fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288

Analysis

max time kernel
9s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
Size 5.4MB
Sample260802-a63ayabb59
SHA256 fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288
MD5 06aede3c96e3f0951339fc71c2521ba9
SHA1 6ae38674a983f6ebe61b8f4301dddeeb0927565b
SHA512 7b5e2af04b407eff49ad09b826d4f7019dd83b504d4cf192e999572080d1e1df2a54987194f5702691a64c8baae3f1698277d8131b3489a34ed7fe67034569a3
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrA:k7ICteErownP0oTcMsABqlkgczs
TLSH
T1B3463308B3A809D6F6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9v2f03.exe	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9v2f03.exe	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiz3z0.exe	xf92m8mp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiz3z0.exe	xf92m8mp.exe

Executes dropped EXE 4 IoCs

pid	Process
1276	xf92m8mp.exe
3156	xf92m8mp.exe
5632	nrwngm2c.exe
5832	nrwngm2c.exe

Loads dropped DLL 34 IoCs

pid	Process
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
3156	xf92m8mp.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe
5832	nrwngm2c.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\fr30au7n\\xf92m8mp.exe"	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\clmizr4e\\nrwngm2c.exe"	xf92m8mp.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
147	ifconfig.me
1588	ifconfig.me
1646	ifconfig.me
9783	ifconfig.me
10233	ifconfig.me
210	ifconfig.me
580	ifconfig.me
2152	ifconfig.me
5734	ifconfig.me
6012	ifconfig.me
9531	ifconfig.me
10453	ifconfig.me
736	ifconfig.me
784	ifconfig.me
2993	ifconfig.me
4823	ifconfig.me
5172	ifconfig.me
5866	ifconfig.me
8129	ifconfig.me
8436	ifconfig.me
409	ifconfig.me
2449	ifconfig.me
3399	ifconfig.me
3697	ifconfig.me
8215	ifconfig.me
8568	ifconfig.me
9873	ifconfig.me
12647	ifconfig.me
157	ifconfig.me
422	ifconfig.me
668	ifconfig.me
4890	ifconfig.me
8154	ifconfig.me
14704	ifconfig.me
514	ifconfig.me
2370	ifconfig.me
6140	ifconfig.me
6485	ifconfig.me
12213	ifconfig.me
13627	ifconfig.me
14633	ifconfig.me
459	ifconfig.me
1600	ifconfig.me
895	ifconfig.me
1047	ifconfig.me
1694	ifconfig.me
3212	ifconfig.me
8667	ifconfig.me
49	ifconfig.me
342	ifconfig.me
355	ifconfig.me
4751	ifconfig.me
522	ifconfig.me
962	ifconfig.me
1085	ifconfig.me
1408	ifconfig.me
1469	ifconfig.me
2027	ifconfig.me
5427	ifconfig.me
13453	ifconfig.me
791	ifconfig.me
1180	ifconfig.me
2900	ifconfig.me
3283	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5984	cmd.exe
7864	cmd.exe
8696	cmd.exe
8612	cmd.exe
8652	cmd.exe
10736	cmd.exe
2436	cmd.exe
948	cmd.exe
8280	cmd.exe
9904	cmd.exe
8860	cmd.exe
6356	cmd.exe
6832	cmd.exe
8452	cmd.exe
1708	cmd.exe
8960	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4408	5008	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	85
PID 4408 wrote to memory of 2436	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	86
PID 2436 wrote to memory of 4272	2436	cmd.exe	116
PID 4408 wrote to memory of 2148	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	89
PID 4408 wrote to memory of 4068	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	90
PID 2148 wrote to memory of 4028	2148	msedge.exe	91
PID 4408 wrote to memory of 3304	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	93
PID 2148 wrote to memory of 4196	2148	msedge.exe	94
PID 2148 wrote to memory of 64	2148	msedge.exe	95
PID 2148 wrote to memory of 64	2148	msedge.exe	95
PID 2148 wrote to memory of 64	2148	msedge.exe	95
PID 2148 wrote to memory of 2252	2148	msedge.exe	97
PID 2148 wrote to memory of 2252	2148	msedge.exe	97
PID 4408 wrote to memory of 4088	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	98
PID 2148 wrote to memory of 4420	2148	msedge.exe	139
PID 2148 wrote to memory of 4420	2148	msedge.exe	139
PID 2148 wrote to memory of 4420	2148	msedge.exe	139
PID 2148 wrote to memory of 2968	2148	msedge.exe	100
PID 2148 wrote to memory of 2968	2148	msedge.exe	100
PID 2148 wrote to memory of 2968	2148	msedge.exe	100
PID 2148 wrote to memory of 3252	2148	msedge.exe	101
PID 2148 wrote to memory of 3252	2148	msedge.exe	101
PID 2148 wrote to memory of 1852	2148	msedge.exe	102
PID 2148 wrote to memory of 3252	2148	msedge.exe	101
PID 2148 wrote to memory of 1852	2148	msedge.exe	102
PID 2148 wrote to memory of 1852	2148	msedge.exe	102
PID 2148 wrote to memory of 3212	2148	msedge.exe	103
PID 2148 wrote to memory of 3212	2148	msedge.exe	103
PID 2148 wrote to memory of 3212	2148	msedge.exe	103
PID 2148 wrote to memory of 2456	2148	msedge.exe	104
PID 2148 wrote to memory of 2456	2148	msedge.exe	104
PID 2148 wrote to memory of 2456	2148	msedge.exe	104
PID 2148 wrote to memory of 1152	2148	msedge.exe	105
PID 2148 wrote to memory of 1152	2148	msedge.exe	105
PID 2148 wrote to memory of 1152	2148	msedge.exe	105
PID 4408 wrote to memory of 792	4408	fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe	107
PID 1276 wrote to memory of 3156	1276	xf92m8mp.exe	108
PID 2148 wrote to memory of 4956	2148	msedge.exe	109
PID 2148 wrote to memory of 4956	2148	msedge.exe	109
PID 2148 wrote to memory of 4956	2148	msedge.exe	109
PID 2148 wrote to memory of 2084	2148	msedge.exe	181
PID 2148 wrote to memory of 2084	2148	msedge.exe	181
PID 2148 wrote to memory of 3844	2148	msedge.exe	111
PID 2148 wrote to memory of 3844	2148	msedge.exe	111
PID 2148 wrote to memory of 3844	2148	msedge.exe	111
PID 2148 wrote to memory of 1088	2148	msedge.exe	114
PID 2148 wrote to memory of 1088	2148	msedge.exe	114
PID 2148 wrote to memory of 1088	2148	msedge.exe	114
PID 3156 wrote to memory of 948	3156	xf92m8mp.exe	112
PID 2148 wrote to memory of 4272	2148	msedge.exe	116
PID 2148 wrote to memory of 4272	2148	msedge.exe	116
PID 2148 wrote to memory of 4048	2148	msedge.exe	118
PID 2148 wrote to memory of 4048	2148	msedge.exe	118
PID 2148 wrote to memory of 4048	2148	msedge.exe	118
PID 2148 wrote to memory of 3012	2148	msedge.exe	120
PID 2148 wrote to memory of 3012	2148	msedge.exe	120
PID 2148 wrote to memory of 3180	2148	msedge.exe	121
PID 2148 wrote to memory of 3180	2148	msedge.exe	121
PID 948 wrote to memory of 4800	948	cmd.exe	124
PID 2148 wrote to memory of 5340	2148	msedge.exe	126
PID 2148 wrote to memory of 5340	2148	msedge.exe	126
PID 3156 wrote to memory of 5756	3156	xf92m8mp.exe	130
PID 2148 wrote to memory of 5776	2148	msedge.exe	131
PID 2148 wrote to memory of 5776	2148	msedge.exe	131

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4272	attrib.exe
8616	attrib.exe
8836	attrib.exe
6536	attrib.exe
7420	attrib.exe
4800	attrib.exe
5292	attrib.exe
8084	attrib.exe
8764	attrib.exe
8708	attrib.exe
9112	attrib.exe
6580	attrib.exe
8328	attrib.exe
5136	attrib.exe
9672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
"C:\Users\Admin\AppData\Local\Temp\fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe
  "C:\Users\Admin\AppData\Local\Temp\fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe"
      4⤵
      Views/modifies file attributes
      PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffb5a9fc188,0x7ffb5a9fc194,0x7ffb5a9fc1a0
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,16967877820782359897,11166858489146123921,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      System Time Discovery
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,17167371017607831340,5354211324152706847,262144 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,14843189345380979487,15824075071291290021,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,1780157534533103012,16416526850813796438,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1781207426205218928,15685936957841018095,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,1166908369925640212,8823425518603037715,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,8602709601011453311,5991689802237221498,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4444,i,11053276857246728595,268868075929372457,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4936,i,18405996953845746330,13525168307127782975,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5096,i,13313942136343572899,385837567917298449,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,8027310753101771848,5105875233913914361,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,4641952114849506416,432975382141766272,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5924,i,1047081652995978658,11956580855602002582,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6072,i,16644674714590958892,946347476214500243,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13546727429156835945,12102162702101862563,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6444,i,13973217125374653576,6049313711578517679,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,3149106865227288726,1654270600218680015,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,1724626415055592655,17001279750601727774,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,4611730056125311876,15967972817728675471,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7504,i,8608135788941675889,17699493807163740890,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7676,i,9746705132324970330,3416345940594882875,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7856,i,11546768666038979371,2821302180313178744,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7988,i,2470835311650757455,5502113900722411477,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7052,i,5326767798323840556,5276857805885333713,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8172,i,11868973522815741232,587059106165583288,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:1
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8508,i,2741678622569060564,6643034289305700582,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8636,i,9354741713361740775,445899468018427573,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8896,i,7737344738218956265,10015532248571734547,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5088,i,5617768251970941509,14386690408776531230,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9124,i,12429347570074549485,3022864169686655304,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9276,i,3428645551527886678,5891781437452538317,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9432,i,10553788447686598077,3666069567639069822,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9284 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9568,i,16064970006365005409,4736013325903355852,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9708,i,10289424832210820276,1691981144720246996,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10188,i,9501945705753573213,11525942260508112720,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10200 /prefetch:1
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10360,i,3915462442711865888,2298000218037519928,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5744,i,14374765091397172674,16900249646783283293,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10520,i,5941167195131463269,11372659108516409970,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10544 /prefetch:1
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4484,i,1355410305823727675,558017033342883975,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5812,i,17371283282886703948,3825515739257892244,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10816,i,2231126532958816576,14554911003101199769,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6372,i,48264096546105901,6821294299152823118,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10956 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11040,i,17118193877088699415,9626230343347479028,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11232,i,15034200730874678880,12124137855112804550,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11236 /prefetch:1
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11376,i,15381543005860305398,11222427764800024391,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11620,i,7076185997767087877,13580329481853161820,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11500 /prefetch:1
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11672,i,9798721616067210536,16045945678767500903,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11808 /prefetch:1
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11948,i,9867564730666791333,11258265397035637468,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11964 /prefetch:1
      4⤵
      PID:7264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12144,i,18121701462530385094,12032230193870340146,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12132 /prefetch:1
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=12272,i,11697509274399630054,2388696945891165980,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12280 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12336,i,1375568457449750073,17634611469892141657,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12332 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4428,i,12190985868812517035,3914312799428745295,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11840 /prefetch:1
      4⤵
      PID:7636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12024,i,16381032312899109205,2052516754694395987,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12092 /prefetch:1
      4⤵
      PID:7736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12796,i,393682162388606943,11812592426989817588,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12788,i,13861387918606381422,8853982831810714112,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5060,i,8939769555888738120,7938001925348659938,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5028,i,7550109806946146229,14215969613091543489,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13080 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=13364,i,9271661614693767879,4550894494740584978,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13348 /prefetch:1
      4⤵
      PID:8176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13560,i,14723953368054393734,12232380435086767003,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13556 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13700,i,6275023820186378415,8207298364452820092,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13708 /prefetch:1
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14072,i,10297297852516806391,18398692002171549538,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=14088 /prefetch:8
      4⤵
      PID:7272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14072,i,10297297852516806391,18398692002171549538,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=14088 /prefetch:8
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=13924,i,3984470447649627027,3747600023765800165,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12084 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13936,i,1859643587514870724,14368108996583667329,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13096 /prefetch:1
      4⤵
      PID:9008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=13224,i,596396397696686252,7289900545632603982,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13264 /prefetch:1
      4⤵
      PID:8224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13996,i,1211416387471236034,2233611383496022105,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13332 /prefetch:1
      4⤵
      PID:8948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14052,i,16000509177818571015,11020005966010230363,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13324 /prefetch:1
      4⤵
      PID:9324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=14168,i,10599624807409832965,11422038953413642760,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13280 /prefetch:1
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=14204,i,1191458384144492565,9704822788020344817,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13252 /prefetch:1
      4⤵
      PID:8760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=14288,i,3500684305677217484,2269183721186606613,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13288 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=14312,i,8185213180996917525,16564377257342047002,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=14304,i,9649560895078875248,2421376928059367314,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13524 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14352,i,18021580407305277169,1020281542029745643,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=14368,i,16745798876083085166,693299960167825923,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12896 /prefetch:1
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=14404,i,16985652360715802503,14863879774286542952,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=14428,i,16589594293813268617,3135549317863969196,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12892 /prefetch:1
      4⤵
      PID:10924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14568,i,16903576267116674631,162783964784806530,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12924 /prefetch:1
      4⤵
      PID:10916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=14668,i,2416574504117891579,10173850565730924794,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13008 /prefetch:1
      4⤵
      PID:10892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=14696,i,1323126672218143876,11722660649026418731,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
      4⤵
      PID:10864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=14736,i,15876395175910907979,12034876239351093018,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10812 /prefetch:1
      4⤵
      PID:10804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=14332,i,4616082451510767192,7353952139833483139,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10836 /prefetch:1
      4⤵
      PID:10768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=14764,i,4996737071626316324,12072402630868176713,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:1
      4⤵
      PID:10700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=15068,i,9596105447344547594,4988954020333532744,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
      4⤵
      PID:10656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=15168,i,12587025557931330087,14255189494213671216,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
      4⤵
      PID:10580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=15196,i,7422159388516236804,15015191782895962279,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
      4⤵
      PID:10532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=15220,i,11260743644422511589,5698440014719138747,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11888 /prefetch:1
      4⤵
      PID:10500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=7480,i,2220812238780225542,15517581469709981511,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11868 /prefetch:1
      4⤵
      PID:10408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=15236,i,3662303519962651535,17166590121308264021,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11892 /prefetch:1
      4⤵
      PID:9908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=15268,i,9430088316583076273,7986230631674675281,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:9880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=7548,i,11934280271763658276,12634448135439682750,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11728 /prefetch:1
      4⤵
      PID:11228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=14804,i,6218824344882972638,3641163149553877077,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=12944 /prefetch:1
      4⤵
      PID:11248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=15312,i,94011644790586288,9975221516553071136,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:1
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=6504,i,5955852039630067510,8088549530917758857,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=15340,i,12038710307021841550,2713987695178876998,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=15388,i,11734208669362875600,5800917575277186036,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=15408,i,6447688791728102045,17820420812701547500,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=15652,i,8399449669241277299,16496601287345268572,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10672 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7007612577852587974,6004989195012188719,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:8
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,10518478002089653925,12980694402768143415,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:8
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,1812069692870103509,13011434102316179442,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=15752,i,14779446989285538578,15413706826721960902,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=15940,i,17557233505461178894,585911322971869335,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:10364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=15968,i,5762352587565346192,16134468581254537636,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:1
      4⤵
      PID:9860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=15728,i,5948134372228405491,2712488811148847443,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
      4⤵
      PID:10796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=15952,i,4428327279727331898,7308447467135758701,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9128 /prefetch:1
      4⤵
      PID:10344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=16188,i,6493083272512489423,4397002707575145586,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=15064,i,15519388279275588419,12742764598882882242,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=8032,i,12040710436527169756,14329048910603768652,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=15712,i,2514222728031779529,11827583137396947069,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=16072,i,9253477224306771047,17936366138560512454,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:11128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=8060,i,11175085354730684147,12097711209494746820,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13900 /prefetch:1
      4⤵
      PID:10444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=8092,i,16420873635523704250,18362831448965378733,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13040 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=2160,i,7728895189517045082,4782965403506480251,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13076 /prefetch:1
      4⤵
      PID:10612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=8096,i,5662992528853135956,13744777479118575743,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:10056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=8088,i,3797530730433902472,11221768529763161749,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=13876 /prefetch:1
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=16328,i,15338025151205975710,8812248090224310738,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11008 /prefetch:1
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=16332,i,11711442232407327582,14333654870693627842,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10948 /prefetch:1
      4⤵
      PID:10088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=16496,i,198147224908508209,10386908471823875848,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:9868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=16524,i,15769519848561750897,260972496145714628,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=11252 /prefetch:1
      4⤵
      PID:10060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=16540,i,1186440065586017083,2319236394734052506,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=10956 /prefetch:1
      4⤵
      PID:10032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=16560,i,11877828426591590572,13906944148622608767,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
      4⤵
      PID:10108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=16588,i,18215352027094177732,15334832985315637719,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
      4⤵
      PID:10216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=16620,i,5297158451202836848,13596669277526251205,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
      4⤵
      PID:10224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=16636,i,6496719226117852745,10200127476582680015,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:9164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=16684,i,2894147759438326422,11620877553091687500,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
      4⤵
      PID:9236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=16708,i,4690743802411262944,1448800019605924483,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:9380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=9164,i,1436145703125926314,11834636557017504736,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:9744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=16724,i,8533090795704807227,9051267727949913797,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:9368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=16756,i,6580104278721340834,810465265370355172,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:1
      4⤵
      PID:9844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8263893451304249893,857592930995794261,524288 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:8
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --always-read-main-dll --metrics-shmem-handle=9564,i,13051710519151406688,15415989458754794137,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --always-read-main-dll --metrics-shmem-handle=6372,i,18336186142279907269,5550030201391085355,2097152 --field-trial-handle=2252,i,10871590606790276132,13546731193928151367,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
      4⤵
      PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1464

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe"
      4⤵
      Views/modifies file attributes
      PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5372

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe
1⤵
- Executes dropped EXE
PID:5632
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\clmizr4e\nrwngm2c.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe"
      4⤵
      Views/modifies file attributes
      PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe
1⤵
PID:6176
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0s4esoy3\zbp7cz8y.exe
  2⤵
  PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6356
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe"
      4⤵
      Views/modifies file attributes
      PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4384

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe
1⤵
PID:6496
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgms8bzf\5wxnogni.exe
  2⤵
  PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6832
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe"
      4⤵
      Views/modifies file attributes
      PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7308

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe
1⤵
PID:6532
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qbtukifz\5xlqihgl.exe
  2⤵
  PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1708
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe"
      4⤵
      Views/modifies file attributes
      PID:7420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8100

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe
1⤵
PID:7768
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jjnf67v5\mbxfxaju.exe
  2⤵
  PID:7176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7864
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe"
      4⤵
      Views/modifies file attributes
      PID:8084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5860

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe
1⤵
PID:1552
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67zgd4m9\rni3ve9j.exe
  2⤵
  PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8280
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe"
      4⤵
      Views/modifies file attributes
      PID:8328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8524

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe
1⤵
PID:8596
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5bg2uv64\e4csbab6.exe
  2⤵
  PID:8668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8696
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe"
      4⤵
      Views/modifies file attributes
      PID:8764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8288

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe
1⤵
PID:8440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jv2n1zsi\ef8fovkx.exe
  2⤵
  PID:8504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8612
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe"
      4⤵
      Views/modifies file attributes
      PID:8708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8212

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe
1⤵
PID:9136
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6i71p2rb\af4ghm3e.exe
  2⤵
  PID:8276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8452
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe"
      4⤵
      Views/modifies file attributes
      PID:8616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe
1⤵
PID:8432
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s1ryfjj9\b7aglmr8.exe
  2⤵
  PID:8628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8652
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe"
      4⤵
      Views/modifies file attributes
      PID:8836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8840

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe
1⤵
PID:8660
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9vtjnugs\fusahtxr.exe
  2⤵
  PID:8904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe"
      4⤵
      Views/modifies file attributes
      PID:9112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9356

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe
1⤵
PID:8424
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sjso4g41\9tovl1ae.exe
  2⤵
  PID:9000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8860
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe"
      4⤵
      Views/modifies file attributes
      PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4380

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe
1⤵
PID:9720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nkjn4m3d\ym1lt0oo.exe
  2⤵
  PID:9848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9904
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe"
      4⤵
      Views/modifies file attributes
      PID:9672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10788

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe
1⤵
PID:10548
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3qj8gz53\zixveesh.exe
  2⤵
  PID:10680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8a4ffol\oj10wq6d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10736

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:10424

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4192

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1274c8c7-4aca-4f2f-8cf3-43e2f8a9f012.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1274c8c7-4aca-4f2f-8cf3-43e2f8a9f012.tmp
Size 12KB
SHA256 a25fb7f175817e996f5859ebecfdbbac2f65280b40c0ad35d6e218f097969577
MD5 3051d53581a9033562027a3dea190ff4
SHA1 71b61232d6e185e8caaaaad1c841fa8bbd890b27
SHA512 0b95ce7e871dff1ef60e661feef91efd36de833cd462458833a5353319742632af0a2e8cc375a973159159315154b4bd886782311e41279af435d9f39ad25a8f
SSDEEP 192:uuN0sNseQUumH3QmiU1GNFyk03HZ/NPLIbIqIjXjqCs:n2sNsev75ewk8lEuX3s
TLSH
T1A5426DB168796C375EE7A141F1463B639EF450BBD9C42F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6969da50-d1d2-4a50-8756-8a6be83a6972.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6969da50-d1d2-4a50-8756-8a6be83a6972.tmp
Size 12KB
SHA256 5b184a4c6d3b6f173ed408dcf1afd50f107ea63bb10f7df48a786248db02ebf0
MD5 dedcbc4b26c714c66e8bedec7297b01c
SHA1 09bb284102d6c2c0b3f82b2476406385f1d292fb
SHA512 9e98a6a8d632badcf9336f1c160304d14d97126ff87aaee10c55571f189ff72be6355c447c92c0253f6c0022a0f532f5ba7a6960731ed2c04250a7ae9d7d0d35
SSDEEP 192:uuN0sNseQUumHPQmiU19NmFk03HZ/NPLIbIqIjXjqCs:n2sNsev7xl2k8lEuX3s
TLSH
T126425DB168796C375EE7A245F1463B639EF450BBD9C41F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 c62c290c09e8cb12b30c7a7ac26b8d4df158350dbabc5d1eae24083c8cf638db
MD5 cdea40d02be6a703cf718c312d2885f3
SHA1 202b7be53692fe941a9a33d5d2a498f912e7edb7
SHA512 0b63ed0e25203a4628140391bdeba54584dc8256a0673970182af00882b575774a4b693fee75dd51e273269ccc9d4c6ae6e01b133acd145cd16bcb0d4fa939d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1F4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 90KB
SHA256 b48363bf074f8091eaf45b3e2537fcd7234e337968ed1eee25a24c4baba60911
MD5 8ac195ba169d961ba21212bc05bfcae7
SHA1 551dcb86b5d682b00c1ad2292b92c6e203f9913a
SHA512 f392f38edd67b36ed03710ecc2bc1a41c9ead7d0254d5b5b11f191eb7cfe35956c3284378a8159850ccc2a841afb58ed990eac3312accfda51a900cc6ed81b6b
SSDEEP 1536:jOc80HUHZxmCk5REHO2kDt25RNr7aydZ5h5xdrOIWizVjt91CcLGeNhc9/mBI:jO100HGCk4u3c5bhwIWiFNCcLR6D
TLSH
T10793024D81A248FD19ABD77563E7F17A0E578E49382A13188EA512033D24CB5AFB337D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 48KB
SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
MD5 7fe007c57ea8a8682c097519166c4943
SHA1 7de32a85a9c2e094c62d5c393a44e9d4b0ee0b28
SHA512 298499a176722aee739bc846b96209ff4f618c7ce305acdb1f930d4e6be5961b411bed13363d1d766ccc5c470facaaee9bfcba11b1c04cf4e2de9b952df32d0c
SSDEEP 1536:KkUOL7TTaDZ3v+Whww93ZrTHjLgOoXRk/a:ZUGuFvnhww93Zr8hBkS
TLSH
T1962302E24F47584EA81B6BEBDC91564F3CCD00A519F06EAD143F81941AD6E858C88BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 105KB
SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
MD5 68b11256fdb00ea264efc414a3081289
SHA1 edaccbe8eb8e0326944b82d03d00be43460e2d7e
SHA512 f8db4fdd6d8315e3151790263a353bf89666dc675e13ef6cf3b084e05f6c03b596c8707fadfa43c42d7201fb86680e4574f0a0915518a5d5911c0d1a0bb0f9dd
SSDEEP 3072:ym0RR8FYstRkmRYjNUUetU+0Q+FgPv474lJstNMWL:SRR8Fz+UUSmQ+F6wVNMY
TLSH
T1D7B312969BE7F3DCC165A8F78949F361D01C6EC81016EB6691426337CFA9001078AFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 149KB
SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
MD5 dc396e633ee01774f0f0b2f1071a566d
SHA1 46e628c30392dcac3b041b5bdfb5df890231d143
SHA512 5bb2742d2d0339e1958cf57c7f8f176a1eb7160436fba9ab43d8f9466a7b0f4a40c7720b03878802474778a5cd1712e68508c5cdf73820cf674341d1e99c1a98
SSDEEP 3072:cbzKhLEOClRbBX7XiCNVHkz9JHXslX76tejVBedwYEdidbKjcDO7MA:c36lShBrXLkz95slL6qvYEdu+jJMA
TLSH
T16BE312182A23CED690EF543E9CF37CA7762F6D902F50599909B3388C524CDE19B5B398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 21KB
SHA256 a8d4cef7e4495cefca79668bdf0169ec8b19abb437b2bb76e68ace84b0a1c10b
MD5 c5c01009251e0503fabdcdcc9664df93
SHA1 6547b070cb480be57ed8c6c59a303b990b4102bb
SHA512 efd799307bd7f4a990892dc30a3a3ccf42ad6d20e48138290f759a926e5c91f29a252a9b3841e323e82c9984c0b2f5df4abd542ae58c377fbcf6036346e4e755
SSDEEP 384:HIbUbl0dWc7hcmlhsOnlWIPrZ2+LWFvXLwNdTqx06vgFmUaWDzXFejtOb:HIb9Z7pz7lzPrZ2hwNULvglDZe5Ob
TLSH
T133A2E1E3C9294B59FB8FA938B16E19CE6E665348E053C23C80872E81761DFF15D0B46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 76KB
SHA256 bbdb4de36778b9dfaf0d76f72ff5eee62586cd6f885d5f60b21436c64f9897d6
MD5 27133cd77bad23037dd37ea625f629be
SHA1 7d684f9aae9346022129138bad558be1ae13c93a
SHA512 3b42a4bc7f4bfc67133b6771b0bf30bbba215124e508b728ca9f42050887bdb7f98dd8c55c82193ff50ce5847a9e4ccecbbf3d77c50fef5aae177ae0f22a5e6a
SSDEEP 1536:zK5VCBgVlaRCfvydYadgqwEcJweg7MixcejkC+mQBYaNlrW:8hVO35dOEcJaMiFjkCEHrW
TLSH
T1B77301BB417F83CB014E9A5D1F46D099034539BAE6E961F120927AE437EC3B902635FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 92KB
SHA256 06eb39208883d683d1bdced76746506c53f9eb004a26b546c833de9597c68f5e
MD5 71f8141525673794be71853eb305f43a
SHA1 3950a35fef794d40d4cc58948c6eebe7727aef6a
SHA512 fdab2e4fa496ace5b8861c5431e4de89d0b91202e626343d8fa07ecf8e66380cae0cb1b9fac94bc7208ab1a5d819683638069791b364684c7280645656f410cc
SSDEEP 1536:ZrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdyk3:3+dCdU1UKok0HaFA9wRw0YuoqsmGeqOe
TLSH
T1F69312BE8E3D675A000DF32C46DCA14F80AD4AC5D901E3DA07ECAADB4172C195E384D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05371d1561265971_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\05371d1561265971_0
Size 284KB
SHA256 e5fe1804314810e102406853fce8cfdce77659037cd919a59fa635548d9fc122
MD5 c671910643eb86a4b91f94e43a391071
SHA1 6a3ab90bc9757f674e9d952bf8da4575a0d22a67
SHA512 d7500947e025fa577045e22abde82f0bf3ed4424b0a63f39a72bd894016a35e3b13ae7b754294811744f962bfe15b15900299754da7f0d1a6c24a5ef07dd879e
SSDEEP 3072:5y7F6aHkbodFYM7TXPIvX3cLarayRnQRmT0Kr8P2GFm9PiXCU1fs:5y56aHuvniNyxQRmT0KYPPSPiXr1fs
TLSH
T19954B5651B90EE29CF7A63F51262CD53A73151083FD7931771E4A33A3C492E25F8A88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089095ad8af62786_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\089095ad8af62786_0
Size 113KB
SHA256 32aefe6c067866bef68e0f0aca8da0337ae8ee2c355fd7bc92e5a6c6ae9d45fc
MD5 b4cfa7f34627a52800ea3016b6d505c2
SHA1 4398a1e8f469699a8d0dbaf7a0aa5b66786338a0
SHA512 5aa3aabd1c507a0c7139349dcc79eefb1fcf82748fb2878d87a59bff8f0e7711be8501db0f1d7331b67a808cc176a60b8999d7d3623fccf96656d730ff299a92
SSDEEP 1536:PYu/Z76L4iGj/xNQ4ouhoFalkpYo+u5xuYmrvQVRNQyXbE1m:gzLXGPQpuOrxW3rvnubE1m
TLSH
T1A1B3C5011760E649CE6623F905A78A53A77480892FC7E72321E5E7357C4A3F16E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1327ce73c473ca58_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1327ce73c473ca58_0
Size 283B
SHA256 b4dbf4671419802e752efa3c5fce4a5ff334fff54c898002aac51dc43323ce40
MD5 cc0ce06f8034ea01c59089342a680f5c
SHA1 a10ed32ede670d89a98ea23630b2d4777e075ae7
SHA512 e351bb7e21db8e14129c3699c5e711c8aa26ab85b8ea8bf55991107b363f9ecd4f98ff015bab813135275d513a2c57e30933033727db189105496a0ac78e3bc3
TLSH
T161D0EBA70C24B6B4F9749FF0CB367B03C226C05C887E81C2C00882721720C3C85CC464
MD5 SHA1 SHA512 TLSH

Submit Download

17e48ae9ec0065c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17e48ae9ec0065c4_0
Size 283B
SHA256 4eac0c25e65cd4c1d8b542d7934fda93c450e4546c0793a9e03229d5f1a91693
MD5 c4d1eb32d919c986bd6344c42c6526b8
SHA1 0af9d0576b45fcb11151e6a43cac5c85270921d1
SHA512 384d1eb21e7d2e80b87a802b1cd67400c3c44522d31e5a6a0271e78a422011344f14b63c3e90dd36ffe0365ce642f7671a8498a05acc344d5710c88cb284364b
TLSH
T11AD02B5B0028E0ACEAE5A9F0C77E1216D39784CC09AC86C6C11680B13485A745548515
MD5 SHA1 SHA512 TLSH

Submit Download

3d298bfd6b2d7e16_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d298bfd6b2d7e16_0
Size 545B
SHA256 f9491df120b9429988dfb89daebddbcf45a30d12473011667c1457026aa732a5
MD5 1173e6479a331166117900c4474ce4b1
SHA1 316c8851cc954b3b597fb0a7ac584aac803d96a5
SHA512 c4fbdb7cdc7ee8a515b398c38ab9ca1a30d4546f37e4f74f79b8872833f4b585bcc00e5d327d8700f0700bbbb2effec76d15616770ae477307ef3beb89130e9b
TLSH
T12CF08B578149B806FF2549B949A7D7439342C4E009AD49A7910821D33646D39385CBF9
MD5 SHA1 SHA512 TLSH

Submit Download

6461897ed888391f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6461897ed888391f_0
Size 283B
SHA256 b1bdc6402ec2baa2520a7a9e2688524a118d2ccfb835c1a6f27d30ed056007b6
MD5 2f94d507bbcbc5f5a57691a7bb3206c8
SHA1 d7f1435d767366a76586a7fb2ec9d41c9567021c
SHA512 ea95558aa6dc4c71005e353c31e4b7a1a8f6128e285a216cad8246c4e4acd17456f26320d613c79252845c1ed67ac29340055f51e52a29946479bbca0311a5c7
TLSH
T1B1D0C24F0028A418C920BAF4D637720E8653502C482D8699410660B17643674668D296
MD5 SHA1 SHA512 TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 9746509b21de23310a720b234fe67754ff776bc99e9ea4214402a3246da6137a
MD5 d4578bc4c2dabf2e84cf573269814331
SHA1 1031ca3bc57b27404f60021c43518f330f13b089
SHA512 c3ef6e5acfb1b6c95022c30d8dd53409a36929a6ef0d255ce98acbdabdebee3d928aa3ac9f98e924315f4e9e3c0f88647d6bd43b659c15a03ac64844c333bd17
TLSH
T17CD02B1F6A059828EB5875F0EBB6625AD221DA558C6C8589401821733B05BB5AA0DA21
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 19453ce1663630200536789c6b47d11b990566ecbd5d4e3abf7ea08ebc63fef9
MD5 742d375aa0e9763aab878e8718838afc
SHA1 8575405539462a3d6f3329b95a0e2b5cc4dc6aee
SHA512 688ebc4f41a190a466ee6e7b7d5b4582e0bf8dce7b0156610ec7337b1b08cd3791d83e3ad833961451ee356cd0b30584cb315d24b717e8ebb90b18703e506edd
TLSH
T161D02B6F4348B418DE308DB0F6AB3201C1BA997C4D1D51A0471D20737405E79AABD615
MD5 SHA1 SHA512 TLSH

Submit Download

a4879302a7de9e5a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a4879302a7de9e5a_0
Size 591KB
SHA256 61b725b3f2380ab70596c75f1e048a77bbd82267b0e59ddd0c905f283258806d
MD5 532986d8c7e533d0ef9573a8871adfa3
SHA1 b01af43669f19a192daa0a47230e50cbfdb50b21
SHA512 cc52a4e78c5e51f8c3b4ce4e761e191c45ba83e948b5c77820e7371aa992f5c8d46ba9714ef6dd6be4c4f5ddf4622c1e6d0dc9e7db3aca26b549be26b396a30c
SSDEEP 6144:B/LJNq2AtRqlKUeJx2va/OLzsAmFAQQO9fkoheWBKHwZEA/52blfk:lqbQl/cQLLzsxZfkosWBKHw5/5glfk
TLSH
T1D1D4F8080790EA55CF7623F501A38957A73581482EC7E727A1E5B7363C493E26E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed391d4a3bb729c1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed391d4a3bb729c1_0
Size 318KB
SHA256 a6fe7d4bf5840d56a563141590847f3c2691890320bee99ece722bed26f77672
MD5 a73b9630e0d443589a33b3defc397fbc
SHA1 53849f11236a19ba37cdc7f382761cdb89aa7f75
SHA512 7640558eafce21481e4e6c46d185fb98f1dac96d4c8c1a09eb6a65a5c4e260fda8712cb113b2c2d399a524e32662b93660921e4a5639b785220ad67adeee3db4
SSDEEP 6144:EuPV3IzIFO4hynZIecdL6t3r5bQztFCKKdkIy6V8EXA:EudGIFO4hlgRKKdkIy6V8b
TLSH
T1CE648EC55B58F9E2CE1766BDB0B11F0A437540086DDDAB4A916162623CC82E12FFF8E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef9736ce02709241_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ef9736ce02709241_0
Size 472KB
SHA256 5229647cb76acd1036ca85bd2600f136612ddb70a4cc5c5d272b369cee6a6e16
MD5 16853f099a90fe402693c1fdd51c5372
SHA1 0307567c8cf3c61d419ebb5b7dabf5c876440cc8
SHA512 f335f74675ccda4ae7c0067bd51e915ad1e79ca50b0ab1d58f0e0883f5a40e7c59e7d825025231fb949f8d8a5d0b71a6ca1328f6e476c70f86164d487d6eb613
SSDEEP 6144:plWNwyG8+Gp6HN4riYzevaq4wa9LeKQUFgMD+dxsA/jHZ+f7D6:p9T8/8HOlQSwI6MidxsY0f7D6
TLSH
T1A7A4C64917A0E955CF7623F442A2C953A73144497EC7E723B1E8F73A3C4A2E15E4A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa81613e9e475efd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa81613e9e475efd_0
Size 304KB
SHA256 7307ed1b93591c5bd6cdcd20de4a17177195fb1ebf37e6ff5eb0e2aa6e16eeea
MD5 0eed28159c2c4f1fbd4a39af44e86021
SHA1 a55f5a16fd1b6da68cb2aec70038c28398af3b6a
SHA512 60a649b0c926a44ad38db861bafbe354b5d5d559a63da53e388dc0b9b64105f251fd6737a2f8b4f3828d20db71561e46d3e98c7a7ad11a03ed95e619e767a117
SSDEEP 3072:f1EsmhzHq5PywET5kOUZa3OP8hUafpjFbPinPs5kJ7RJtYGtUqmRsUc:NEdgPyrFuZa+P8hnRPMsQ7RY+yc
TLSH
T1AA6494595790FD94CB7A23F445528953B731848C2EC3E32362F8B73A3C4A2E55E8A94F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 558ba809da2bc29e25819ea5681bb3e5f8c40ae7aea034283d3d5a11c76b3cdd
MD5 7e2470dad2aecba9351f5c2d1be94b38
SHA1 65ce3f95d4adcbda793dfc6401b4f4e6a3814173
SHA512 de69bb4f6f5af0042fe49246debb627780eef7d4214c718d6dd2ba64ba86f12db8d0475a8baa414b57e05fa891dff5c6d3bbc6323ace6788e93ba16a809da214
SSDEEP 48:DxGRjS1sMp4bkF8tgNJq0WOKP2AzEDEnHGQvLT7mF5HAylfqQiospJyb550TKnp4:Dxp/0kOKX8SQnHGWKHguioaEb5Nq
TLSH
T103911C1442B28463EB543CF2E5C82D5334FA85982E9F5FE606D258BF9E1A7E5E019434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5980af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5980af.TMP
Size 3KB
SHA256 aad8dc6b559423b301d21c587e166e52a8a2b17d6699b9864877d0872b3d0a92
MD5 e87debcfb9ec78972440d03df997f5c7
SHA1 44e0d8197198a7bc42cda3504da90abe00229aac
SHA512 3d19b07f7cc3001d76ec3ca35f6a4dcdb806dfd3d00178a8d1e3e57bc761e671f050882322b0648dcac2de7fd91d7d67bb18f63f993dfe0999a44c5833a7a30b
TLSH
T16371D815017380B3EB243C31E5D93E9334FF84A83E9F5FA615D1457FAA0A7A6E421834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 87da385845bdaad0cc0219a42aa8777849b6e4cdc8f94acc84ea7cb1d32bb985
MD5 29b7e5cc11aae26591f934eddc24ea9c
SHA1 09c204bad65b0fc2193fd0e1b6e15696632ecfd1
SHA512 755350ae8581b52b4115b6780a48bd72cd23dbc599b125f1d0bb12374ed278add2f158dcb088882f980c639807b1b8490d637d4883c1a3b29011ecc146d4d444
SSDEEP 192:sxZfORGyM/jK1Ml8MjdS/ffsxc83EdpLV1WFb/W6+WNiuczMF9ntpYB7SgqbIgyJ:sxZfOc7dS/ffsxc80WVbkorpVO
TLSH
T15152FB526A386A778DEBD219F951BF63D1F50462D2900E54AAFCDE1C04F6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e9f39f9be1eb5b7e4588048653514c786ab16bbaf9284f464392025236fe6d36
MD5 1270008d3d8495c72c7eb6dcca3a5773
SHA1 0e530e7f0e0de1ba49821780cde168276753cd12
SHA512 5ed047ba47df9424f99e2630ef645b26178ff1916868a0672bacb48f36669023750c4f6721d411e281668b7defe3f3cdc9f098ef4c5932db6e1b4054b74df127
SSDEEP 768:5B8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcALl6opdyroqkrUnw:5B8iJANWvx76ru1jaHALocdpdUw
TLSH
T133E2FA3B680CCB7E4F844E9CEC266F966DD801CB5A984D5447FA884C03C76EE51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d6a7d676fb9fe225eb244be863c9498775ca09e04d20cb71da164399aa882834
MD5 e0805be97a7200a6ba8eb7e4a76133d6
SHA1 56f2ad4c12decdd48657a5103fbb2751b20ef129
SHA512 67921bb34d1d2dd14c63e089e71d92f36c59b257ad3b2c881d0d8fcb89a671ac84a340e45fc8cf8399f59014b6c7148f53327033f24acd257f79759608358186
SSDEEP 96:KUQQKlCS2FqK20hBmKaEaW9SKu0lCYKzSyg:y/pTtZJ3g
TLSH
T197D17A1630BB1B832DBE2F0C96959B1A4B4175A33018A82B7FD940794DAED340DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f75ebf9d07642c239e7edb1310a22c13b8208a496e2fce9cd6e8044aa6e9a8f0
MD5 daa3b9a2224eca7b8c2499abdd23c412
SHA1 2b035229fbb81c2cfae26fe87852086fb8761edb
SHA512 7cedccb6481558e4f378f363b37d5fc7e184605aed4e7aa803bf45badd14e6fc19579b1fa79e55a7b9c9452e4b70204b5c37c031a01e1dd702cd348c8ce9afa8
SSDEEP 192:uuNosNseQUumHiQmiU1BNXgk03HZ/NPLIbIqIjXjqCs:nasNsev7+hwk8lEuX3s
TLSH
T15A425CB068796C375EE7A145F1463B63AEF450BB9DC41F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3c2e4348f61dec954df1294602b16f78af9f5c406bccbf72197f33df168b313b
MD5 49e69b0d988ec17e8ccd582a0304321b
SHA1 726a6e50338847f43bf3fc9d9f5c44da547b3ee3
SHA512 8d5fb3f7936c5f4300126e5594591229c08fddce12f519bfc9bc1629ad268a9cbb122fa1a69e926fc159af1616d98f20e494a17fbcc63682c2b0844557a8d0ff
SSDEEP 192:zKggsNszQUumHjQmiU16N8bk03HZ/NPLIbIqIjXjqCs:zksNszv71yGk8lEuX3s
TLSH
T1FF425CB16879AC375DE7A245F14637639EB850BBD9C42F98D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 224590713b437f9d19196b3f94df272307c16099d930b2d4ebf0d5f0bf16f425
MD5 83aa117848f5f3b428a567a9dcfd99f1
SHA1 2bfddcf222b823adea46c256322d347da2696df4
SHA512 794f808164088b3bf578659d41f67670ff637d25b2c507feb37f8284a793bcc35bb6456d70eb0d5247259b0aa3d836482f334b1b599aa2deb164eb41ae1922aa
SSDEEP 192:zK8sNszQUumHHQmiU1YNH1k03HZ/NPcIbIqIjXjqCs:zzsNszv7JMVk8ltuX3s
TLSH
T161425CB16878AC375DE7A545F1463B639EB450BBD9C42F98E9EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7e610be865fa6be7d50625c601ad4f0a95d85c75f6a5cf52ce675fcef034eabf
MD5 1c89b9870f4c40faae499579984ae745
SHA1 85c6bb78ab3c9436e1fdb9e57a61b32c4f0e53e6
SHA512 df56ed5f4ce0af9ac556a2417821c0b155a217cd8b420a9c71068c6c8732c62965aed3f4686fcb3e9b4d717aea791561cd907161731dcfd3426271ff67a8e98a
SSDEEP 192:zKWsNszQUumHNQmiU1tNWgk03HZ/NPcIbIqIjXjqCs:zJsNszv7r5tk8ltuX3s
TLSH
T142425CB16878AC375DE7A145F1463B639EB450BBD9C52F98D9EC9B0C01C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5a812bfdae1886afecc7792eea7b8ec5ac525185c6956ccdde9b75c492a52116
MD5 04ddaec889be801693128bc431c9195e
SHA1 51c6d4f49d1b210fbc5e35571798310271d17539
SHA512 05ba50ba3d8a06e4c2bb738f0fc1f93275c665f64364b6cf4bf649930e0d0183085abf34137cea5c01ab9592a281200575805d242a7711267a15c8281f732194
SSDEEP 192:zKEsNszQUumHdQmiU17N4rk03HZ/NPLIbIqIjXjqCs:zTsNszv77juk8lEuX3s
TLSH
T1F1425CB16879AC375DE7A245F0463B639EB450BBD9C42F98D6EC9B0C01C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c44a0832fc6e87c4db8bc12825e81036aa26b3b9e84f7533e5d8789ad0058baf
MD5 5fe9046a6d6ffb330448a043655c86f8
SHA1 6724fd74d2ff05c5637871db09a316a173e013c8
SHA512 a62c1a20971d3cfe7f9b9d8ad9e4810af4620c1ca35fa1043e73eb88c2395f383a4d091b3e6c34ae8d0b079d7a9590423f02636f942b2c1bc78f61db73703add
SSDEEP 192:zKggsNszQUumHOQmiU19Nrok03HZ/NPLIbIqIjXjqCs:zksNszv7qtsk8lEuX3s
TLSH
T1E5426DB16879AC375DE7A245F04637639EB850BBD9C42F98D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ec6c182375b16c23b696b8d6bac762b84ded80a544916e8dbe235f437d9460b0
MD5 4da779e9a581c880268b45b623c1812a
SHA1 1a750ca5472238aef33467b8a4e37ab411bbe84c
SHA512 fe8b0fd9f93662dfba77bb0fcd3a5132defd78a9488babcf595dd6eba59398c5763daea29b00ffca39227821d857cac780797f6868041a9bf3283d017220cc76
SSDEEP 192:uuKesNszQUumH3QmiU1UN1stk03HZ/NPLIbIqIjXjqCs:nhsNszv75c1Mk8lEuX3s
TLSH
T163426CB168796C375DE7A145F1463B639EB450BBD9C41F98D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0d42ee2d62c85c3f1ef5b95ab7f0a2278dc65577768678dbdfe31cc895544f2f
MD5 224b5a6a2b9df4e1be9f92014f6a6667
SHA1 9964b94b9cdfee2047111ee32b96b7e9f9a6d337
SHA512 2ce4469b45422d3148b97117801ec1348f7cff7b07d67ac096ab205d30b39506dfde7c12a7d87e966f391fe681bc4c54a85a39f17d74f860828b832edb55b5db
SSDEEP 192:uuKysNsxQUumHXQmiU11NOtk03HZ/NPLIbIqIjXjqCs:nNsNsxv7ZNyk8lEuX3s
TLSH
T121425CB168796C375EE7A145F04637639EF450BB99C02F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d5956419ab7087c57453396cb713f5d178f7d019a4fd600653c700fa00b47441
MD5 4cf5543b60ffb965a3c57a741168f8f5
SHA1 087d101bacc899419530a024179b2c55f8e9f901
SHA512 941630184c03041764f143ab2059b8c2ebe69bf13f22bd0fb4f347df9fc304b4e547f173bc289e4037744bceb11ea47026aa6926187119473f0e1eca77031d56
SSDEEP 192:uuKCsNsxQUumH0WQmiU1RNZuk03HZ/NPLIbIqIjXjqCs:nJsNsxv7UydYk8lEuX3s
TLSH
T1AA426DB168796C375EE7A145F0463B639EF450BBD9C01F98E6EC9B1C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0caf85c366f80ca80e5b55e3672187efa192f3d35114f6206ab8db4b1b375b31
MD5 d782e2c05aaea5faaefb57e76ac555eb
SHA1 6b70663979352125c97def0ef0d6c6c96ec59d17
SHA512 4735d5900f9d748a38e937b2c788ba7f7234641852b617003a7fa64ee59a9d912c898bb9db7b259985dccca1a735adfef825edf2514b3a2c3b2100f387674999
SSDEEP 192:uuKJsNsxQUumHbQmiU1NNVSk03HZ/NPLIbIqIjXjqCs:n+sNsxv7tZwk8lEuX3s
TLSH
T150426DB168786C375EE7A145F0463B639EF450BBD9C41F98D6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5216784d504f2fea2721c491c5896fff76c502e62b100bbdc23bc6c75434256a
MD5 3244afe71fcc892408626bb3471a19a5
SHA1 540c8538dec173816bc3f2b167319d7e31ea107f
SHA512 7d7954a23d598f2ecbae108be6a9216b4c3c05c258125ed436c93753686f140593a26daa4b42bad74ec1cf09914466dd017049f76aee66000af2816552b042b8
SSDEEP 192:uuKasNsxQUumHnQmiU14NvIk03HZ/NPLIbIqIjXjqCs:nZsNsxv7psAk8lEuX3s
TLSH
T1CF425DB168796C375EE7A145F04637639EF450BBD9C02F98D6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7ab0d420f99711f7ed8fd5d6e14f382029f3522cc33d6238c4f78abf0f07277d
MD5 f4060a2793d6ae02c148ebbfe682a129
SHA1 647beee73323ca140e70843f398e0b0aba0e2ed4
SHA512 e3cb53f3d6375ce5dec4ce2908d12440dd319b6c7a8484cc80a6270aff06bfd781f6252042c5688eb63f51d0aa5dea5b4beb1bbc327eb50756c81080ff4d8043
SSDEEP 192:uuK5sNsxQUumHMQmiU1EN7Ek03HZ/NPLIbIqIjXjqCs:nCsNsxv78ook8lEuX3s
TLSH
T187426DB168796C375EE7A245F0463B639EF450BBD9C01F98D6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b50cabdc911f72bfef26020b030bb9fc85efd5864f5c2b92eb52fe714f981ea7
MD5 0ec1f2b72f159d0f985b6a67d3124162
SHA1 560543f3e7d85ce8562baa7ae3352c48c22dc9b7
SHA512 d4c08eb332a6592a59b42c5bdbba811602874f7c07736bf6c6f87ba5bba1f29d2d910d6402eb3a5c0d115e02157a74280bf1dd289b55e41af376815f128645b5
SSDEEP 192:uuNosNseQUumHPQmiU16N4zk03HZ/NPLIbIqIjXjqCs:nasNsev7xquk8lEuX3s
TLSH
T181425CB168796C375EE7A145F04637639EF460BB9DC41F98D6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b97389b85f483559b8936edb76301ef416037b0e155b5c5ccb12f6fb3048e0ad
MD5 9edb79a66ae447c3ed65c73d63ffd37c
SHA1 e62540973e3596fb55cddf11386e6aecd3419b17
SHA512 a89e5228692c2c9176537e488eaa8678dca33de7385419dac02b3ce61d1062ee8798e65d3668801c1223b217bf56928ee62132fff0028bf08277e0c007c42b1a
SSDEEP 192:uuNesNseQUumHPQmiU1oNXsk03HZ/NPLIbIqIjXjqCs:nosNsev7x48k8lEuX3s
TLSH
T1EF425CB168796C375EE7A245F1463B639EF450BBD9C41F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 37e391e2ebbe9e3d953965e0c658ce2eb598c701678b56d319488a6624e030a8
MD5 09205845dfcb865f3b4ede9c89feeb9d
SHA1 6ffafb5b3aa414188f02ed9f70febea0d5eea1a1
SHA512 20f771bcbf5e2f1bf40a62fb54cb419173cd8a616f7af52b04e0822f373dde54859111a064cfa684253133ea21cc273ff4a1646de6c6ebf6cdc37b1e472f585d
SSDEEP 192:uuNGsNseQUumH3QmiU1ONC5k03HZ/NPLIbIqIjXjqCs:ncsNsev756uk8lEuX3s
TLSH
T119426CB168796C375EE7A245F0463B639EF450BBD9C41F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 44aa32f49ce3a662e7cf0c91720e2493a818ff41e9a58008611a9a57f8114fef
MD5 d346f21b61dad25ab09ba368aea3e03c
SHA1 0284fc6089abe25e01e074a89b13555305852746
SHA512 836f4c01522684b9d090668d3bb82fa03333a1eeeb47f5a5f3ba84328cb4ba9403d69ca5bd9bdf2f05186c71d6ed4bdca56a9cd7eeaec194178df847bef8bb29
SSDEEP 192:uuNDsNseQUumHIQmiU1CNA1k03HZ/NPLIbIqIjXjqCs:nZsNsev7Iegk8lEuX3s
TLSH
T1F0425DB168796C375EE7A245F1463B639EF450BBD9C41F98D6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 25dc344e7267258c801f5fdb7caabc3e1a8360e09529fac927db3b9fba2503e9
MD5 473a101ba875cc31ef8c8ca90767f98f
SHA1 f2e76d7a074490b99c0191d3099b1446cb99fbcf
SHA512 ed52aee920034c0b02f2d9f014b464e19d2b00a71219336c8cfda5cf87fb3fa59bad43c12527a84f9c0089419abaccc8ad6d002141c69eca3794cfa12df82b52
SSDEEP 96:ZqONkTQsjpfmUTmDK5ih/cIPURHl8h4otop5i5D0BhPwivh50xy0SFYKsAxXeYzX:gON/6kDfQmiUy84Z903HLQib30U6
TLSH
T11802E9356C782CBB8EA39E49F44637275FA5212BEA852F84D9E81A1C05D764C1742827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 669b924e5b0113963b73b28ef530ea60ba535341397a28499d3faf9155952495
MD5 cc7ff8e3aff959a8c1538eb4ef00f0d1
SHA1 3d4a51ff9185df380b0e2bdfbe87357d1032c355
SHA512 359df2ed4638dbde80a027eca6881b45a27d7a73098429a489240c1f8970f5060d3387983237a8662073bda6f90d3651ed2d00c02902ae4d8635b3d73ec59686
SSDEEP 192:zKWsNszQUumHdQmiU1qN1rk03HZ/NPcIbIqIjXjqCs:zJsNszv77upk8ltuX3s
TLSH
T102425CB16878AC375DE7A245F1463B639EB450BBD9C52F98E5EC9B0C01C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6f3021371a366b28ba21b2bd2b1a7cd296b3c90160038f86efce7f972f7c7f1a
MD5 5f6c343053a11e4f8a45a27443104738
SHA1 706ac957d08252e916ca8c59a9cc4c7799f138cc
SHA512 bbffe9b543f95112396bca045a6b7c93275d031d1f4e715a3d495e3d29a05e2c367a1fe8338a60e32ea7b688ea6fef969fc5f9c3b67fa651495f72759b2797cc
SSDEEP 192:zKEsNszQUumH3QmiU1uNFOk03HZ/NPLIbIqIjXjqCs:zTsNszv75eAk8lEuX3s
TLSH
T127425CB16879AC375DE7A245F0463B639EB450BBD9C42F98D6EC9B0C01C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 204358680935421045c22f2b35ec0004882d628954a4d1ffb9a853a7d0dc5c2f
MD5 8e26739420ce9ca90d4c8a9356edfec0
SHA1 3cba88f6f6b955d14eb26aede4ee0eeac8e50510
SHA512 f80cf75ee525ca0b51ac26ee596a7f912251b904154881b68506458471b55ed50594cc942c30214eecf0ab0b24ebb9dd338c37e8be721305583b6919e39e4843
SSDEEP 192:zKmsNszQUumHbQmiU1TN5+k03HZ/NPLIbIqIjXjqCs:zxsNszv7t7Yk8lEuX3s
TLSH
T16D425CB16879AC375DE7A245F1463B639EB450BBD9C42F94D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fe6b24b1065734917e40cae382be776fa105e3b615518574e138f80558933c4f
MD5 70eefcf2555e35e02e075503f42e2887
SHA1 0ba4c737d22240e6b3098f2f36a9195412e3c53e
SHA512 1498921b773dd68af958170e4bc67efc9d79b3980d7dc44e76881e814bf87e1308b4a36f9c003003c072773c09cc3d50d0686765dc990dd024957f0aeabc3cd2
SSDEEP 192:zKmsNszQUumHOQmiU1oNKxk03HZ/NPLIbIqIjXjqCs:zxsNszv7qgWk8lEuX3s
TLSH
T18D425DB16879AC375DE7A245F14637639EB450BBD9C42F94E6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f098b5d44249e9f7ad8fd00935dedf23f31226e6407d352f4257f6d90d9e0087
MD5 6a910e4fc9dedf70189d7f60b8e79f79
SHA1 37f2c578553b22536876de958ace96fcb7e5e548
SHA512 219c559697a092919728d1be67a733552fbc874576971eb11167313b22e237f547fedd8058f59c64c0c50d2208951ab9e2d5c7dd3c46643a6d69f17a9574a2fb
SSDEEP 192:uuKesNszQUumHXQmiU1ZNDUk03HZ/NPLIbIqIjXjqCs:nhsNszv7ZJIk8lEuX3s
TLSH
T13C425DB168796C375DE7A145F1463B639EB450BBD9C42F94E6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 18db22150b7b32ee118895a5a3b89a955a0881ec612429dac7524f1a7cb19cf4
MD5 2bf8931acad6826901995f2256ea6ce2
SHA1 024e3cc756476ead36c14448514893ef049a647a
SHA512 b2205e8c0cb4c098176d8d25e493f8d16857d1d42b1da2f9eb1a22cbdd75bbd3eb0e98e3300d1dd66899ce8b680feefb5ed57e7505dec150958b502efab22d47
SSDEEP 192:uuN23sNseQUumHCQmiU1cNQHk03HZ/NPLIbIqIjXjqCs:nasNsev7eI+k8lEuX3s
TLSH
T10A426DB06878AC375EE7A241F10637639EF450BBC9C41F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 54b63969ecb6093b110942a3d83a0e06b195d01dc88edc1b1c4c18f10f819d0f
MD5 87caa3cde86426433908247a72cf5a65
SHA1 1c2a639e969768d2ae59150aa3e19dee18727a99
SHA512 9f41bb482303f370598c86129c9006c5421bf6cfdd32e9f9e14ef9deb18f09ba57ad99641845da27e6d896bf6464d6a7709e33625cf82838b01fcbdc3e3720e3
SSDEEP 192:uuNDsNseQUumHvQmiU1vNfik03HZ/NPLIbIqIjXjqCs:nZsNsev7Rjqk8lEuX3s
TLSH
T17B425DB168796C375EE7A245F14637639EF450BBD9C41F98D6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 888c6f1b5f355fc464bb90e1f692439be1691554d74b24eed4364f8433550e98
MD5 ca5d7db70929ec719cc2005cc5870957
SHA1 d55955562a6c1b15a365bdfa334a4223615213a1
SHA512 24ba330ecb7568ada89b4b3ce8f5537d2e626201ab97427e07b24e5d0a46941e41d74b681e04b61efe864ec3480581835633a3c5dfae3e252589d3c9fe627c3a
SSDEEP 192:uuNesNseQUumHtQmiU1nN4/k03HZ/NPLIbIqIjXjqCs:nosNsev7L/uk8lEuX3s
TLSH
T1FD426CB168796C375EE7A241F1463B639EF450BBD9C51F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a5008fff6e41850ec0fe6ec669b675dbcbab532257389d40b920d31a80e80c3c
MD5 21d9b3a78568cfc09700dbbba9f58745
SHA1 3bd8083eec0ca00f2a845c233cb782b4c8512d47
SHA512 b12ef09b5a076ac29ca33163d920342487150f7e13a43478249db46de3a1e47dcd98df09f9a0128cb8ba1d20b1d7aa39810fa6e5302cc253a460a78a6000d2f2
SSDEEP 192:uuNGsNseQUumHCQmiU1hNRGk03HZ/NPLIbIqIjXjqCs:ncsNsev7e1ok8lEuX3s
TLSH
T1C5426DB068786C375EE7A245F00637639EF450BBD9C51F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e13faa0b6343a030090b2baf9f45b628c91cbec5c76a3417882f512e39a8dc0e
MD5 4802fbdccf32a5806e68d7b67cb72d51
SHA1 24bd95cd9df31832a2283b3d626e8fe5ddd06f91
SHA512 9be2f814262ef129ccc9d1b06e1faf049da7a08f78d6773286d5f80bfa529cbec7db3e0f3baa2a164b788adde6f7721d8175c701a419222d94f34acd83dd1e94
SSDEEP 192:zK0sNszQUumHbQmiU1eNluk03HZ/NPLIbIqIjXjqCs:zPsNszv7tCok8lEuX3s
TLSH
T1D3425CB16879AC375DE7A245F1463B639EB450BBD9C42F98D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 991cf4b90a973b7579920369cf08785b4505e5178b1fd0f28dd094457c4f807a
MD5 030824c0028d2313292cd8a5a2239bbe
SHA1 42d116fb34dba5c039880a39d3c75a46106a26ca
SHA512 8dd2fb34f9d0abad0d6b2990caccbbf308557933cfafbe62cf97ce4f87c25b724672329ac4f6af7bf75cb4ffebefe390e93f64e44ef079649344d74724e65da6
SSDEEP 192:uuKesNsxQUumHXQmiU16EN9mk03HZ/NPLIbIqIjXjqCs:nhsNsxv7ZMmYk8lEuX3s
TLSH
T1ED425CB168786C375EE7A241F14637639EB450BBD9C12F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d65cbb24edbfdc9e9780849cc330e81e723a48e80e0976e144352859fb90ae4c
MD5 7636dbd06d558786289201ab43f344ba
SHA1 522ec5fc23aaaa61a7c2a4f41942582554a50ec6
SHA512 7be6c0ff75394dd398b6407a685af57170f087d5b57eb6ccfeaef98e517e22b7d2a191bfb4cd72d25801f62f7660e1f65474bff01d211a917af633dd5d6a3f15
SSDEEP 192:uuK6sNsxQUumHxQmiU1hNqhk03HZ/NPLIbIqIjXjqCs:nBsNsxv7vByk8lEuX3s
TLSH
T15C425DB168796C375EE7A245F0463B639EF450BBD9C11F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a293a0917d95d5506ca7527b998dd5a52f9fc1e4a68b46bf195772a5630e009e
MD5 910992b753bb9435b8529521d482f4c8
SHA1 ec1c818f7b888e2baad2bdcf9ef64e61df301532
SHA512 78072708e1b4868c742979a4cefe4de0897b364cc29aa172d9d17ca50ed311ab28f3fac1b3d7843de5fc5d7cf3276cc76432e3d2c77054ee2c03f21738fc4422
SSDEEP 192:uuK5sNsxQUumHnQmiU1JN+Rk03HZ/NPLIbIqIjXjqCs:nCsNsxv7pVSk8lEuX3s
TLSH
T18A426DB168796C375EE7A145F0463B639EF450BBD9C02F98D6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 61d7af70c3785e01cea782194c3d811768f2d4ac90522382c92c65754abf7b81
MD5 f4e0bcf667f80bebacc5c2387c29f268
SHA1 a4835f3a89059c20f476b9b7de05488232a071db
SHA512 8fadf319b4140b9f9c8967f9016bf0afe82bfa123fe93400011cb5d0bdec240ca75e10b33c844d6634140c3537b8190d036f1fe9e1a365e4517baf2d4c1bd8c4
SSDEEP 192:zIONs6kmHMQmiU11NTZk03HZ/N4cIbIqIjXU9:zIONs6Z8tdk8louXU9
TLSH
T1842229B168B8AC779DE3A645F08337639EA4107BDD846F94E9EC5B1C04D33882B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c8b5e0137900d3d370fc7d821af7b451da68244aed531b4ad2d850a98f569228
MD5 53e8855f10c8f13277c26d55e7968935
SHA1 2e59611f602917ac98de02ba75dc496dc3d02252
SHA512 994a904d97464c7fd5c3c6d93ddc3909f44a54ab8c5d94a84b876c94333b1b4be16fe0c82e59562947137962d1659273ead532d106c980dc0cebcc664c464457
SSDEEP 192:uuN23sNseQUumHvQmiU1HNv0k03HZ/NPLIbIqIjXjqCs:nasNsev7RL8k8lEuX3s
TLSH
T103426CB168796C375EE7A241F0463B639EF450BBD9C41F98E6EC9B0C04C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 59eed8df40888c786a414159a5d4c81c532417e3085b69683b5d18ebaea55560
MD5 ffa6f4012dfcf3ea6698bcfa3222bae4
SHA1 293e608a3e4c43cdadd2e3f18456af7d03143f92
SHA512 31114fccf2634eec9c70e0eb550544a7a7bc9638b1112b21741ab4645c7c40e565614395e4dae6901d0337fe43bf9a9d1a10dfd8d18f230de97672ed21423b71
SSDEEP 192:uuKjsNseQUumHiQmiU1uNMXk03HZ/NPLIbIqIjXjqCs:nEsNsev7+W2k8lEuX3s
TLSH
T198426DB168796C375EE7A241F04637639EF450BBD9C42F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7a020af742d16d8ba9f6219dccac0d7710caa5a05c5114600863b86401a76eb2
MD5 7bcc7b9a37038ef76a4b5f9e1dff2a98
SHA1 1d2c1da2d024585b406ae6e15bafb44ff79e3a10
SHA512 565f2a9692f9bd03e57d3673bcff048e5df19e294571481d10832f6c78a0c7f164903cb3e547dc7737f37989f4541b8cf7e7003087fc5e9160f929f1136d88d9
SSDEEP 192:uuKysNsxQUumHxQmiU1SNt6k03HZ/NPLIbIqIjXjqCs:nNsNsxv7vSgk8lEuX3s
TLSH
T18C425DB168796C375EE7A245F0463B639EF450BBD9C11F98E6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 364438293f2e8274fbb2095087e99a34a1076dd2146d3eedd681ceeba9312584
MD5 51fd813a2b5f2b30040dd14f01d484a5
SHA1 abef63a2932e3c224195f16604e22ea876ea6bcb
SHA512 2ba0a364247ca1632e7ff530fde724d8ef195c5bdc6c47ab637b166e9780f0f77a31740ca43f9eb512e7cf85f33f27b5f3222bf36640aeb52b23025903d11ffa
SSDEEP 192:uuKJsNsxQUumH0WQmiU1+N2lk03HZ/NPLIbIqIjXjqCs:n+sNsxv7Uyiik8lEuX3s
TLSH
T1A6426DB168786C375EE7A145F1463B639EF450BBD9C01F98D6EC9B0C05C63982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1d8bae73d91e609553a03d3f0d15e7b710f83db1d77391173bc7ec21fb00c118
MD5 272fd934c14cc63e2d45efab82603ac4
SHA1 77244c0eb69b92015e6e00345e5172d5f8d2234a
SHA512 f0f01a1cc173e580b0d128b12d67cd1ca50d8dc819f6d99274ea70c268b4c1802e6504d06607a999aebdda46fc9baf3a74782f088fbe32896089b4177cd2adeb
SSDEEP 192:zIsNs2QUumHwQmiU1ONoyk03HZ/N4cIbIqIjXjqCe:zIsNs2v7QWpk8louX3e
TLSH
T1F1425CB168796C375EE7A545F5463B639EA850BBDDC02F94E9E89B0C04C73C82B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e9da5e9ef5fe4217aa870c3ce75f3a62f2c872f3562076dcb2c0b8c603b047a6
MD5 8b312b0f295d891402cc20c9edb642df
SHA1 3547adf16df3f6fb0eb71c43fd8cabe0287df720
SHA512 bd6ae1b12e351b96286e0f2cf4ce0bc5f7011a16f5a28a7de501f8bc2b57ace911050d1e9a7933e68d102ff6e9db53edec8bd84295e4f515131abcf61dd38c0a
SSDEEP 192:zIONs6kmHMQmiU1ANt8Uk03HZ/N4cIbIqIjXU9:zIONs6Z8gtHk8louXU9
TLSH
T1D82229B168B8AC779DE3A645F08337639EA4107BDD856F94E9EC5B1C05D33882B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72aa13d92a722e5e5cd9be3f66569de6ee2a1d0ec389618d38c4f2a59a654363
MD5 e34b0035d88d2cc8e17848cdacc1280e
SHA1 975220358340b69b284e110b3ff569ceefa3fca4
SHA512 f954179d9a4919491e3fd9b66e6085c967e9c7b9cda2c109528bbaa20e104073025487e59072b94d1394e57851bc2be7d762bee3980b201e58a2849c8b3ac465
SSDEEP 192:0ONt6kkQmiUya4M903HZ/N4cRbIqIjXU6:0ONt6JiM98lxuXU6
TLSH
T18012297168B8AC679ED3A545F08337679E94207BEEC56F94E5E82B1C04D73882F0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 0a2b8a6189ed5229389dd60ffebbfa46aa0ff9b3b3eba9f546313d15f3db71e7
MD5 551e5257c93e13cc5f5efed9f646655c
SHA1 df3f69368b47eb6569d734caa6e80668d6b3002a
SHA512 1eaa3dee8ffbb5f0713bad6b06dce8c06a48cc5e0ac68bfeaa2e627bc229d3934b645f50dc70c07ce36ccef47ced5a08a10425a46e210bbbe80183ccdfe294ce
SSDEEP 192:zIONs6kmHMQmiU1bNB/k03HZ/N4cIbIqIjXU9:zIONs6Z875k8louXU9
TLSH
T1322219B168B8AC779DE3A645F08337639EA4107BDD856F94E9EC5B1C05D33882B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 534a435b165dd982ab7ca27cfca918dfd7fff11cdf4a82d473e4811bb92e3fb7
MD5 6aed6fe2b05882a2dee26ceba089d71d
SHA1 00f37f0ee2f0be0f77b0776d7c211d47917df533
SHA512 68727c0f8900bbe57c58d9dbccb051877ae022b4b09df69d6223b46cb14e84351d09582be8d0c8848fdf96eedf826c9b7b37d225951e8162b13409ec0c0e8e25
SSDEEP 192:zK0sNszQUumH3QmiU1xNGhk03HZ/NPLIbIqIjXjqCs:zPsNszv759ek8lEuX3s
TLSH
T1CD426CB168796C375DE7A245F14637639EB450BBD9C42F94D6EC9B0C01C73982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57d67c25-4149-48cb-86e5-3867f59df04d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57d67c25-4149-48cb-86e5-3867f59df04d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

03193e63-26c5-43da-aaa8-b4f6f396618c.tmp

Path C:\Users\Admin\AppData\Local\Temp\03193e63-26c5-43da-aaa8-b4f6f396618c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

127af5a8-5d64-410f-aac7-6a6f96666575.tmp

Path C:\Users\Admin\AppData\Local\Temp\127af5a8-5d64-410f-aac7-6a6f96666575.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50082\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c1d13bc-ad3f-45a4-aaa9-21266b66328f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2148_1646177167\7c1d13bc-ad3f-45a4-aaa9-21266b66328f.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xf92m8mp.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fr30au7n\xf92m8mp.exe
Size 5.4MB
SHA256 fa1115eb9670ae43ecba6f995c78ce6ffa7ff101fea1373d082b66d531c5c288
MD5 06aede3c96e3f0951339fc71c2521ba9
SHA1 6ae38674a983f6ebe61b8f4301dddeeb0927565b
SHA512 7b5e2af04b407eff49ad09b826d4f7019dd83b504d4cf192e999572080d1e1df2a54987194f5702691a64c8baae3f1698277d8131b3489a34ed7fe67034569a3
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrA:k7ICteErownP0oTcMsABqlkgczs
TLSH
T1B3463308B3A809D6F6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/7032-1620-0x000002BBE7D00000-0x000002BBE7DAD000-memory.dmp

Download

memory/7032-1619-0x000002BBE78F0000-0x000002BBE7C3D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads