ceda96456bb279d73f0f676b
MD5 cfbce1bca8dd52e126b1d1f2291aceed
SHA1 67011f77261923ea425191ffa5a88a325ed28e8c
SHA512 041f9b22adcb275d70295deffe4817ed3375e8af7f59c76f589471d7d0d9851cb71f4a4e84c9e2d18be27e9d0dcc6bd0ebd6f65b5179f30c7cc7a9a3a76137a2
SSDEEP 768:bg3txDZIO00U8nNzc4ReyIsPw2ewBKZOCA:bg3VU8ntc44bso2evZzA
TLSH
T159F2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6ED9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3bdb2a410b74eb7460c0f6e2fe2967ded45c7607df25213e5b9e299fefe1c73e
MD5 0691fa6bf41713dc202e5297f1745bfe
SHA1 b16e9393ae2fe1e74b27d77718fe11a89f920df9
SHA512 9ec323706e3e3d5bd5a215f91c2fb82de0a7863e4737ba889c2234878cd46b4c3f23bc7e5be11959ac0172a3675aa8be15d6adaff725c23c4cdc9dfd4940a478
SSDEEP 768:bj3RVDZIO00U8nNzc4ReyIsPw2ewBKZOCA:bj3lU8ntc44bso2evZzA
TLSH
T19BF2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EE9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dace1a56be6fb7f725c25af55ce48a812c29b5cbdb8591947b953f5699a6e2d8
MD5 38df75822b4e6868c1f3df7e8a9d28a4
SHA1 2a3c4cfa71aed30573397bb1f9e6cdc8536e3094
SHA512 3f9ed895e3a02c6d4617b147e16ea4e68a04df276cf18550602879aff9f4ff6bd9486eee09406e943884fdd0a13df39fee776a1af25cbc0edc0f73cafb9527fc
SSDEEP 768:bS3DfDZIO00U8nNzc4ReyIsPw2ewBKZOCA:bS3JU8ntc44bso2evZzA
TLSH
T1D7F2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EDAF1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 35b5b10ad69bbfc41a35b493ed25b9867d64a0aa5acf28286e396f0b3dcf21da
MD5 153745ef7ba84aa63db37024ec31a5ef
SHA1 750951fe43502f32d5f3a8d577c7c3bf49f7fd89
SHA512 91c0a85a45ebb3d1f15952852f34c82810d261a91dd30804f2021826e0538a8da236b32ef512d300e06819e1a9c0d91f79b966aec27cd5c61ecfb711f9edea7b
SSDEEP 768:bV3q7DZIO00U8nNzc4ReyIsPw2ewBKZOCA:bV3wU8ntc44bso2evZzA
TLSH
T193F2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EE9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 402366370d07406e950fe75f117c6e98c8edd3da8e28d81024da8882cfb47ea5
MD5 78ac3ec32f543641e9164730dcd3cdb0
SHA1 c469d19778c7d9a957a815056f4f5ab105032b12
SHA512 4b3bc4798f87d767064b2880c877d8a2d1a8ce0b7711317d18eb522d90c421203b6577e56fa0d06192999b3897916193f48d37a1281c4f57d8dba9857363484c
SSDEEP 768:by3wlDZIO00U8nNzc4ReyIsPw2ewBKZOCA:by30U8ntc44bso2evZzA
TLSH
T123F2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EE9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f3b658659ad7669455aa5d55e16b6eb07c10ea420c87cc2f6126d537e8ff1a45
MD5 6c2986876674d2243525b8a5d81bd27a
SHA1 a474aaf344b355e22d80df225e99d811379344cf
SHA512 5f43479b1ab34435e72786a6a3362b40204decf14a06843dbb0e4d22a45e66c2154d164060d586903f58756ffdd739f700373ee06fd956c11cd89f4e84b72b27
SSDEEP 768:bz3X9DZIO00U8nNzc4ReyIsPw2ewBKZOCA:bz3rU8ntc44bso2evZzA
TLSH
T13DF2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6ED9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7c7777a7f5f8e806ff32fc0e38e5f79200474eac4c1b98e3d9cf505573db60b8
MD5 4d618ec20581357cc8dac2211fdb0af4
SHA1 7114863882eccc17f9dfdc4004e6d720dcad5a9c
SHA512 7316d94b73640ee18bc7ff327548352825ba18e0cf554551a363a14f0ac8b20ab8b229e8e848db76d3faab18bbba07c7fed3585aa6070b85be664c71a4f747ef
SSDEEP 768:bk35XDZIO00U8nNzc4ReyIsPw2ewBKZOCA:bk3nU8ntc44bso2evZzA
TLSH
T118F2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EE9F1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c93cd38fc8e4bc4cd9dd24555ab558d7c8b119b59933f4fca29e953166f1c514
MD5 7728669e2007c12cdc30dc0b5a3087ec
SHA1 39704e804fb23fe3f0be39bf4a0f08ee6e5effe3
SHA512 be67badfda24c5ebb1a505a47a339317fe1aa200856259fa96ce85d2ad816b5abe108ba563b7419a680e43b89f8c4066e7982b5d4e54abf7f01573854887ed24
SSDEEP 768:6rv+4UNbds3xzDZIO00UPNzc4ReyIsXZeVH1S5D:6bsbS3/UPtc44bspEH1Y
TLSH
T1BA03CF32E8788A77BCF6A686B54B76133EF8511782881A94C5DE6F0C468B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8c7e3f20cdc382ca1d719ac0a379d3c6fe01bb28809dc51f16c189ba88d6678e
MD5 3dd1f0cae879def567897fedb2af993b
SHA1 879de246c3d5076450b22a5851fb23f6ed797cfb
SHA512 88d82ef3d7e9b96b4f6d0e058694ac7d50c799cf16c24aee2d4762d65b3db1be557647d5dc503670fda385c228b73d5f88f8dde7c2047d9e37d2d0d092268396
SSDEEP 768:Rrv+4UNbd734RDZIO00U8ENzc4ReyIsPwo7I:RbsbN3AU8Etc44bsooU
TLSH
T16A03CE31F8288963ACF6A242F5473A937EF4216B84C91EA4D9DA5F0C05871EE1B5F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9ae2f780df34cabd10da9cabae07571d64e2e19f13fd9c85c05c27263a49e8e7
MD5 fd8af0cf862279290ac4afc9fde65503
SHA1 bbbd79d28f944d68b4f8c343df79da757c2767c7
SHA512 34889d58daeb3c884a5810035f9e16a54d1e98a8a5abbcccb0883d57cf458151f4a01075b725af0a818f9e5301bafe86dd4cd8d4e6e6edc029a09d7bd7bf1baa
SSDEEP 768:lrv+4UNbdT3Q9DZIO00U8WNzc4ReyIsPwo7I:lbsbN3UU8Wtc44bsooU
TLSH
T16903BE31F8289973ACF69242F5473A937EF4216B84C81EA4D5EA5F0C05871EE1B5F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 696cec648cacd47174dccd16de187e6ff6aff1db7dad1cb34a4095cbe66a6fdf
MD5 592200ff0052bad01567ca15b81fdbb6
SHA1 9e10e78e02a8794432d02f2bb1f25fa8123a5c32
SHA512 6107af991f7cf34324aa88c8372764b2779ce9b2825894ba8a0d27eb75ed91024d87d782cf11bf9ee4e9471489df952d7915b7d3880e30113ce18790b426625c
SSDEEP 768:b93eXDZIO00U89Nzc4ReyIsPw2ewBKZOCA:b93kU89tc44bso2evZzA
TLSH
T12DF2BF70BC298D63ACEAA646F94736837DF46167D0C82E64E6EDAF0C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a882b09b4f91a600530951e780fd080ea753391dff6de1c52a21ab5878cf3145
MD5 896ee63503c9f015d52bc3e81999fb36
SHA1 8131f901fbae119fc58133e33d6de3768a2c1c9b
SHA512 fadbed2e356d39f81596997708474e2fc5bb13d85cf248c145e264c2a1676056a9b83c419f5285f2b5e6a8943acceb08107c79728e9605d2f593008926406970
SSDEEP 768:vk30HDZIO00U8nNzc4ReyIsPw2ewBKZOCA:vk3GU8ntc44bso2evZzA
TLSH
T14BF2BF70BC298D63ACEAA646F94736937DF46167C0C82E64E6EDAF1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b49d3c405cb0034a1f4b8df218fb6dac1931f33d248dbbb65b1f4951ec53b835
MD5 a0ad3457e1013380ec608442a4cc6850
SHA1 bc588dc69b0bc2abda7da865f52d23164eb1f26c
SHA512 bb6ce95840e77585764fccd1d3f668f2d90683605b2fe4e7a6c5781b08e61574dd829ca32a4b43015ce6913d36636f2acaa10525ff3d77ea7f6835654ff75449
SSDEEP 768:vT3w3DZIO00U8nNzc4ReyIsPw2ewBKZOCA:vT3GU8ntc44bso2evZzA
TLSH
T17CF2BF70BC298D63ACEAA646F94736837DF46167C0C82E64E6EDAF1C044329D175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f070cd41b62dceb498212d0e013aaff3ab2a4af89cea3f1252620f9ecad6fcbd
MD5 3f08bb2bb7279a0f0c07c781da598526
SHA1 5f54f38badea833052d03c9f992f7267e8f65f77
SHA512 dfcdcfb454b7de1ed5a36556d4b1b5b66441b440cdf58d4c795798854b8cf55ac868bf595c5ab7311703a80eba3cd17233dcedfaea693c8a8ef0c3e91d4e4f0d
SSDEEP 768:VFQT3DwgLIZw5O00U8GoNzc4ReyIsPw2ewBKZOCA:0T3CU8Gotc44bso2evZzA
TLSH
T13B039D76EC68CA6BBCF69786FA467643ADF01167C5C86DE4EAD95E0C00831DD074BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e9b4992d224b06a008ab1ef3748d9571a307f12c0935c87169548c1a2db47b88
MD5 ce43bc079aebb936c594edbf9fbcd32b
SHA1 388a72d40d60eb65e73bd8bcb6a697224825f87e
SHA512 1aba7bd11b397f81b4c5250f9db33718d1661608d058f6ceca288e05c6d3cd8753598053eeb90e0d3b960f24734eb9fc1a3eca1f5aa1909e21f7f65f3c34a3b8
SSDEEP 768:Nrv+4UNbds3fBDZIO00U8pNzc4ReyIsPweVH1S5s:NbsbS3XU8ptc44bsoEH1b
TLSH
T13D03CF32A878C977ACFAA646F48736937EF8212BC4880E94D4DA5F0C06471DD175FA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 852c8a1a82fd114a308ba3fb522b38fe5e8a1ba194e919be8a6e85ddeeced86e
MD5 6ef38de3f9c9882a2ad7880ac805cf77
SHA1 7e88b4f448c3c54e13e347ff744b97297b0fd198
SHA512 36b18c6f72c55d0745202ff41b058463b4d81258d4c4aa3f7ea9ba00e10e4d6535871db604ba48991e994aa7d65dd2466e03b54fbfff8cffeefbdbc961f527d3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a86f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a86f4.TMP
Size 392B
SHA256 6f3edd45b85181bafce5fce159c71f27d56e6c1010cbb7f1828d8add2d134f02
MD5 62b1b960124df11193d27328fd146fdc
SHA1 f17de43586f664e3656024a414565b8b42e6fa8b
SHA512 541f6ad4ea0b7bbb6cbb4e54880d556c8ba2c960aea0620bf908411e1dab300bdcf77b1ab3671b9a5f5d0cbeaa5619bc27652b1e81b8b1e8105097bc33a3c014
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10402\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6b935a4-546c-4e24-b2eb-b32d07876774.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6b935a4-546c-4e24-b2eb-b32d07876774.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

sqxwtlgl.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qunojksx\sqxwtlgl.exe
Size 5.4MB
SHA256 8a49185ea5dc58804331a42debbe8c1f47f11f080c645747759d3a2f23fe1b21
MD5 bbe8b3cc30987971e68be0d905ea5d08
SHA1 0bad6ba6865fea3e7354ad01fef744fbe5178690
SHA512 7b967527a3c5dd97563fe7474848c1d36ae1b95342ad4c572fc9ec6afd1ad58b417c51232b7ea80812cf048a39bedff3c2fbb3afec86aa0471f77e86696bb40e
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uT:AsTICteErownP0oTcMsABqljkW
TLSH
T1DA463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads