0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
Size 5.4MB
Sample260801-3thd8aaf37
SHA256 0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833
MD5 d3a3d2b0d8629ff417c2a27327c902be
SHA1 2dee277db90fe3728ee029f75a7643629bd1eb1d
SHA512 064c24c6c4783d629a30a4931033864412fb4c48cb60161d641b125e00cbb8565b551f6cba2d93d91e9fa5ffd6485b9f1e7b1335182387fbbc922e3fe4c48626
SSDEEP 98304:lmgtRQDgICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlollloHFMIQ6UDo:JiDgICteErownP0oTcMsABqlfiU0
TLSH
T1FE463308B3E819E5FAB3D43D85665221D972742547F0D1CF03AC9A662F236E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7byzn.exe	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7byzn.exe	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe

Executes dropped EXE 2 IoCs

pid	Process
1624	xfhtgalq.exe
3316	xfhtgalq.exe

Loads dropped DLL 22 IoCs

pid	Process
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe
3316	xfhtgalq.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\u4d8r9ub\\xfhtgalq.exe"	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12150	ifconfig.me
13004	ifconfig.me
5489	ifconfig.me
97	ifconfig.me
1197	ifconfig.me
5572	ifconfig.me
7328	ifconfig.me
10030	ifconfig.me
13323	ifconfig.me
1350	ifconfig.me
7863	ifconfig.me
12216	ifconfig.me
64	ifconfig.me
141	ifconfig.me
2692	ifconfig.me
4690	ifconfig.me
4998	ifconfig.me
5459	ifconfig.me
9039	ifconfig.me
9902	ifconfig.me
295	ifconfig.me
2281	ifconfig.me
2921	ifconfig.me
7485	ifconfig.me
11445	ifconfig.me
12554	ifconfig.me
13567	ifconfig.me
188	ifconfig.me
4356	ifconfig.me
4827	ifconfig.me
9950	ifconfig.me
4917	ifconfig.me
7283	ifconfig.me
7698	ifconfig.me
571	ifconfig.me
901	ifconfig.me
6086	ifconfig.me
9388	ifconfig.me
265	ifconfig.me
6109	ifconfig.me
6709	ifconfig.me
3129	ifconfig.me
8339	ifconfig.me
8941	ifconfig.me
12225	ifconfig.me
142	ifconfig.me
2678	ifconfig.me
6155	ifconfig.me
8966	ifconfig.me
4733	ifconfig.me
6790	ifconfig.me
7310	ifconfig.me
13024	ifconfig.me
556	ifconfig.me
2965	ifconfig.me
4766	ifconfig.me
10785	ifconfig.me
1682	ifconfig.me
5598	ifconfig.me
6660	ifconfig.me
9127	ifconfig.me
177	ifconfig.me
2622	ifconfig.me
4559	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1708	cmd.exe
6656	cmd.exe
8072	cmd.exe
2824	cmd.exe
2588	cmd.exe
1932	cmd.exe
5416	cmd.exe
6308	cmd.exe
7692	cmd.exe
10580	cmd.exe
8420	cmd.exe
1756	cmd.exe
6460	cmd.exe
6604	cmd.exe
9964	cmd.exe
9196	cmd.exe
10416	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6180	msedge.exe
1880	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	msedge.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4352	3572	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe	84
PID 4352 wrote to memory of 1708	4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe	85
PID 1708 wrote to memory of 1088	1708	cmd.exe	87
PID 1624 wrote to memory of 3316	1624	xfhtgalq.exe	91
PID 4352 wrote to memory of 1064	4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe	92
PID 1064 wrote to memory of 1472	1064	msedge.exe	93
PID 4352 wrote to memory of 2220	4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe	94
PID 3316 wrote to memory of 1932	3316	xfhtgalq.exe	95
PID 4352 wrote to memory of 4624	4352	0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe	97
PID 1064 wrote to memory of 1880	1064	msedge.exe	98
PID 1064 wrote to memory of 3268	1064	msedge.exe	99
PID 1064 wrote to memory of 3268	1064	msedge.exe	99
PID 1064 wrote to memory of 3268	1064	msedge.exe	99
PID 1064 wrote to memory of 4320	1064	msedge.exe	100
PID 1064 wrote to memory of 4320	1064	msedge.exe	100
PID 1064 wrote to memory of 3884	1064	msedge.exe	124
PID 1064 wrote to memory of 3884	1064	msedge.exe	124
PID 1064 wrote to memory of 3884	1064	msedge.exe	124
PID 1064 wrote to memory of 2500	1064	msedge.exe	103
PID 1064 wrote to memory of 2500	1064	msedge.exe	103
PID 1064 wrote to memory of 2500	1064	msedge.exe	103
PID 1932 wrote to memory of 1040	1932	cmd.exe	104

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
8064	attrib.exe
1088	attrib.exe
4932	attrib.exe
1204	attrib.exe
8704	attrib.exe
10520	attrib.exe
5216	attrib.exe
7740	attrib.exe
7180	attrib.exe
10208	attrib.exe
6572	attrib.exe
1236	attrib.exe
1040	attrib.exe
5384	attrib.exe
7092	attrib.exe
6360	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
"C:\Users\Admin\AppData\Local\Temp\0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe
  "C:\Users\Admin\AppData\Local\Temp\0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe"
      4⤵
      Views/modifies file attributes
      PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffdf711c188,0x7ffdf711c194,0x7ffdf711c1a0
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,14440156240362390091,4564735175106369204,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      System Time Discovery
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,7149385700400127600,5689316822605138521,262144 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8490288503915115645,5334545224931913504,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5151008214278991319,6245827870897042783,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,2381971029078286061,1995144975785609743,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,16627271079031964296,3238026823392345145,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,6613799027624132526,979179212512303431,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4400,i,3854428836347940483,9667730231642952020,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5016,i,3074516939490540673,303933553804025850,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,3220195929382840112,8955728888493834588,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3840,i,8317103370939094981,996464758672163970,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5784,i,7141232880628058405,18051410071271497439,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5972,i,17558386705544286530,1222964709618097768,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6008,i,8687776821810913682,7688976063901498254,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3948,i,14374091975021825705,14566915531899708107,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16369813278993492580,17359622801179977613,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,2396770147539645858,13364283001890617180,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6928,i,10513134572756469671,7433039263409822721,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7076,i,2020858433991844189,6347713247249615584,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7252,i,2651763782496371219,9006719674192117217,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7428,i,17392775358268864504,8767218319075957947,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7600,i,2625269284532747371,2764247880259190590,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7760,i,16808820624430232880,15137838802887851947,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7792,i,15181391981887743596,4747079977738030263,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8032,i,8909527444876570692,10689848584951535930,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7076,i,5661543242074798857,8615829697062201885,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7768,i,17536575445138197780,562662482714061378,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8536,i,9470612195898300354,6913717257010836935,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7204,i,2222052658687706669,15739247744579008843,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8920,i,16543743997843692504,9142162222007509068,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7412,i,17816336726160165069,16971559003382605110,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9104,i,6007826768697907141,152336821927535549,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9456,i,5063954002818000970,3655774366073887757,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7792,i,15808346079329188251,14624209464268323462,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,9229558508929163441,6858358085228388023,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,9229558508929163441,6858358085228388023,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9360,i,4327075678811016431,4214142882516839866,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:1
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10060,i,4746058342224100291,13985231799105246173,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6912,i,9815415764641631829,10392265644947384005,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10108,i,5380411043805375186,227971996027327725,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10140,i,14445901852372373647,16532419985626867080,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10072,i,1931916603175521903,9835799468005120951,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10180,i,8689738122323431605,2477842638658790358,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10252,i,12049983292877474305,16649424285448131843,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10288,i,15159257638986506528,14747561662738576652,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10280,i,15558344344142167143,5608830102369958511,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10320,i,17858455326341499364,6929626712145827309,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10352,i,11085130832055365269,15910385994230862100,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10376,i,122440223326342049,18149140730457542519,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10436,i,3470736429894092815,8844626134527198076,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10412,i,180906112130383774,15612779647051036735,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10472,i,15700671956986424495,13715734917494701125,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5496,i,15055344054593567750,7307403151042117158,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10488,i,9673205782164659474,628938090728484375,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10600,i,11033334858755784009,1265033435833156246,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4268,i,13715497166984818672,1384098415916014640,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:7728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10660,i,4906151337810353060,16806370438157309032,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
      4⤵
      PID:7804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10680,i,8379841049207285309,3944134933082992379,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=10632,i,10839967860868546190,12749517276105415788,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10728,i,4229253558534992827,16973038419051705907,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12116 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4340,i,4244909936762567914,12394152668513651233,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12148 /prefetch:1
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10948,i,13972829961755884758,14073967294111909062,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12184 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10972,i,16457465522740593324,3622131807780323624,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12220 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11032,i,14928531465011930910,1054665520540261071,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12256 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=4524,i,7601197282294306137,5454575696178486057,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12296 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=3552,i,5500355402142303214,6369323297760165255,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12332 /prefetch:1
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=11056,i,16505455459589441756,10002112054289493199,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12368 /prefetch:1
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=11064,i,18201046377510866473,14258987558477411651,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12404 /prefetch:1
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=11216,i,15899477288017755082,6999339575690886739,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12440 /prefetch:1
      4⤵
      PID:10056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=3876,i,5492156887894689236,7366007107652287209,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12476 /prefetch:1
      4⤵
      PID:10060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10944,i,15426822225894908604,3037556303036453418,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12512 /prefetch:1
      4⤵
      PID:10064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=11260,i,13389918436720032408,6955302080907184440,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12548 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=11292,i,11085754509629110497,3578036573642454294,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12584 /prefetch:1
      4⤵
      PID:10152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=11304,i,8857245041546936612,1714550318215352891,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12620 /prefetch:1
      4⤵
      PID:10180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=11328,i,17182742912958980996,11768946793736116403,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12656 /prefetch:1
      4⤵
      PID:10188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=11444,i,7004924130764331689,9046986791435727364,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12692 /prefetch:1
      4⤵
      PID:10160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11552,i,2246561838502956622,4929843119844424138,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12728 /prefetch:1
      4⤵
      PID:9792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=6072,i,13230071972365772919,5887942882943301198,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12764 /prefetch:1
      4⤵
      PID:10216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6188,i,8036134251124685866,18160504125993074494,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12800 /prefetch:1
      4⤵
      PID:10156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=6148,i,180996954266280866,6563931249699529058,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:1
      4⤵
      PID:10220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=6136,i,6337110965704564208,10480182939010182580,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12872 /prefetch:1
      4⤵
      PID:10120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=6168,i,6890911618481424174,15952936220309230694,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12908 /prefetch:1
      4⤵
      PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=11596,i,8688966174846815412,17713404093978283322,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12944 /prefetch:1
      4⤵
      PID:7704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=11624,i,3739271066316463580,1120310926734516658,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=12980 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=11636,i,4051587117609440213,6294404662881913161,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13016 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=11696,i,13783704941763570865,14506873915008865505,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13052 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11716,i,14741644866024241974,10120167510405986941,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13088 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=11736,i,17505762429055106256,14703456648988996430,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=11760,i,10445573626911961668,14574984571350157316,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13160 /prefetch:1
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11724,i,3075584430655306235,14813826626279042418,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13196 /prefetch:1
      4⤵
      PID:7408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=11800,i,18094875782223467037,9503915477466581240,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13232 /prefetch:1
      4⤵
      PID:7572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11812,i,4408506155095606190,5226066515335108842,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13268 /prefetch:8
      4⤵
      PID:7748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11720,i,1524238420703481145,15723192673234213849,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13324 /prefetch:8
      4⤵
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11816,i,5496067761310009692,9319238795329595228,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:8
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11904,i,18129918893050526704,3475278709148102973,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13412 /prefetch:1
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11928,i,10712536222880911157,9129131035583028537,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13416 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11976,i,3519934632169798307,11812158805449329527,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13428 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=12024,i,4808414386516710243,12768677822324432643,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13460 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11988,i,16849965189486509098,8032242306772873338,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13440 /prefetch:1
      4⤵
      PID:8260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12056,i,17335273301629203123,4475100835732940336,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13480 /prefetch:1
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=12072,i,4150126071236151283,6685752400572167175,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13500 /prefetch:1
      4⤵
      PID:9520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=12080,i,564724430992135479,9942113518482803228,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13520 /prefetch:1
      4⤵
      PID:7736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=7172,i,5743272742197828397,53516574094908274,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13540 /prefetch:1
      4⤵
      PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,3833765281798637202,560776470922307974,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13560 /prefetch:8
      4⤵
      PID:9636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=7444,i,11354825811866015697,10738894985580120331,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13780 /prefetch:1
      4⤵
      PID:9968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=7292,i,13589490876576043243,8613312869922495145,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13808 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=7380,i,2762652379534351667,15559751080910340616,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13844 /prefetch:1
      4⤵
      PID:9616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=7356,i,1102989978682855967,15590125856080369893,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13880 /prefetch:1
      4⤵
      PID:9816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=7332,i,5698600543143307928,2176297010972374002,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13916 /prefetch:1
      4⤵
      PID:9848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=7244,i,6756352912549160689,8572605301011647217,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13952 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=7364,i,2962067070166668561,12004974769504230431,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13988 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=7316,i,16597117123983120992,828682872735605540,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14024 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=7216,i,17870904623043915939,3310636417227788135,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14060 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=7432,i,8665489275881690890,14106506814829403223,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14096 /prefetch:1
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=7060,i,16346778487868866111,10168846435221307595,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14132 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=12100,i,6160464629212730999,8825550128702881370,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14168 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=7192,i,2866624103548674782,3878387107044951884,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14204 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11944,i,18285779659721387802,2714605991406654531,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14240 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=7940,i,6590472786033133311,13084594753172903910,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14276 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=8024,i,11731288571202241437,2649208325216156643,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14312 /prefetch:1
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=8724,i,11462242917182932090,2593671346115396439,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14352 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=8848,i,1113370701236450489,3617534814859512668,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14388 /prefetch:1
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8604,i,14058447454832638007,13500488264930398165,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14424 /prefetch:8
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=8580,i,12706217103699100502,12151674623555652463,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14468 /prefetch:1
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=8620,i,1840337722754296663,6644440641294530406,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14496 /prefetch:1
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=8572,i,12585265819818591777,12611069256325424360,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14532 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=7312,i,11615225959265514768,13491340674160508626,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=14568 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=6836,i,1425737951255931459,4706398609732597275,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:10272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=6020,i,14415385981851118263,10169572686413018311,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:10280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=5832,i,18062002580880357311,13647788807687825382,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:1
      4⤵
      PID:10288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=6200,i,7531184829433989110,9535861639452980800,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:1
      4⤵
      PID:10296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=5840,i,6354040800161806690,12556635393480138993,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
      4⤵
      PID:10304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --metrics-shmem-handle=1596,i,4319254250863602692,11278436194360415997,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
      4⤵
      PID:10312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --metrics-shmem-handle=8740,i,7090831288804380932,11417930185420229617,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:1
      4⤵
      PID:10320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8716,i,2021827651121108199,10295578143395081618,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:8
      4⤵
      PID:10328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --metrics-shmem-handle=8792,i,2418381576525293172,9168717219042810285,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
      4⤵
      PID:10336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --metrics-shmem-handle=8768,i,10918546715532866797,436349645193390379,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13396 /prefetch:1
      4⤵
      PID:10344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --metrics-shmem-handle=8784,i,14280166917836470461,6556437979817857495,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13328 /prefetch:1
      4⤵
      PID:10352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8456,i,4910493310483961915,12981677313440770512,524288 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:11236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --always-read-main-dll --metrics-shmem-handle=9764,i,2598686644145489762,2020886840768481513,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=9696 /prefetch:1
      4⤵
      PID:10768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --always-read-main-dll --metrics-shmem-handle=6264,i,13841067048309545877,9604908505489193255,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=13348 /prefetch:1
      4⤵
      PID:10800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --always-read-main-dll --metrics-shmem-handle=6228,i,678669159070173935,10802197865881759387,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:10796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=162 --always-read-main-dll --metrics-shmem-handle=6268,i,11107395333375589393,4109228958395666139,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=19852 /prefetch:1
      4⤵
      PID:10816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=164 --always-read-main-dll --metrics-shmem-handle=9416,i,9405695560898392245,2529558828478108836,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:10820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=163 --always-read-main-dll --metrics-shmem-handle=13336,i,14081237185842039905,8148816847015560696,2097152 --field-trial-handle=2240,i,14368913835564436244,8119515011936247272,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:8980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4640

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe"
      4⤵
      Views/modifies file attributes
      PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe
1⤵
PID:3744
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxg99uvz\pys1gf6w.exe
  2⤵
  PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1756
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe"
      4⤵
      Views/modifies file attributes
      PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5384

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe
1⤵
PID:6140
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lpb5t633\fmtrjnt4.exe
  2⤵
  PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5416
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe"
      4⤵
      Views/modifies file attributes
      PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6352

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe
1⤵
PID:6828
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gogwwrhr\5rlikq1d.exe
  2⤵
  PID:6960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe"
      4⤵
      Views/modifies file attributes
      PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6856

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe
1⤵
PID:6948
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r3v92dfv\d6260adp.exe
  2⤵
  PID:6672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6460
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe"
      4⤵
      Views/modifies file attributes
      PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6484

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe
1⤵
PID:6676
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re871vrm\o5s2w7xe.exe
  2⤵
  PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe"
      4⤵
      Views/modifies file attributes
      PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4996

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe
1⤵
PID:4244
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2wcss37\itfcmp5y.exe
  2⤵
  PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6308
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe"
      4⤵
      Views/modifies file attributes
      PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7528

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe
1⤵
PID:7588
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux2dnz8e\aguzliml.exe
  2⤵
  PID:7660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7692
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe"
      4⤵
      Views/modifies file attributes
      PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3300

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe
1⤵
PID:7952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\656zzky1\xc1v0r29.exe
  2⤵
  PID:8032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe"
      4⤵
      Views/modifies file attributes
      PID:7180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8068

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe
1⤵
PID:7688
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\abuoz0hm\0akwkwm4.exe
  2⤵
  PID:7916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe"
      4⤵
      Views/modifies file attributes
      PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe
1⤵
PID:6704
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j6hch7b1\a0bxiqxq.exe
  2⤵
  PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2588
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe"
      4⤵
      Views/modifies file attributes
      PID:8064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8828

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe
1⤵
PID:7880
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pnkzrfv5\3el7y2fh.exe
  2⤵
  PID:8348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8420
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe"
      4⤵
      Views/modifies file attributes
      PID:8704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe
1⤵
PID:8780
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o1btwwdv\1asy447e.exe
  2⤵
  PID:9120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9196
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe"
      4⤵
      Views/modifies file attributes
      PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5944

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe
1⤵
PID:9760
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l6htcv7v\vxs8drxi.exe
  2⤵
  PID:9852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9964
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe"
      4⤵
      Views/modifies file attributes
      PID:10208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5660

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe
1⤵
PID:9620
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\df0hqfn1\tf9dhfyh.exe
  2⤵
  PID:9892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10416
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe"
      4⤵
      Views/modifies file attributes
      PID:10520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10772

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe
1⤵
PID:11108
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\knymszjm\y0ayniov.exe
  2⤵
  PID:11228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ss4n9pjl\2t57b933.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x36c,0x2a0,0x2a4,0x394,0x3f8,0x7ffdf711c188,0x7ffdf711c194,0x7ffdf711c1a0
      4⤵
      PID:10600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,14011276820790945260,7653164090188214308,524288 --field-trial-handle=2392,i,4659568531037399079,122128652380802389,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
      4⤵
      System Time Discovery
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,160028080222285807,6296002361124166704,262144 --field-trial-handle=2392,i,4659568531037399079,122128652380802389,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5168

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9dfa837c-7cd1-4477-840a-37a1e9949ef1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9dfa837c-7cd1-4477-840a-37a1e9949ef1.tmp
Size 12KB
SHA256 fe68968c30a086d3376cfd4b6cb11f751313b838edc3dc8cca9f70b1f330154e
MD5 635e546404defb3860bcbd75dd086849
SHA1 7373313e42f862ed46580019cdd1b584fad69001
SHA512 344cc26dfbb10eb2fd62bee9087b33110b8e78bb71bab97f1f54406816244b22418495d960044738b8ddd9e52bf6d95465f92b4ef7acffa9e3bea7424c82630d
SSDEEP 192:zTh0sNOUwQhxkKd+YLe3pQmiU1lqC49e+CG6+FdetRLXx++UJiOq/5LqyD:z6sNOUwaxk4zi3rAe+CQdi++JNXD
TLSH
T1AD422975A8786C7748EBA105F54B3A539EE420B799CA2F94E9DC5F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00e543b7-a209-4231-b7b8-600a370c409a.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\00e543b7-a209-4231-b7b8-600a370c409a.dmp
Size 557KB
SHA256 cbf8b66f260ff6b97d863ef1e5f1483d023662c8f149da6b5744b3a10346d971
MD5 3c93b4874ff995feb1b9e349b6eec846
SHA1 376396de9de7ff642a371d115726b2e7b7900653
SHA512 1e0d5758e6e571dceecbdef89999a90e472f4caa23fc55ba6fe2c4f435b703dd93033dc66b7078821e9634572583f70df4f070b4d1e371438e1b65cc54ef6e90
SSDEEP 3072:iSJIube1gXR3oxL4Ip1oxL4sHh24OXtgh/h:iSJRR3o2Ip1o2sPTh/h
TLSH
T121C42C266F408E69F02D46304BA2FF99A3F2FD51062153FB22D5B3AA5FBB3445D57A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ad6b77f-92a1-4e67-b4b7-0d067e8fc53b.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4ad6b77f-92a1-4e67-b4b7-0d067e8fc53b.dmp
Size 114KB
SHA256 02611c631c361398072dc66adf5dd919ba588790a4119a3122c34bf04ff35826
MD5 be5ad741315d354b183270dd11c82885
SHA1 1fec6b45c1c1ff9a76214e36f671bad2f66565c0
SHA512 f302e2585466e2cc79e525c68d0b2b6de3e2dd084c3d3a1f358720d6ea36c335308d8a96402ca75be79208100994b5a61a8e9dcb94e08554f052943470747a58
SSDEEP 768:kkgJO4fqwYUhN4PuWnHy748/HRcKPIiHzAenWKJCkB:kCwYUhGPuWnHy7f/HRVAeis
TLSH
T195B3CA2AA784443AF029433496F36725FBFBE4550B534B9B07264B7A2C23780AF31F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e74dfc01-eb14-4bb3-8971-8750dd065495.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e74dfc01-eb14-4bb3-8971-8750dd065495.dmp
Size 4.7MB
SHA256 69ba159f8e066d26f1f17341fe277c8a8ceacd6cd16909bbe3b5bd12c81cae80
MD5 765a1a73973f32e4a66247a1e65858c3
SHA1 9aeeec1f70ff398109683d6adc37adcf4634f68c
SHA512 13fa0f532864c283dec0b9f625369cb6ffab824cb0cb13079d0bc1475ae9dd1d41867ca96ce8df74403c5ae48f7ea95bd94ebeec80c1f2df404fb16a50de06e9
SSDEEP 24576:YEwi80e9Rb7Tm4u8CnQsMlk+nPiPPP2BPzPPPugPnO+o9x:Ys8r37UnQsMlE1
TLSH
T1E73629D6B39383AAF00987308A63FA506BF3ECA18AD29757691473581D7774CBD36D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000030
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000031
Size 25KB
SHA256 702565d9a2c68ef25af3e9e6cd8df0a7807cf1baf503b378908cb10f7fc3d7c7
MD5 d146e8b7de85fb77925dd0ab09ac35a4
SHA1 4c0ceb3c88e64edfbeeb93e69db7e076f7beeb50
SHA512 0abd1e8121b0317251bbcc71356bb2b10b238c2cee875982faaee728d78254b4bf4f96814f696fbed11c58fbecfb29931b86aa6571a33cef15ee92a57dc8809d
SSDEEP 768:9kBKg8b31hjeo2b/46KjQCtsHbls7q/m4qQQ/o:9kx8jj1xHWblBNqQ+o
TLSH
T1E0C2E03977576132F73CECABE39168E065DF15F2703A3AEB079E4917205074D6880ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000032
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000033
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000034
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000035
Size 48KB
SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
MD5 7fe007c57ea8a8682c097519166c4943
SHA1 7de32a85a9c2e094c62d5c393a44e9d4b0ee0b28
SHA512 298499a176722aee739bc846b96209ff4f618c7ce305acdb1f930d4e6be5961b411bed13363d1d766ccc5c470facaaee9bfcba11b1c04cf4e2de9b952df32d0c
SSDEEP 1536:KkUOL7TTaDZ3v+Whww93ZrTHjLgOoXRk/a:ZUGuFvnhww93Zr8hBkS
TLSH
T1962302E24F47584EA81B6BEBDC91564F3CCD00A519F06EAD143F81941AD6E858C88BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000036
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000037
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000038
Size 90KB
SHA256 b48363bf074f8091eaf45b3e2537fcd7234e337968ed1eee25a24c4baba60911
MD5 8ac195ba169d961ba21212bc05bfcae7
SHA1 551dcb86b5d682b00c1ad2292b92c6e203f9913a
SHA512 f392f38edd67b36ed03710ecc2bc1a41c9ead7d0254d5b5b11f191eb7cfe35956c3284378a8159850ccc2a841afb58ed990eac3312accfda51a900cc6ed81b6b
SSDEEP 1536:jOc80HUHZxmCk5REHO2kDt25RNr7aydZ5h5xdrOIWizVjt91CcLGeNhc9/mBI:jO100HGCk4u3c5bhwIWiFNCcLR6D
TLSH
T10793024D81A248FD19ABD77563E7F17A0E578E49382A13188EA512033D24CB5AFB337D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000039
Size 105KB
SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
MD5 68b11256fdb00ea264efc414a3081289
SHA1 edaccbe8eb8e0326944b82d03d00be43460e2d7e
SHA512 f8db4fdd6d8315e3151790263a353bf89666dc675e13ef6cf3b084e05f6c03b596c8707fadfa43c42d7201fb86680e4574f0a0915518a5d5911c0d1a0bb0f9dd
SSDEEP 3072:ym0RR8FYstRkmRYjNUUetU+0Q+FgPv474lJstNMWL:SRR8Fz+UUSmQ+F6wVNMY
TLSH
T1D7B312969BE7F3DCC165A8F78949F361D01C6EC81016EB6691426337CFA9001078AFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003a
Size 149KB
SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
MD5 dc396e633ee01774f0f0b2f1071a566d
SHA1 46e628c30392dcac3b041b5bdfb5df890231d143
SHA512 5bb2742d2d0339e1958cf57c7f8f176a1eb7160436fba9ab43d8f9466a7b0f4a40c7720b03878802474778a5cd1712e68508c5cdf73820cf674341d1e99c1a98
SSDEEP 3072:cbzKhLEOClRbBX7XiCNVHkz9JHXslX76tejVBedwYEdidbKjcDO7MA:c36lShBrXLkz95slL6qvYEdu+jJMA
TLSH
T16BE312182A23CED690EF543E9CF37CA7762F6D902F50599909B3388C524CDE19B5B398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003b
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 21KB
SHA256 a8d4cef7e4495cefca79668bdf0169ec8b19abb437b2bb76e68ace84b0a1c10b
MD5 c5c01009251e0503fabdcdcc9664df93
SHA1 6547b070cb480be57ed8c6c59a303b990b4102bb
SHA512 efd799307bd7f4a990892dc30a3a3ccf42ad6d20e48138290f759a926e5c91f29a252a9b3841e323e82c9984c0b2f5df4abd542ae58c377fbcf6036346e4e755
SSDEEP 384:HIbUbl0dWc7hcmlhsOnlWIPrZ2+LWFvXLwNdTqx06vgFmUaWDzXFejtOb:HIb9Z7pz7lzPrZ2hwNULvglDZe5Ob
TLSH
T133A2E1E3C9294B59FB8FA938B16E19CE6E665348E053C23C80872E81761DFF15D0B46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Size 76KB
SHA256 bbdb4de36778b9dfaf0d76f72ff5eee62586cd6f885d5f60b21436c64f9897d6
MD5 27133cd77bad23037dd37ea625f629be
SHA1 7d684f9aae9346022129138bad558be1ae13c93a
SHA512 3b42a4bc7f4bfc67133b6771b0bf30bbba215124e508b728ca9f42050887bdb7f98dd8c55c82193ff50ce5847a9e4ccecbbf3d77c50fef5aae177ae0f22a5e6a
SSDEEP 1536:zK5VCBgVlaRCfvydYadgqwEcJweg7MixcejkC+mQBYaNlrW:8hVO35dOEcJaMiFjkCEHrW
TLSH
T1B77301BB417F83CB014E9A5D1F46D099034539BAE6E961F120927AE437EC3B902635FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 92KB
SHA256 06eb39208883d683d1bdced76746506c53f9eb004a26b546c833de9597c68f5e
MD5 71f8141525673794be71853eb305f43a
SHA1 3950a35fef794d40d4cc58948c6eebe7727aef6a
SHA512 fdab2e4fa496ace5b8861c5431e4de89d0b91202e626343d8fa07ecf8e66380cae0cb1b9fac94bc7208ab1a5d819683638069791b364684c7280645656f410cc
SSDEEP 1536:ZrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdyk3:3+dCdU1UKok0HaFA9wRw0YuoqsmGeqOe
TLSH
T1F69312BE8E3D675A000DF32C46DCA14F80AD4AC5D901E3DA07ECAADB4172C195E384D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1327ce73c473ca58_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1327ce73c473ca58_0
Size 283B
SHA256 11332e3d6c2f23cad676a28d21b3245b548d25efc9275d4264a88df58703302d
MD5 2fcfb562da70bd1958e2f7c76724b295
SHA1 883175c1fc1004eb0adbe5569f8c260552aa252c
SHA512 a72f1655e4af04b15a0758fe7d4014aa34e4b4c8718479da6a26b5adcdb7a8bb57cff0d88808edd422c7e1ced09d3fb93a16b8522f241a6638cc8ce0fe8aeb53
TLSH
T14CD02B578C199669FBB99FB4EBA7B343C369C1844D6EC0A54100C2722396D24ABCD016
MD5 SHA1 SHA512 TLSH

Submit Download

14d1d752b85628e0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14d1d752b85628e0_0
Size 318KB
SHA256 a08f704998bff2de9f682367f3e7d05f2c8308b43af69c7a94bca224ec31973a
MD5 b2b71eac8421582269b5a7bdaed13089
SHA1 4e48220164c75a406b88df71c6b132d5a16adfbb
SHA512 51cfff246d576e78566317e14f768ffefe860597ed209679bddcd551f859fdfc233ab890ca810b04a94074a780a6245686189b6e414bfecc3ef73bc992d793bf
SSDEEP 6144:UwlV3IzI1O4hi5ZaMPdl6t3r5bQztwHKKrkIy6V8EoA:UwvGI1O4hNjzKKrkIy6V8y
TLSH
T1B9648EC95758F9D6CE1766BDB0B11F0A53B640086DDD9B4A817162623CC82E02FFF8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17e48ae9ec0065c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17e48ae9ec0065c4_0
Size 283B
SHA256 4fccc14817900405df6c2113984d90a5045da301798ad65cae8c6783acb06fed
MD5 79c8a9cb801956f1eb0b0a7ca1c9abac
SHA1 58fc397276fa5690e9eb3b879424c83025d810ce
SHA512 54cb15dd0f9d08a7b0b44f7dab2c040a34609699fd8b3b76797177bc4d747665816ff012084706c41f4da6a735226909d07c75841b16c1dce85a0ecc0c01404d
TLSH
T1BAD0EB4F001CB4A8EFAA9CF0CBBF0207A2EB808C4D5E03C54420D0F63804AB0E4C8197
MD5 SHA1 SHA512 TLSH

Submit Download

32e500902a54b67d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\32e500902a54b67d_0
Size 180KB
SHA256 ef994189b54f6d910d909435f13b30996925a95f6b95062758587f87afd32361
MD5 2ead1b45f0d27280e2074b7e6337f986
SHA1 ec14679320f01b1f3e5dc7982d2adf0cc4c695df
SHA512 50f92e54fdf328e4771332269f295e82991b6248bb4d32035901561999bad75c1fea53112fdb124ce3b318b3164fe9f1c478c535dd3bbc875a4525d972360154
SSDEEP 3072:DfVh8oBUr/ManueRZDQDy3qMEvsuVEmQ8nZOieSpq:37TyHEvsuVEmQ84iTq
TLSH
T113042B440750CAA6CE7727F941638916A73080446EC6F72B32B5B7353C8A2F15EAFD9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d93ae8277945415_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d93ae8277945415_0
Size 591KB
SHA256 9b74f27d47f54b5473699d8b39c5fab23d2139d0555456051dc77b80486605e2
MD5 4e240d693c3242a7237263a67cc2899d
SHA1 a8d838b92c75f1199649e4a1638dcbaa483dffd2
SHA512 c958477c4801359010055a0510921b4b32bd7338059992cec51588c4e9be4ae945da543689f5b445b7ed6bbde5bc2bf6779ab8dd28664eba97138f7128af6382
SSDEEP 6144:9wvZTMtniYx6l8JS2v8co+BXa4WrbnfXrFvo1/IJ6tyZEA/52blfk:AMAoqWVS+BX14XFvolIJ6ty5/5glfk
TLSH
T13DD4F8084790EA59CE7623F401A38957A73581483EC7E727A1E5B7363C493E16E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6216df15bc3f0f41_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6216df15bc3f0f41_0
Size 304KB
SHA256 61d979e326b79ba72e00a71c6300df152583e67eb2b5405fa242ab2570f134b2
MD5 6d7108b0564f146ec74076dd57b75cac
SHA1 425b14d56b322abd60ba573bbed6daa3ca6dbe89
SHA512 04b0d0057e9ff8bf6f2a7f868a1e9c358b5c41b264c9442078bd686cb207f52ea20ba762dba8d05fce272c0a5f23c5bd303509772cdb5dfaeffa439a34f6f245
SSDEEP 3072:2NtccB34xsZCQ92SaLuzRCltvS/0Uafp5tsgyaAI5kJ7R+t0VT6qmRsUc:Mccp8Q9zyGRCnS/0tWgBAIQ7q0Ncc
TLSH
T1B06494495790FD98CB7A23F44552CD57B731848C2FC3E32362E4A73A2C4A2D55E8A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6461897ed888391f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6461897ed888391f_0
Size 283B
SHA256 815502a9800ba529f15910eaeccc1929cefcd4108b732fbf4ef17d8be87a8754
MD5 e872a6a555fb89bfff302c4810dcacea
SHA1 b7f80f71bc77534c5def4fe6c98db3d94add4385
SHA512 f6b987a041b171eae721343d40ad94981a0117d4dc6c3c89e1c3a96677c48ced7d03f2bb1787db855dd2e219aafd39f18a1de7ea42c475a1dc7baa3ed1e13d3c
TLSH
T18AD02B5B2428B924C821FAF8D772664BC113989D0D7D82524105A0B2B7477603A8D999
MD5 SHA1 SHA512 TLSH

Submit Download

659ae65814b4be4d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\659ae65814b4be4d_0
Size 602B
SHA256 8d26d1fbf17c2890369646fe2508cc664c7fb2a202844dca6ffc119bc868e7ef
MD5 f0642faedd6b05dd270beeb5a35078ed
SHA1 b224826682eaa2caac33f42164e5f07067c21b21
SHA512 698c269fa1cea6a90ea8c90df67cf074018395df9104a87dc161b12ab38cd4441cd5765629af234cfc9afeac1a25258af576808ad4fa0b58c8b32006acab7c12
TLSH
T1B0F0410B8021E819DE725F71C5C796528E23D114486DEA9E201490EB20218B0F804C86
MD5 SHA1 SHA512 TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 f8c7577308f2c27e91ff30640c5ebe21bbb3379bc0b20f57c1a708f7e2805191
MD5 f7602fd7cfbbfdd855ce97ec8efccd78
SHA1 a52af94b166561767ec1f58dc7bf62089f4e9a28
SHA512 eea9337c26696549882a0ae7ecf9e3875904fd5c9763782fa1a6d017018a862bb236ed9ffde04fa3a01177f94154ece4a58e4cff34fde98e3baabd1e1df5d47e
TLSH
T1E1D02B5F9805EC66DB587BB0DB77A102C512C59A4CBD9483443531F325086F09C09B15
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 2133c5b57df71845ae9bd84ad9b7708f11d56ae8c0abb620613b10ba4eda3082
MD5 d3311066f673f60a648b5ffe195d4e54
SHA1 c262d85c1b3d1f4d4f83b354218b874aca7f6016
SHA512 783b3f552c6b604e01e5a44f19d56e8f866aba728250d1d844bc5117a1e6e1e87539b2393a4aa3df4a6a63a990a43cc7e2f6c06a4a87b20ed46a4f26c3f67d7e
TLSH
T16CD02BBF2448D412DE214EF591FB614184E7A01C4D5C4495624451A334418BBF5E6224
MD5 SHA1 SHA512 TLSH

Submit Download

a42032eae583ffaa_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a42032eae583ffaa_0
Size 113KB
SHA256 6a1bf90ed318fc02802d42ab675bed10a9d0edb39f4f28b01c438e27d7fdcaf3
MD5 af6bda6d08d47867486994b4ddd63714
SHA1 5c859fe0343a23e28368e0712ae81bdd81a89d72
SHA512 6f0689a182c34f5fc658cb64f0be42cba3638d617b28619a96337f0706621be05c1e9d9a64f54674520f46fff8375c1bf226a6324f6976907919fab0bdc18335
SSDEEP 1536:KIEHTnEVwRxjoHXzw6Ahvlg1zWF4Zn2WtNqYmrvQVRNQyXbE1m:zhVwxgzD0NWRi3rvnubE1m
TLSH
T16CB3C5055B60E649CE6623F901638A53A76480492FC7E72322E9F7357C4A3F15E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8e254c47c0f62f9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c8e254c47c0f62f9_0
Size 284KB
SHA256 e9727e22fec3b1eb1ea09371e8649dcf81e7276555b2b6da442336791a976598
MD5 3f398d92cf391cc5f691582f8b5e62a9
SHA1 a462a54c1bd887c85339da94934b22b6948dbcaa
SHA512 604424bd7db3c4156a1dbe154698f1acd93ebab34f393a63748efd391f092227cc2b54c87e5e760f14d6d011454fa966d1e6f4f0f8d68118d11ad4aeaa45cd85
SSDEEP 3072:+eZpau+o0EbgM1x5ib7AAR328rVrY5myD2LEY2NH05zyf6E5fs:+eDau2/Zk8rRY5myD2QYsazyf75fs
TLSH
T1E854D6651B90EE15CF7A23F542A2C953A73150483FD7971771E4A33A3C1A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7003623eae91c50_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e7003623eae91c50_0
Size 393B
SHA256 ac475e6e5f791811743759c9add4556e6cb68c4b4c9cc862ba857147aeb26862
MD5 04b273ac972a1b373da138dd0e8934c0
SHA1 18d87d1b797e07aacf524f801390ad03b6d55a99
SHA512 1f67beed511e192ecb680ea9e8590feb32fa96dde5cfd81a5482688205f16de48d3d6d903427046941d9a9b66e30771b287aa3a794eb03206f3e0ae1bcb97148
TLSH
T11CE06157433D5865D81ECEF4C2175517DB56440447BE52D4E00365F526828F1F999146
MD5 SHA1 SHA512 TLSH

Submit Download

f9f356c5a38789f4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9f356c5a38789f4_0
Size 24KB
SHA256 46f64b2f5a300bcda64aac3bd347468c96df2708e2af50c98c5b2d71a9226234
MD5 224e1322af6a757e095d319ed1934c11
SHA1 45054cd0a9e4c1c64b4c9245fe060b1a74d2eedc
SHA512 2bcb72068ef3c786f9416bd30c742ee1e65de59492572870069b1f9181ee6a6f4784631fe21e63300f61823f19e0d99cbaf468b6e2e44ffc622c28283d19d41b
SSDEEP 384:Qip5MwywQ45Lk4jOBwyvUFLJEG9LR6tlSIMEswbTS7Usf0WCuEZZyZVH36LAII7j:f55/988FlEK0/MG3sQuEQZiYv
TLSH
T1A2B2090917509B89CE6623F914778A47BB3240057ECAEB1710D2E734AC4C1E26D9FDAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8392996ee9f619fdf16842d633a9f8a9b1883afdcda218f9ac5f9a6d4b9e9d7
MD5 624dea3b46a395aeb70034ed9dd24dc5
SHA1 06f48634b9d4eda25c1da6d13a02f305d15f14f3
SHA512 6bb63747ffb09821e6eac8b82d878127428e3858a805e11e3f572f79cd10cc206ec546c9061d6233c01499d2d8e6a0aaa1e40911573ef46b70629dcad03f1254
TLSH
T1926130B4AA832523DB540078A1C62E2D3471BFE5FD0BCE731290593A455FBDD825543C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a04b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a04b4.TMP
Size 2KB
SHA256 2cf5917667b9e0db06af6992ac014b68e032c6590dfc7a7dbf22a71612ed648d
MD5 fd02ea7c43394a582dec4f46e0cf9040
SHA1 113e169a696c5a0520a3c820671ea8831811c9d5
SHA512 ea686b9bb060802eb14ad003a343c0b349fd6f8b28219e133a47d68d17ad6cfe21b4d7c60cf473dc21ebf4b8f9a391beabc90cc8b15f59bc4bcea5f48d82bf78
TLSH
T1915181B854822423E7251030A1DA2F7E3872BFD9FE0BCD7340908D32450F7D18369034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f1ca7bea4edce9aca3358b7dd8ea8c0492366c43dd11300866eff3ce916361db
MD5 a1e91f678855943835d52d751bcd29ee
SHA1 30b8782103c995390beb1831676e7e948578258a
SHA512 e0890dc27f6dcd3ea8ef33a3f79f4316d022b6b0e50da841a788f62d35ddc9d09f0071892000befe39df625c11db5a83799db45ad0c89df6bd2620e2d3187958
SSDEEP 96:DGcOq0BVk2kqYGSHNzwawEo9BbVNztNWVqQEJpbUH:DSD3/V5SHN0a5o7bVN5NW0QEJpbUH
TLSH
T1BEA1ABF7C3E5962ECC2152F0AB156E2BCE2D091553283D2AC9D5EF5BA7E2470E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b53ea2afb4f80fe306a893fc76b06a278e3d7a117497859ccda030096b9bd564
MD5 c839cd56a21d507f7c4838b99f8567dc
SHA1 63ba4d4625ea6937d5171f85f537b7a69097aaa1
SHA512 79e3d67ed250dae206534cf12e1faf98b1d289e0a07665131af66a6f866785689c4ef6bbe3e3c1d3532fe524e852e752629d6573f7bf196a19b4339c2efec7ff
SSDEEP 96:DGcOq0BVk2kqYG0Nzwp/WGwEo9BbVNzBQErbvGgVd:DSD3/V50N0VWG5o7bVN1QErbvGgj
TLSH
T161A1BBF7C3E5962DCC2152F0EB156E2BCE2D091653283D2AC9D5AF5BA7E2470E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0af716d35682ef5c09e443c14484237bff297d6e98a3cacdfeed47995d55f671
MD5 f9ae202ef4e8f84c1452efae97261481
SHA1 433dd6c2e5ece3ecc71db176e41c1807caeb81f7
SHA512 02549dcd4a909c961df7fbe0c14715dac5425d0966fa38b915d628213290d60b1cdbf50aafd8a581bb0703771f825e303808a55810e88f03f5cfdbf0c00398e9
SSDEEP 192:sxZ7RvVyM/jK1Ml8MjU/fts/TN+EdpLwrq8DFR/W6+WNiRtzkjpYBjIFc+BIgyJ:sxZ737U/fts/THIXb+4pOaO
TLSH
T14B52F812A6386A778CEBD219F951BF53D2F5047292940E54AEFCD91C00E6AFC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 febfcf839a99c1f797e940d6d52d7484d192deff0c18366f8096de23b6de4704
MD5 ada8a97f70d19bbf7a316f45c38d433f
SHA1 8665ed3967e3f9f2a146c6da24ff14d4f480f932
SHA512 1b5aa1e167e9cf17fbb53617644869ea6bdee2c57d5f8ae678fa0229b3625caf69a1708bb48837399bc477d527cae5fea470895970586388c5fd15783648663c
SSDEEP 768:ivcv20wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoFLlwmWN4ro86VMx:ivcv20wWvu+Z+u1javFLeRND86A
TLSH
T1E4E20A3B280CCB7E4F841E9CED2A6F9A6ED801CB57984D5447FA884C02C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 88b806dd3d66465d166490280cbbb3c18996ebd175d995180e353917e0491fc2
MD5 ee9584cbb1c1429a08ef2e3622ecfe55
SHA1 317fd274b746dcc13973a5b6074644c776340cbc
SHA512 a27ab559ee21a5e3c1f33ad057e1e14704b6c56320cdc7448b53199b79a68108d054e17ba898743a9efe798f284656cb9d8cd5d5c31d5282d9b4da665320c28b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCc5:mT3LVxnr+JFTBBi9UBtXcqzs7z7ca
TLSH
T113C12502703F0242297D7908B3668536AE4272673814A8FF7BB910A15F27E261DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 dcd9b71cd4a8f9261c93a1dadfb5c5fd1547d221e847e47b800e6791a6155e8c
MD5 8ad9e00666cb9077ba4bbcec47eb19a5
SHA1 7ea9353e75358ab5232e5d7dd590959f7ec6a3b2
SHA512 17a72bc1aa206bcfc6005fce7febadf184dcbaf2cc83503ca15dbdb444dbb1e7c1054e4e01f348a6c6c109964743a88c5e9b46e2633560f7e371b3bd9e427453
TLSH
T1B1215580D3FE50897ECBA589C109A40366A63E9F160D28B56B6D44F44F8CC380B7FD25
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 168493b3bb3653335df95f9efffb9e6f0bec7b64286ca16163e6604ee1e830db
MD5 a4c5a32e242d72cef86cf4de062adfef
SHA1 ba01f0c69eb85038f5b44a6676b16f31325d2a28
SHA512 aaaf2dc305ad18bc5624c9bd870373097b9eb694192e041b9e7f295096b71e87a67fe533f5a1e2b46f5674c22801b9979b1ca943cab2ba936e236ac76cece758
SSDEEP 384:nVvsNOUTaxk4zi0xrZDf4S+CQdi++VNnTKwBODNZOCpWn:Vv3yE/6S4ExVNnewBKZOUWn
TLSH
T1A5920778E879ED679CE3A285B60776879EE410A399C91ED8D9DD6F0C00C36DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 aab450cc0ab30ddf4f2e337d47492acd3274406571f68b58d3bfd9be04deb5ef
MD5 0733904b0145295f6cc7a686e3901abf
SHA1 929edbe7021cd899778b857f5d7e012c98e8687c
SHA512 42eb7296d49306bfb271cc54fa8dc052815208f95860b0dd13686e5c2db48608eaaf969d28bb27e37b607d0914da46106dc071945ddb3a140ea52403b161fde2
SSDEEP 384:nnsNOUTaxk4zi7AQweZDf4S+CQdi++GDNnTKwBODNZOCpWn:n3yEuwDS4Ex6NnewBKZOUWn
TLSH
T1A4920778E879ED67ACE3A285B60776879EE410A399C91ED8D9DD5F0C00C36DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 12959a8db3767dbc08881fcbbe680a0c8ad6b55c69ae39c36a9210ff899e1334
MD5 f58851ce99c704da9ac8efd133a040da
SHA1 cea99b3b9bcfcc68272ddcfe9b4cd9f672e1cccf
SHA512 6c6fb456d5146d9ffab573730352d59bfdcbb2b7dd8615327baa5be281fb14e0162e84434eca82b8a6f77cd4e3d6014b3af4b32a49d4909b258f5ac79292668c
SSDEEP 192:zTqsNOUwQhxkKd+YLe3JQmiU1wdCV1e+CG6+FdetRLXx++UCiOq/5LqyD:zGsNOUwaxk4ziXLje+CQdi++MNXD
TLSH
T1F4422A74A8796C7749E7A109F58B3A539EE420B799C52F98E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a54ffc845e35ac920cca7af9571a59b13d28d00d0db64d355f7b5f54cb52c728
MD5 66438ba644c04f1587f95bfb2277ce9d
SHA1 bffd4bab35c287ab9d9eaf7553d7c8ac070c4081
SHA512 b7dd544604cc7ad31ed1d15a6035c7ed83ca42d852e4a3bbbd2ad15a4eae92b3ed743c36c7d478fd52d8df4c919de881775b3ad3542ad4bfb8f1d9d538ddc1db
SSDEEP 192:JONB6v+YLNQmiUy2vZh+CG6+FdetRLusNLTU6:JONB6vz//Zh+CQdMFU6
TLSH
T12A02EA3568782C6B9FF6AE05F4873A135FE4103BE9962F91DAD81F1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e147d839957655fafe9c4134ee3ad3b969a3228ccf320c7834033b6a55ab3a54
MD5 4472d3364d723e3a071261fa3df0b729
SHA1 9a5cd453bb70e57e92038dc55f1de421361b624b
SHA512 4c10c97d653b4aa13bb60e55d0a6d2504310b5e280f146a20d64c0463eca5ba533b5c61abd6e1eafad9aca5ea128158c2fb245b5cc6cff294753dae6e0dfc64c
SSDEEP 192:zTDsNOUwQhxkKd+YLe33GQmiU1ICl1e+CG6+FdetRLXx++UCiOq/5LqyD:zHsNOUwaxk4ziHibfe+CQdi++MNXD
TLSH
T127423A74A8786C7749E7A109F54B3A539EF420B799862F98E9DC5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 710ba3b78eb9c7348e1922326482fdc2dfae6b8327f03410197af050d29a4585
MD5 3e7d61289cfc756be4838866acb86823
SHA1 9f02fef963a6e5b9d633c3a66305739e4fae838b
SHA512 71bddf80110f1f58bb2efee9e986b16411f2d20fdc341a4c7d9682a1b8422b12a585aac3a75483e2a0b5d7f2f58aa3f16c969c1e66248c41e24120e1441490fb
SSDEEP 192:zTWZsNOUwQhxkKd+YLe3/QmiU1dCYge+CG6+FdetRLXx++UCiOq/5LqyD:zusNOUwaxk4zix+fe+CQdi++MNXD
TLSH
T161423A74A8786C7748E7A109F54B3A539EE420B799C62F98E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fde444027fa271018a5d3a35ad73084a57ba2e18c8efdbd16b5f3f80b48c6427
MD5 7f0fd99be0565d11ac6248297e82302f
SHA1 0565e128953fd5cee1fc697298f0ee48d7326998
SHA512 84879e803bd95ac0f3485e8ef20dfa1e576e34e680f752814d932502d8370bed3d7eb2bda13090e0689665e9253902d42a5d6e3a87d945a3472e2dc3f7973610
SSDEEP 192:zTvsNOUwQhxkKd+YLe3RQmiU16hChZe+CG6+FdetRLXx++UCiOq/5LqyD:zzsNOUwaxk4zifxLe+CQdi++MNXD
TLSH
T13B422A75A8786C7749EBA105F58B3A539EE420B799C92F94E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c060d1f45e26a966a2dd37c1c9ce8855700f0d704b53cfbec1a2b5b4e963bdca
MD5 245d842721a8a1bec0b6e6e70793f4a2
SHA1 bc93ac5a64687e4e1e783aeaf13e4e59d4f42eec
SHA512 0aca2c1af7d305043acb57380ba72fc05cf9079def5c06f2958fd1d8d095d450f2e3697ba47ddc8ac3331cd02d5149170f84a4e8ae42f4b84f12cd345a9584f8
SSDEEP 192:zThEsNOUwQhxkKd+YLe3RQmiU16OCS2e+CG6+FdetRLXx++UCiOq/5LqyD:zqsNOUwaxk4zif+Be+CQdi++MNXD
TLSH
T159422A75A8786C7749EBA109F54B3A539EE420B799C92F94E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1944d16352bf5a9951883f8b028162c3c2236fab0e850df21fd30fa28f9645b5
MD5 b65fd6ff00fffa1ba32e967b6f2f9ba9
SHA1 fd6d59ad1c2e2c3c890d3815297f35665549a532
SHA512 668c71fbdaee5a32456b918a887df221cc9fec77be10356af9cfc1ab8d62fb12569bb6c21ba84f19c8a959545d2fd7f0fba16ceb0ac148b1501e3994042b5ffb
SSDEEP 192:zThEsNOUwQhxkKd+YLe3NQmiU16bCz/e+CG6+FdetRLXx++UCiOq/5LqyD:zqsNOUwaxk4zi7bTe+CQdi++MNXD
TLSH
T185422A75A8786C7748EBA105F54B3A539EE420B799C92F94E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 70c2388af574ec2f3f8470f2da1e9d85c60610e94a4f437c9a39aa7852c9d746
MD5 67cb038239d80da14a236897f42a7525
SHA1 e21281fa478f047644f494fa7a792d8b2db38048
SHA512 d8b84c652e8d962aca0d9b021b69b402e36330e63d16976239748b37ba1b27bb71b5355058cf7bfbc505a207f71d5e881f739d728ee29029a972e3dcb2843058
SSDEEP 192:zThNsNOUwQhxkKd+YLe3NQmiU16ACEUe+CG6+FdetRLXx++UCiOq/5LqyD:z3sNOUwaxk4zi7Ide+CQdi++MNXD
TLSH
T14E422A75A8786C7748EBA105F54B3A539EE420B799CA2F94E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 381ca57ad60e122e6db17de190df55bd5c28bacb7ab824cae4a3252fb0a99a2e
MD5 6d862c279ecb0e4bb88be76fd28b0b0c
SHA1 f752889a53448f50fa82c01bc95deb01d85a56ff
SHA512 22d681932cc177edf2226442491ad466fc64053c72580e132f20d683db7a12e184618e546df409110131610df9ccd12e3898b9767c6e5b70594c2cb1bada7f4c
SSDEEP 192:uuThAsNOUKQhxkKd+YLe3HQmiU1HCBYe+CG6+FdetRLXx++UJiOq/5LqyD:nOsNOUKaxk4ziZw6e+CQdi++JNXD
TLSH
T159422975A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8eb1e570e5195840b2d8b3f2aa6e522cf78e9e83772a4709a458492b6143cf2b
MD5 5aeab8cf272e5fe893a7dd01101862dc
SHA1 243c8636df3310603bb7d672ddf853408b187ed8
SHA512 53ddccbe0aecb3226384edda1f574c3734e4ac79e2c16be39827d54d020afc4d6da5278f5dd7c9edc226cb574515f7e68adf98e22328a7ab5e73bc7881f1086e
SSDEEP 192:uuTh3sNOUKQhxkKd+YLe3NQmiU1OCDste+CG6+FdetRLXx++UJiOq/5LqyD:nhsNOUKaxk4zi7RDMe+CQdi++JNXD
TLSH
T14E423A75A8786C7749EBA105F54B3A539EE420B789C52F98E5DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 99c790f17c5ceb6618464cfef3e763a94e8a09fd2e9ef02d6716f5a1f2264acd
MD5 b1d1d18bf6a3b25c81f98fa7ca99063a
SHA1 4b2781377b362b92f1d1389950af92a9a70df729
SHA512 9504f1280903abe979ae9b896811de29d57edc865405945c07eacafb3ffd15e7a21d9a823bd5685779731f952140f914740b65e890bc5807bafe0e4b66d741f6
SSDEEP 192:uuThVsNOUKQhxkKd+YLe3IQmiU1/CH6e+CG6+FdetRLXx++UJiOq/5LqyD:n7sNOUKaxk4ziYsae+CQdi++JNXD
TLSH
T1AA423A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a553561ec73218c3d8910183dde4609a9f61329a7229b207cdd5799be292d3c6
MD5 0e456af56abffe47edfa68b297aa0c24
SHA1 4fe00dc064d7c54dcab7a6a7b5d9b80a470cf1d5
SHA512 292c4498bddb362d6db58a26a995102ef53f9d2484fc89d17764285c83e440dbd6955a4a6f348f6b7f4265f23d000cbbe231e09c98c8f84d0e262b63ea3245ae
SSDEEP 192:uuThzsNOUKQhxkKd+YLe3HQmiU1mCyLe+CG6+FdetRLXx++UJiOq/5LqyD:nlsNOUKaxk4ziZVEe+CQdi++JNXD
TLSH
T1DE423A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bfeb8db5b29e6ee5c7274846fe00711ed4a68253bfbd84f386d4d278c71b10af
MD5 e04c6d220aee4c8cfdef960900f9ccec
SHA1 f7c1b3889dccc38361db5c403f78cf4a817ae873
SHA512 751cd79c211b3fea3ce23c9d6d8a2df6c0853cad7784f22e426ab92ce326dc7bc2643ae4af359a5362ebeb71b152674d66a3276c411c07e7b6a4e9e757accce9
SSDEEP 192:uuThqsNOUKQhxkKd+YLe3HQmiU1ICAle+CG6+FdetRLXx++UJiOq/5LqyD:n8sNOUKaxk4ziZbUe+CQdi++JNXD
TLSH
T119422A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6da028733506a13744fe897343485d6507d5bec163305d28a77f96b85d0414fe
MD5 4d32c1ce383068f7cad3c7926d9b82c8
SHA1 ebef7eaeb8e1083f56c7087abb87d0eae2f814eb
SHA512 a97e0be97ea56be3b3779972968789be0303e1a75684a463699b3c5e6c95426629d75b3e2944834a313a962513e5eeff19a53ef7d26e9ed88629bf796b634581
SSDEEP 192:uuthdsNOUTQhxkKd+YLe3WQmiU1vCxIe+CG6+FdetRLXx++UJiOq/5LqyD:n5sNOUTaxk4ziiYSe+CQdi++JNXD
TLSH
T16E522975A8786C7749EBA105F5473A539EE420B789C52F98E9EC8F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c04dbb06f2ca0e3516879d1ab2f7ed2e83de511f54f6ebd36ab3fdffa8f344e7
MD5 40e7a5fe1b32a9d1282004f17108cf80
SHA1 4683c1eb6654f38e5e50620e4a6d0aa6217b7601
SHA512 4f0144682084898a9ed0d16dd7cee8b5db83c892a8e98e1e096c1b6d1aafa1c7f6b48da5884a26a1083a6c68509757812d8682465f8f88a2c32fe762f9ff5ba4
SSDEEP 192:uuthJsNOUTQhxkKd+YLe3jQmiU1ECGXe+CG6+FdetRLXx++UJiOq/5LqyD:nFsNOUTaxk4ziFjoe+CQdi++JNXD
TLSH
T195522975A8786C7749EBA105F5473A539EE420B789C52F98E9ED9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ed9ba1e70b8750ec78925b79f139b3771e2c2af79859d8f02875b6cf3379f6d7
MD5 1a0e2b728754755774b4489682ccb944
SHA1 707d69248023a1e344ad948c4934675a50d8b687
SHA512 5cc62eb7a4956bdfab728d7c630ce314706384393b0b2ab30714408a6069ae32e14ad785b80197e44f5ec992f4ab53d3d87037c3f36b7e49221b7179e43fa54f
SSDEEP 192:zTDsNOU9QhxkKd+YLe33GQmiU1HCGye+CG6+FdetRLXx++UCiOq/5Lqy0:zHsNOU9axk4ziHi0Te+CQdi++MNX0
TLSH
T16E423A75A8796C7749E7A109F58B3A539EE420B799852F98E9D85F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6d70199c52d1331f364484d9774c1e0b4e2217766f25d311f98f715d30e573aa
MD5 cd3df9dafdcd0e2d444e0ca91c45b3aa
SHA1 23f13ca426cc2f92cd08d9a9a0d9c669629e6661
SHA512 c7222f0227575049ceddf52512d292c5ecf9aaf2c12d8cd7bc42a594ea6858a938caaea2e78e5e493f37b1a2bd2a9d66192133ba10f624c1b60ef808d6ac16d1
SSDEEP 192:zTqsNOUwQhxkKd+YLe3/QmiU1wICpxe+CG6+FdetRLXx++UCiOq/5LqyD:zGsNOUwaxk4zixuve+CQdi++MNXD
TLSH
T1D3422A74A8796C7749E7A109F54B3A539EE420B799C62F98E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d9a6564f1fb82a51a070803ddaa72918c0ac12be3a5e0e4b3660dd1983c933dc
MD5 1ecd71e92d633e4e54d4aebe2b0ea8a7
SHA1 e9af57881f2fc59ba14f3ea24ed9b916c50c41a9
SHA512 4320a4988bf59b2d0ee66fa2c8c3d1eade29a10b93ac30a1052800fc2df9b26c477c44539a715ff73b5c4953485af8bb63ab9b632749542a490883885d338116
SSDEEP 192:zTvsNOUwQhxkKd+YLe3JQmiU16cCIge+CG6+FdetRLXx++UCiOq/5LqyD:zzsNOUwaxk4ziX0Fe+CQdi++MNXD
TLSH
T1E0422A75A8786C7748E7A105F58B3A539EE420B799C92F94E9DC5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fb86c47a17219cc2058e134d626ba45704628eb149dd7e7b35a1c56908e7f820
MD5 b5a4cee5b889050d2b27e3a511631d69
SHA1 d4879318d3ac7025f4f7f93df3a62cfbf1e49f93
SHA512 028f77f5dfffe8c88960494b65fbf93e70e0e4dd6bb8e5cebbe74273f82f7d657e44a4f4b49d95d4f7512240a6117fd3d8f4a628d0d6998c623bf84beca4a46c
SSDEEP 192:zThNsNOUwQhxkKd+YLe3GQmiU16ukCtte+CG6+FdetRLXx++UCiOq/5LqyD:z3sNOUwaxk4ziSbBDe+CQdi++MNXD
TLSH
T1D3422A75A8796C7748EBA105F58B3A539EE420B799C92F94E9DD5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3f662d87af52f7804619f6d1bb031e162f8b97ce1651168770d3d109bdfff4d8
MD5 c7bc70628a8d26d3188243b527a1a31a
SHA1 9d7342ca02b27e5614e5766ac3eb0954dc25ac69
SHA512 45e7e499ba93f2bb44cd8ce45b69982181e0dd4cf41fd54c7766b94e0f761dd922e14c7efbff72d44dd31348fc8c751725c2e2862974d244c86e87d49c186f8c
SSDEEP 192:uuThAsNOUKQhxkKd+YLe3rQmiU1aCkhe+CG6+FdetRLXx++UJiOq/5LqyD:nOsNOUKaxk4ziNdYe+CQdi++JNXD
TLSH
T194422975A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3c106823262b5ceefec49199a5cb1d544d7c71a10580aa62f829860cc2282cff
MD5 7160c7004685a67d55cb208efc281637
SHA1 98bc9e7ad3e39c55753d31de4538f6f221e72127
SHA512 0f88307102e5900615fb22e61618288e404d321041a143e1d9ed7ad5c328137c1a7a370b5b4ab4ccf533ab7d27ec01d40964689904c54539bd1b593549f384e6
SSDEEP 192:uuThqsNOUKQhxkKd+YLe3WQmiU1CCfSe+CG6+FdetRLXx++UJiOq/5LqyD:n8sNOUKaxk4ziilqe+CQdi++JNXD
TLSH
T11B423A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 faa75e1ac1388e36a04c724a223772da54aa04ef9888777ea8216de4eede3a7d
MD5 9d42ddb535167929b5fa1d3c262d95d1
SHA1 9d9a3fd0e0cfe42f812985f2c5605662cc2c61a4
SHA512 8d2920fb9c503555538a1a16739feff37d2ceb0a693279cba09350902baf0bbbb9c4bc543cedea1d8cdce2816df3f8c31e4a9928fc7d0fbca4e3ff49a656cd6a
SSDEEP 192:uuthasNOUTQhxkKd+YLe37QmiU1JC3qe+CG6+FdetRLXx++UJiOq/5LqyD:nWsNOUTaxk4zidGae+CQdi++JNXD
TLSH
T18E522A75A8786C7749EBA105F5473A539EE420B789C92F98E5DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7a9630f8dc7201e098cc02063aef454bd59faad9ad74db52d8263bb5cfec8b4d
MD5 9f608579b951522cc24491a10b54404c
SHA1 f106ee1c562bd56940ece1265d37b335881ecfbb
SHA512 6c26604da3484e506ae7277f29a488b561628cca679890853dfa3597e2a67d6b87a37523d6e79c92f915ef8f11712af66d32082a5446612149dbd22922845c75
SSDEEP 192:uuthIsNOUTQhxkKd+YLe3qQmiU18CM5e+CG6+FdetRLXx++YJiOq/5LqyD:n8sNOUTaxk4ziWPoe+CQdi++9NXD
TLSH
T193522975A8796C7749EBA105F54B3A539EE420B789C52F94E9EC8F0C01C73DC230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d8c7d2d26879fdc7bdb6d05202f7edbe923dfc2e901c1416902d919a0f8e23f5
MD5 a4dc7e711eecf33bb467526a1c33ce1f
SHA1 a814bf1a5b3619ba9004c518495e72ea825e3c3c
SHA512 b19758acf5b992f8a8633cd055e21b9492047085acd4b5da5de4d93619f0c6fd98cbcabec7c526e683d22021a6443b528810e826b92ead60e80272b3e12ae660
SSDEEP 192:uuthssNOUTQhxkKd+YLe3LQmiU1BCJQe+CG6+FdetRLXx++UJiOq/5LqyD:n4sNOUTaxk4zitSme+CQdi++JNXD
TLSH
T121522875A8796C7749EBA105F54B3A539EE420B789C52F94E5EC8F0C01C72D8230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 18b79abc17277afac75dbccf33a1182d714950c8232187bff8c8bc3eb93b6511
MD5 80662e6c85598d9db77f08bc98572da1
SHA1 dce99b474023f58504472f8f74f3d01a770444fb
SHA512 02e33d5fe3bf03b9a0189346df076ce6bccb1e980692d38939b9678ff797cf3cde293c618a24453ed99e3ee8696c0564be2dedef6e9f1dcd722ba881e3ef3427
SSDEEP 192:uuThEsNOUKQhxkKd+YLe3NQmiU11C8Ze+CG6+FdetRLXx++UJiOq/5LqyD:nSsNOUKaxk4zi72Ie+CQdi++JNXD
TLSH
T130422A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b2e3b3a2149a43cf4290dfb9b565d20c2c7b6d2acfeee7f8ebdf97a121ad4400
MD5 31a003046e5207ced735e7f2fc1e2110
SHA1 96cc459ad6bbf4371d2e63f7411df2bcf8f782e1
SHA512 82a9b2880528af49b1b9a406264ea78eafb0761e57ef8b7f8891fb0b51c443d096c807cf5e6817735e822103e5840f33687cf520099bb0f6a39096a2cc370ddb
SSDEEP 192:uuThVsNOUKQhxkKd+YLe3oQmiU1ACote+CG6+FdetRLXx++UJiOq/5LqyD:n7sNOUKaxk4zi4TEe+CQdi++JNXD
TLSH
T17A422A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 96a3ce9bab3af4e4f5f84a58c85562dab0e832694965cd3984747d53797e4741
MD5 192e944b8a108edf711c90c75b09b825
SHA1 1d92f529eb24e5def2049848059092f484dc64e5
SHA512 7cc85654be98e941a94f4aca7b438611aef2bacd9fdb551f00f6c480afa65ab4243fdca200e72f1899e3607ae20902fc08f36fac636342d5d208aceefb048cf8
SSDEEP 192:uuThTsNOUKQhxkKd+YLe3iQmiU1ZC1Ue+CG6+FdetRLXx++UJiOq/5LqyD:nVsNOUKaxk4ziOCOe+CQdi++JNXD
TLSH
T1AC423A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 367c50ac9f2bb7d93ab281fa326c8d61f42cd79f6270a3335497bfcbe0c38fdd
MD5 49a59400f08feac56c500da1200f6038
SHA1 a483d1e95728142b51ba3194588adca0cd4ce557
SHA512 d3ab1f95356165a94b59264b16e4ac9ea99d1955331acdadc5f9f645c9f59f68603bbfe4b53b83dbfc79b24804858e836154a1598dd4283e3bd2f50236b5fce0
SSDEEP 192:uuthdsNOUTQhxkKd+YLe3jQmiU1wCi7e+CG6+FdetRLXx++UJiOq/5LqyD:n5sNOUTaxk4ziFPoe+CQdi++JNXD
TLSH
T17C522975A8786C7749EBA105F5473A539EE420B789C52F98E9ED9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 254db49858aa2efcc94269b5755f2bc7760ecb544a91237829cf3e86664a37b7
MD5 97bfb4e527f526e77ab739713d0bf8b1
SHA1 4f71a12aca7793bddedaeb48ae97fc46676b9553
SHA512 637c4769fa4ae06aff8b55c50a08e639703a62532b65ceb4569240a3864649deeee21eb2fcf43e90d57577a0c537544623511e71bab2fb3ed0d5eade5919165a
SSDEEP 384:nUZcIPJsNOUTaxk4zi7AswoZDf4S+CQdi++GDNnTKwBODNZOCpWb:SR3yEywhS4Ex6NnewBKZOUWb
TLSH
T1FCB23974E879ED67ACE7A285BA4776879EE4106395CC1EC8D8DDAF0C00836DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ed7aa94a7bfb934d53041fd376664a42cb5e820e10733547273e63d5435ab793
MD5 d24f9b856c498ef29a52803477c8d0b2
SHA1 504119ec0eca4a50e611810a283ab4e7e9abf002
SHA512 2a5c71d7aeb379d2ff5b2e310dbfa151405d5417509f5a54c77e20e3770a12649cf92e3e41fd9b302205c5d6d5e8000ca31d9e6ee26669b1e2dfde03c57d0732
SSDEEP 192:uuTh8sNOUKQhxkKd+YLe3rQmiU1dCTue+CG6+FdetRLXx++UJiOq/5LqyD:n+sNOUKaxk4ziNqae+CQdi++JNXD
TLSH
T184422975A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 329aff0bd18b0845846c2610a1092b3e14ab07e12abdaba3d34e29835ecea17f
MD5 56a92c8fd4b736582400291e3a4551f9
SHA1 c0cf3451f0532a21a6ad57da98d58811afe50004
SHA512 460ca0a5abb42234deb482fe42967a232d2ce45f83bab4040f6068b48d5c6dbad310313d4468128d33a60e434688a5e31b5bea506edb3f60805f3224f93bc145
SSDEEP 192:zTDONOU6QhxkKd+YLe33GQmiU1hCf8Ue+CG6+FdetRLXx++QCiOq/5U8:zHONOU6axk4ziHiKfHe+CQdi++oNU8
TLSH
T15B321934A8786C6B89E7A548F4873A939EE42077DD853F95E5D84F0C01D72DC230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5c67b9772efa1dca35577b197f90a137268177371ff4e74ecec4c058b196e74d
MD5 e91c6446630714c9c7abdf669b37b65f
SHA1 d4424316c9a61e5594baab40591cae2d7f0f00d8
SHA512 8a245ca4aaafae7b9dfffc5a3f6fbb4280e63c4586a3c56ec74747ec5738599e97e172bb41faf8023ca5920234f9a2cf41dbc4bc5119e95bc01b50994139984f
SSDEEP 192:uuThTsNOUKQhxkKd+YLe3IQmiU1SCWne+CG6+FdetRLXx++UJiOq/5LqyD:nVsNOUKaxk4ziYJEe+CQdi++JNXD
TLSH
T100422A75A8786C7749EBA105F54B3A539EE420B789C52F98E9DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c551b15c2e7267772d3b6542f5bfa6a15ab1eaaf99f566bb5f3f8439abd41426
MD5 77a7f740ec3c0eac943d59558b37a6c6
SHA1 3a1fb50bc2210719a26ebd200752f017e4278664
SHA512 9e61ef838ffcc9c103017d84fdd8a3f53f6927815959b6292362cb50c2e84b1be06d2a420864603001d74bd7d7ef53dc49936b24799c92b8a6cc319039e16b60
SSDEEP 192:uuThzsNOUKQhxkKd+YLe3iQmiU1zCTue+CG6+FdetRLXx++UJiOq/5LqyD:nlsNOUKaxk4ziOIKe+CQdi++JNXD
TLSH
T194423B75A8786C7749E7A105F5473A539EE420B789C52F98E5DD8F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 012df69747532fbf256b79f42ec524e5409bd43fad87350a0af2807233bfe46b
MD5 5772dedc13dda4e2dd5620084095a1df
SHA1 de092e49469de86e731ae8772b1d4f03e0e8fb3c
SHA512 3e418e463f66f4d07e8b6df9422be8cc385f5151088aaad44260a3217a5577d44eec7ff34ba4f21cba71ea0173592958aec944dbf4a2cc41f24cb26e07797077
SSDEEP 192:uuthasNOUTQhxkKd+YLe3LQmiU1KCYde+CG6+FdetRLXx++UJiOq/5LqyD:nWsNOUTaxk4zitNse+CQdi++JNXD
TLSH
T18A522A75A8786C7749EBA105F54B3A639EE420B789C52F98E5DD9F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d962c52d80e8d3ce5762590354e5588c603537c5f4e6a77797f7373e9c3b777
MD5 4b1fd2a6abb3b815d5a6faf1eedeb130
SHA1 a7463d84aad7501183afee947970b250373e77ef
SHA512 63fce89c03b870503430d4abc93f7ccfd2d2b6da51d7329e07ecab5d59ab0a583cf032202aa836249cd2f6b59fb0ce55faf50f8c3b9748c4bea3e3cb7235b00b
SSDEEP 192:0ON06v+YLtQmiUysv6h+CG6+FdetRLXx++QCHOq/5U6:0ON06vzfX6h+CQdi++xNU6
TLSH
T13A120834A8686C6B5AE6A504F4873A93AEE42077DD867F91E6D85F0C01D779C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9004bd65b7b177fdcaf3a6ab5c22537a229e78dae3c6f1c0ccc9b85a1132da4d
MD5 37b8adfe2892a74eee226df13d35a6fa
SHA1 db3e325de943d21c2af641b4fa528941c756d2c4
SHA512 819392efda172b071c05a445611018fac35aaa01088a2436763135f062e902fada7a61c200c7160f0618676c93d7422c9be74b926a53c29c23f505e215abce5c
SSDEEP 192:zTDsNOUVQhxkKd+YLe33GQmiU1aCD/e+CG6+FdetRLXx++QCiOq/5LqyJ:zHsNOUVaxk4ziHixDe+CQdi++oNXJ
TLSH
T191423B75A8796C7749E7A109F58B3A539EF420B799852F98E9DC5F0C01C72DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9665344-5d30-48d0-b6fb-a7a4c6e0f46d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9665344-5d30-48d0-b6fb-a7a4c6e0f46d.tmp
Size 12KB
SHA256 21b43eda6a2b7a83ca6c753584d8bb7411bc8f4a663e5e788ef5d758db5f8b57
MD5 982fc3c4b1accc6ffe8e9fcd90242956
SHA1 cc3e9a2beb8dd663c4d5eac64e5a981c5b402dc1
SHA512 a71c86447126a0529acae4710b75fb7d0e41047eee132e70e5dfd8bda78dea3e3072332de1d8bf55e5b2ad8451c9c1b68cf27c8ccf28564f6ffcfee87378d664
SSDEEP 192:zTh0sNOUwQhxkKd+YLe3GQmiU1tCFke+CG6+FdetRLXx++UJiOq/5LqyD:z6sNOUwaxk4ziSOue+CQdi++JNXD
TLSH
T1D3423A75A8796C7748EBA105F54B3A539EE420B799C92F94E9DC5F0C01C72DC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28674089-8139-4656-80a9-96de8fdaca92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28674089-8139-4656-80a9-96de8fdaca92.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33210695fafddd9b9c55b7126347be9bab02cfe1881d226963eb8f9d419ad946
MD5 071cce807a797b8b888adc98e04a6588
SHA1 77f0fcb449b1e9b8475118360c249d124c26ca6a
SHA512 ca9480c26aba81b798efa58f5d7523c7fe63f3cbfacf9a0173b26a100b7fe589ad02d57665d6bcb580d0da70195ca9ac69f2ebe6a5818e57855c0bbd0f328eeb
TLSH
T1BF412B68A6FD1148B3736F5BABF6A86D987F7C762E06C05E10010D4F0626A40C871773
MD5 SHA1 SHA512 TLSH

Submit Download

75328dda-4685-417b-bdd5-b5a531ce9ad5.tmp

Path C:\Users\Admin\AppData\Local\Temp\75328dda-4685-417b-bdd5-b5a531ce9ad5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\base_library.zip
Size 711KB
SHA256 8d5a44b741f1637eb707f4e49b7c5cd49d3d58c4806e94138de7139495ad9be3
MD5 805b883272d178134e0854b3a8140c98
SHA1 05324a836727622506c0b2115dfc3157480e672c
SHA512 49375c0d72257f23734d9755222e4e24b68e00bccd2a88674b813342120ce2f2902c7c3bd6f795de20ce060daa630c33b0bb1595b799ed6cda6a0409b44f82c9
SSDEEP 12288:52osQNRs54PK4I18Nd3fyEWg6k10axSPh6oQDSNYV0c/5:52osQNRs54PK4I1Gd3fyEWdjs5oQDSN6
TLSH
T198F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35722\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e81cc0d6-5c66-44ba-a8c3-51bc328b1058.tmp

Path C:\Users\Admin\AppData\Local\Temp\e81cc0d6-5c66-44ba-a8c3-51bc328b1058.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5c3ceb7e-dae1-415f-90c2-d2cde4f9b1fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1064_381136983\5c3ceb7e-dae1-415f-90c2-d2cde4f9b1fd.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xfhtgalq.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4d8r9ub\xfhtgalq.exe
Size 5.4MB
SHA256 0327d48590d68060a0cc30c7b4c68c107912c5ec1b219214ea8df7015eb61833
MD5 d3a3d2b0d8629ff417c2a27327c902be
SHA1 2dee277db90fe3728ee029f75a7643629bd1eb1d
SHA512 064c24c6c4783d629a30a4931033864412fb4c48cb60161d641b125e00cbb8565b551f6cba2d93d91e9fa5ffd6485b9f1e7b1335182387fbbc922e3fe4c48626
SSDEEP 98304:lmgtRQDgICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlollloHFMIQ6UDo:JiDgICteErownP0oTcMsABqlfiU0
TLSH
T1FE463308B3E819E5FAB3D43D85665221D972742547F0D1CF03AC9A662F236E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads