8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1

Analysis

max time kernel
2s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
Size 5.4MB
Sample260802-a684gsbb67
SHA256 8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1
MD5 e71a0e198e0eb52a961502c408a90f25
SHA1 a0da3eeb76a183c33531179b416da54b856ff488
SHA512 f21ef2a150a6499c09722f95aab70fcdafb26b4bc2ce91acc617692bb69bb337f674233e33ad9b1d0bb391d86ca7ae4f6a22443a7b23c3ecb4ae19bc78291a0b
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrN:k7ICteErownP0oTcMsABqlkgczZ
TLSH
T12E463308B3A809D6F6B3D53D81565211D872B4264BB0D2CB43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ty0bij.exe	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ty0bij.exe	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe

Executes dropped EXE 2 IoCs

pid	Process
828	858h21xd.exe
3724	858h21xd.exe

Loads dropped DLL 22 IoCs

pid	Process
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe
3724	858h21xd.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\hiozi32n\\858h21xd.exe"	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4290	ifconfig.me
1368	ifconfig.me
2611	ifconfig.me
2827	ifconfig.me
3766	ifconfig.me
5197	ifconfig.me
5290	ifconfig.me
6794	ifconfig.me
8704	ifconfig.me
1777	ifconfig.me
6113	ifconfig.me
8649	ifconfig.me
8800	ifconfig.me
11257	ifconfig.me
13596	ifconfig.me
14680	ifconfig.me
150	ifconfig.me
895	ifconfig.me
2500	ifconfig.me
5751	ifconfig.me
6177	ifconfig.me
8855	ifconfig.me
9072	ifconfig.me
310	ifconfig.me
4436	ifconfig.me
4876	ifconfig.me
6840	ifconfig.me
9514	ifconfig.me
11338	ifconfig.me
2478	ifconfig.me
5594	ifconfig.me
9450	ifconfig.me
13481	ifconfig.me
1450	ifconfig.me
128	ifconfig.me
1243	ifconfig.me
2612	ifconfig.me
2877	ifconfig.me
10367	ifconfig.me
14455	ifconfig.me
1124	ifconfig.me
222	ifconfig.me
5465	ifconfig.me
10851	ifconfig.me
11538	ifconfig.me
12829	ifconfig.me
2757	ifconfig.me
8378	ifconfig.me
3818	ifconfig.me
6868	ifconfig.me
13417	ifconfig.me
3030	ifconfig.me
4896	ifconfig.me
10833	ifconfig.me
14691	ifconfig.me
490	ifconfig.me
1681	ifconfig.me
7415	ifconfig.me
10536	ifconfig.me
397	ifconfig.me
398	ifconfig.me
1440	ifconfig.me
8851	ifconfig.me
9522	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 19 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4924	cmd.exe
5332	cmd.exe
7696	cmd.exe
8564	cmd.exe
8344	cmd.exe
672	cmd.exe
6952	cmd.exe
6376	cmd.exe
7616	cmd.exe
7648	cmd.exe
8868	cmd.exe
7728	cmd.exe
7624	cmd.exe
5780	cmd.exe
10848	cmd.exe
2456	cmd.exe
5980	cmd.exe
7868	cmd.exe
6836	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4428	msedge.exe
6888	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	msedge.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2672	1864	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	85
PID 2672 wrote to memory of 4924	2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	86
PID 4924 wrote to memory of 1632	4924	cmd.exe	88
PID 2672 wrote to memory of 1964	2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	89
PID 2672 wrote to memory of 1568	2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	90
PID 1964 wrote to memory of 4572	1964	msedge.exe	92
PID 2672 wrote to memory of 4472	2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	93
PID 828 wrote to memory of 3724	828	858h21xd.exe	95
PID 2672 wrote to memory of 3044	2672	8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe	96
PID 3724 wrote to memory of 2456	3724	858h21xd.exe	97
PID 1964 wrote to memory of 4428	1964	msedge.exe	99
PID 1964 wrote to memory of 3096	1964	msedge.exe	100
PID 1964 wrote to memory of 3096	1964	msedge.exe	100
PID 1964 wrote to memory of 3096	1964	msedge.exe	100
PID 1964 wrote to memory of 1412	1964	msedge.exe	101
PID 1964 wrote to memory of 1412	1964	msedge.exe	101

Views/modifies file attributes 1 TTPs 19 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6044	attrib.exe
6756	attrib.exe
5336	attrib.exe
6708	attrib.exe
7932	attrib.exe
7936	attrib.exe
7944	attrib.exe
8796	attrib.exe
1632	attrib.exe
7712	attrib.exe
5124	attrib.exe
6688	attrib.exe
4816	attrib.exe
5820	attrib.exe
9288	attrib.exe
920	attrib.exe
7008	attrib.exe
1980	attrib.exe
8816	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
"C:\Users\Admin\AppData\Local\Temp\8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe
  "C:\Users\Admin\AppData\Local\Temp\8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe"
      4⤵
      Views/modifies file attributes
      PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff91cd9c188,0x7ff91cd9c194,0x7ff91cd9c1a0
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,11855378147764930715,7736961682313112307,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
      4⤵
      System Time Discovery
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4030165806388594887,2674062054042187781,262144 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,8034583223628899666,6155426230772213628,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16579225638617368863,5376738582093595230,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2970566142619651279,8906410392078769953,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1562989310024356363,2549358071423255951,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,5879153050987341552,306827236108753595,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4592,i,2170537660135706402,1641762940944601401,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4876,i,7541526327399736974,6639313860138415226,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4896,i,9354711709708422395,8035167869111735578,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5240,i,5622276055168013659,6082695438514006268,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5294065612166578408,13312164156636099215,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,47100683983321443,10516494880787757518,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6120,i,10089240763783333867,1473686564098207441,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6172,i,16787354581938697018,12480419537295182758,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6412,i,8051865354618886765,3086357601290292279,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5744,i,3718199546247198590,8372186484133037967,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,6411946736438833824,16090769593908968970,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,5248691458841805865,6781517207321322176,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7340,i,17451964007767456604,11026423961630229160,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5848,i,3968893837083998068,2536818831030019509,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7804,i,6548675576068727105,14534870871718738521,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7944,i,7266625655151670310,3876997691605728069,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7412,i,9669142901111673222,9578442609827492122,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8084,i,10326813080702849325,17187454089142332893,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8428,i,11485245357343497603,11148949793121796245,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8392,i,2063306918964080475,16300943479055088188,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:1
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,6930798023284199828,17880292202851704576,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:8
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9108,i,10120801194541977918,5816889200013609156,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9120,i,16294213377094252600,11117441657141525480,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9416,i,3630362214492834837,13966672988708913530,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9296 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9564,i,670130661747640794,3343224038010927794,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9700,i,18010078357049100038,2280215233752068646,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9860,i,12914368915950387163,16107568270603109221,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10104,i,12574322459991211853,17866444148861853936,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9100,i,11820437387376560537,6262651628043849549,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10280 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5896,i,7175079873651445373,10457316241940523691,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10432,i,13697657308714223463,17568548327958383924,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10400 /prefetch:1
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10564,i,15192390158215267619,2315966440919017586,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10572 /prefetch:1
      4⤵
      PID:6368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10708,i,14395302448244163252,3328990044550840260,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10716 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10176,i,11145929135108094124,7612160559167368364,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10840 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3668,i,1768395814097758532,2871943679081104399,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11040 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11044,i,5137979404699678955,16421121672452744749,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10112,i,1349531398948631971,5130894494799938241,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11324 /prefetch:1
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11964,i,49531857440725128,12869864934735917980,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11980 /prefetch:8
      4⤵
      PID:7316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11964,i,49531857440725128,12869864934735917980,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11980 /prefetch:8
      4⤵
      PID:7336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11528,i,10233456529097912495,2373013197015676846,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10776 /prefetch:1
      4⤵
      PID:10736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10272,i,9771340781887586870,11633684087228408319,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:1
      4⤵
      PID:10744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11564,i,1132999165660945923,8972230539140718469,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:1
      4⤵
      PID:10752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11580,i,14697997563443563249,4875237159577965591,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
      4⤵
      PID:10760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11620,i,5113654430150452307,16734837350120051262,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:10768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11652,i,16829465985745687910,11744698911321137257,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
      4⤵
      PID:10776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11696,i,7741245902504814738,10889623759432001780,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
      4⤵
      PID:10784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5728,i,10165613051716317794,12208944074821207225,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
      4⤵
      PID:10792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12056,i,18204680432344648896,2347890283598439072,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10768 /prefetch:1
      4⤵
      PID:10800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12084,i,12156691415279977191,13753187282552058605,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
      4⤵
      PID:10808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12176,i,6280597058469346001,9964057188694179148,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10832 /prefetch:1
      4⤵
      PID:10816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=12280,i,10355260635874394419,871134044623893060,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
      4⤵
      PID:10824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=12376,i,10673378397296550112,5218288310208160697,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10308 /prefetch:1
      4⤵
      PID:10832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12404,i,2463800311704125986,18121200329943987992,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:10840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=12432,i,7679056973359675815,3528495520460030566,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      PID:10848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=12460,i,17952240828817147824,14695614031972551649,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10232 /prefetch:1
      4⤵
      PID:10856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12476,i,7803493930716311388,12527293122081824046,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10152 /prefetch:1
      4⤵
      PID:10864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12536,i,586614241292081505,12069319887531793642,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:1
      4⤵
      PID:10872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=12552,i,3607673365408513551,10381201445002732653,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
      4⤵
      PID:10880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=12584,i,3978217019525384458,319979909798201616,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:1
      4⤵
      PID:10888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=12624,i,20499166718859443,1108216707372089859,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
      4⤵
      PID:10896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12644,i,17364430888350608922,9558012738156001008,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
      4⤵
      PID:10904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12672,i,1478955607646599677,4045005459975753931,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
      4⤵
      PID:10912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=4996,i,16399705560755004163,17979633935043289368,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1
      4⤵
      PID:10920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4964,i,16729926633843959825,7403561545863279417,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:10928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=12720,i,8474049926091965444,6753759884127885694,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
      4⤵
      PID:10936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=12724,i,6908016050565685655,848100571353500771,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
      4⤵
      PID:10944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=12764,i,14231053202582569898,4674475516065164779,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
      4⤵
      PID:10952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4988,i,3538276240890744277,8090877693927156954,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:10960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=12804,i,11139160114657122650,8489813229607755548,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:1
      4⤵
      PID:10968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=12828,i,13946674479466494605,4874489459098895051,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11332 /prefetch:1
      4⤵
      PID:10976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=12864,i,14546026150864505108,4126864349998980545,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:1
      4⤵
      PID:10984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=5972,i,9829010801540756584,4789549681341816488,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
      4⤵
      PID:10992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=6012,i,13985327675598772465,14649921496873797180,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
      4⤵
      PID:11000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=12968,i,16316473274173447034,2526693710170104797,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
      4⤵
      PID:11008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=13000,i,6424749686088018677,5318514143227123270,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:11016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=13044,i,17196427376602695411,13871024544888646493,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
      4⤵
      PID:11024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=13052,i,12305616436485794145,12817886058242318723,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
      4⤵
      PID:11032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=13068,i,15634849551181993832,2809556964202286326,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=13968 /prefetch:1
      4⤵
      PID:11040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=13092,i,9791890011797752518,10407099772318885715,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
      4⤵
      PID:11048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=13276,i,15516801243048323664,769890645208019641,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14000 /prefetch:1
      4⤵
      PID:11056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=13308,i,14348601083074829720,6481049376064056275,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14036 /prefetch:1
      4⤵
      PID:11064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=5764,i,16927200685018656263,11114675558606765491,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14072 /prefetch:1
      4⤵
      PID:11072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=13484,i,7691428254661239366,15117897574255554020,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14108 /prefetch:1
      4⤵
      PID:11080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=13508,i,8929694849617825722,14068603586656230507,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14144 /prefetch:1
      4⤵
      PID:11088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=13532,i,5624525115913404124,5542827283214673540,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14180 /prefetch:1
      4⤵
      PID:11096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=13556,i,16031970884172172915,17201261052086305328,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14216 /prefetch:1
      4⤵
      PID:11104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=13560,i,1496134416208481812,3719715435141373868,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14252 /prefetch:1
      4⤵
      PID:11112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=13584,i,17891801220303775862,10081352333830730266,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14288 /prefetch:1
      4⤵
      PID:11120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13636,i,17277975323728912098,15211377143178319342,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14324 /prefetch:8
      4⤵
      PID:11128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13640,i,1678700091376302073,10771719390668045251,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14316 /prefetch:8
      4⤵
      PID:11136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13644,i,16625461813714901381,13954987623903898442,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14348 /prefetch:8
      4⤵
      PID:11144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=5136,i,10581064784681304519,1730888803699495939,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14360 /prefetch:1
      4⤵
      PID:11152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=5660,i,10023465135691185407,6323624236182446516,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14372 /prefetch:1
      4⤵
      PID:11160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=13724,i,1250358369796913873,7368837349192435998,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14388 /prefetch:1
      4⤵
      PID:11168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=13764,i,1801766147088388872,8592113022645153348,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14400 /prefetch:1
      4⤵
      PID:11176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=13728,i,17490064739873746537,2173318777721482858,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14420 /prefetch:1
      4⤵
      PID:11184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=6528,i,7122825807459524459,7313181760751659228,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14440 /prefetch:1
      4⤵
      PID:11192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=4652,i,6062649657574654510,2368935106425962485,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14460 /prefetch:1
      4⤵
      PID:11200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=13896,i,10126435414041783219,17972054621895194504,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14480 /prefetch:1
      4⤵
      PID:11208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=2152,i,3048372020287308134,14606419802071409599,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14500 /prefetch:1
      4⤵
      PID:11216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=13872,i,3172780419091106378,2932489305785213557,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14520 /prefetch:1
      4⤵
      PID:11224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=13864,i,11907677413711543680,12438652960504149643,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14540 /prefetch:1
      4⤵
      PID:11232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=4660,i,15992155197372230166,12322856087612611169,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14560 /prefetch:1
      4⤵
      PID:11240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=4636,i,9496727848320728832,16601875116657539313,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14580 /prefetch:1
      4⤵
      PID:11248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=7348,i,5092622876954072942,16382971727734433162,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14600 /prefetch:1
      4⤵
      PID:11256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,11167431524219583408,9755949195399632272,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14392 /prefetch:8
      4⤵
      PID:10244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,17802137690966536916,8258773091267997607,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14620 /prefetch:8
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=9884,i,14454357841168425768,7128720528169229406,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14692 /prefetch:1
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=9896,i,3938778970651966820,16682123934450055317,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14696 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=8572,i,10630357945481032745,8398471030803659324,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14708 /prefetch:1
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=7684,i,5037124922869950624,4044466121942876767,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14720 /prefetch:1
      4⤵
      PID:10352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=8564,i,15598485568066143369,3345382770608012613,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14740 /prefetch:1
      4⤵
      PID:10368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=9868,i,6424556574008104398,6052508640330734244,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14760 /prefetch:1
      4⤵
      PID:10376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=9880,i,6576766855645788454,8526889381358820744,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14780 /prefetch:1
      4⤵
      PID:10384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=7428,i,15265937036407765842,11962534612260116066,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14800 /prefetch:1
      4⤵
      PID:10392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=13952,i,15720590204546541627,14607465328073390616,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14840 /prefetch:1
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=7680,i,4748848688691512050,3230879141889847568,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=14820 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,8083433459407325811,1276866750556555145,524288 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
      4⤵
      PID:10528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=6676,i,3491551651901195857,17589462283859634841,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:10524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --metrics-shmem-handle=8360,i,9191489609813481738,11614571384162543831,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=10872 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --metrics-shmem-handle=9060,i,16966972421620210335,539669717630666301,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:1
      4⤵
      PID:10284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --metrics-shmem-handle=9132,i,2940193187608853299,8926448033628351961,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:1
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --metrics-shmem-handle=9200,i,7155282618552049035,10594411749427446766,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --always-read-main-dll --metrics-shmem-handle=9108,i,8137960265166619369,11098167510953331751,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --always-read-main-dll --metrics-shmem-handle=9212,i,4120668881405674103,1368696980323670486,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11032 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --always-read-main-dll --metrics-shmem-handle=9968,i,18409025827285957405,10165893962869088263,2097152 --field-trial-handle=2612,i,16307183998228851730,16459488309851498939,262144 --variations-seed-version --mojo-platform-channel-handle=11040 /prefetch:1
      4⤵
      PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4156

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe"
      4⤵
      Views/modifies file attributes
      PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3728

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe
1⤵
PID:5152
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drpt25of\aje000oq.exe
  2⤵
  PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5332
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe"
      4⤵
      Views/modifies file attributes
      PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3484

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe
1⤵
PID:5260
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7qrz3a4\asvd8s0o.exe
  2⤵
  PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe"
      4⤵
      Views/modifies file attributes
      PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6432

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe
1⤵
PID:6804
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74lmzg1w\bny2m4w4.exe
  2⤵
  PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe"
      4⤵
      Views/modifies file attributes
      PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7132

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe
1⤵
PID:6852
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pvkekcb\6e3hz7t1.exe
  2⤵
  PID:7112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe"
      4⤵
      Views/modifies file attributes
      PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7748

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe
1⤵
PID:7652
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vcimck6w\ybh21ema.exe
  2⤵
  PID:7812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe"
      4⤵
      Views/modifies file attributes
      PID:7932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7368

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe
1⤵
PID:7200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i7b3wx4j\3kao020k.exe
  2⤵
  PID:7496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7624
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe"
      4⤵
      Views/modifies file attributes
      PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe
1⤵
PID:7304
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qf58jle0\6rq4xvk1.exe
  2⤵
  PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7616
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe"
      4⤵
      Views/modifies file attributes
      PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7948

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe
1⤵
PID:7316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90jkosdo\3boif4cr.exe
  2⤵
  PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7696
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe"
      4⤵
      Views/modifies file attributes
      PID:7944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3492

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe
1⤵
PID:8092
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wy5apmyf\91k5ax6c.exe
  2⤵
  PID:7692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe"
      4⤵
      Views/modifies file attributes
      PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe
1⤵
PID:8400
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmuidob3\l3qf9jv3.exe
  2⤵
  PID:8528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe"
      4⤵
      Views/modifies file attributes
      PID:8816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8584

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe
1⤵
PID:9136
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\szx53k6l\f8rom8zv.exe
  2⤵
  PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8344
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe"
      4⤵
      Views/modifies file attributes
      PID:8796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9552

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe
1⤵
PID:8520
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kwe9grgc\y3cpt5q4.exe
  2⤵
  PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe"
      4⤵
      Views/modifies file attributes
      PID:9288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe
1⤵
PID:5276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tva7fmg2\bux8jg8g.exe
  2⤵
  PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe"
      4⤵
      Views/modifies file attributes
      PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x36c,0x308,0x2a4,0x394,0x3f8,0x7ff91cd9c188,0x7ff91cd9c194,0x7ff91cd9c1a0
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,137942899162197875,15963138636523777018,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:3
      4⤵
      System Time Discovery
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6457435756553269098,7966700497288596674,262144 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
      4⤵
      PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,15510674108262913416,13638442980233791884,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3088,i,11373258529677056439,13912533327646087838,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:7596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3092,i,8162904745874482657,15471746523576284397,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,11438100526775748337,8277847316120218480,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
      4⤵
      PID:8948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10077823694639229222,4186468022371360526,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:10272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,5039552508054376704,14470860138607594054,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
      4⤵
      PID:7520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1689471846663343969,7821147053503127334,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5568,i,15613324479282449355,10777797808346618624,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5196,i,15027238718525341772,935358196804116156,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:8104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5056,i,3039582941363700520,17560321329023381912,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:8936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4008,i,18297944547253918094,13379884742842167314,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:9212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5868,i,6522694436015126706,16073223167891732369,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:9396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5076,i,11907016977915243617,9378565066465366375,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6236,i,5460492220816063679,8160163588950787403,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6400,i,8197751256955886805,1381167547675448740,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6396,i,17487320950784154435,935325334760778236,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3144,i,4449501004086115138,15246780856999256610,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
      4⤵
      PID:11028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3196,i,10419396530622858426,11317086026213953228,524288 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:11024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7232,i,10525583536964970837,7073692391961363912,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
      4⤵
      PID:10800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7200,i,13278969182953995983,15807455846352371979,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7504,i,17348050645813196581,12155113989675789792,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
      4⤵
      PID:10968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7644,i,8472035124044342826,1277123601940374699,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7864,i,8000255549906021763,727601874768477451,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
      4⤵
      PID:11260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8060,i,13229684199215179262,9139176713299443116,2097152 --field-trial-handle=2724,i,8098920095489801641,10622143312044090345,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
      4⤵
      PID:10336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe
1⤵
PID:6296
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vn0ywnoo\dyp4vmq4.exe
  2⤵
  PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:672
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe"
      4⤵
      Views/modifies file attributes
      PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5216

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe
1⤵
PID:7284
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fos5sgym\acrd1p8l.exe
  2⤵
  PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6836
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe"
      4⤵
      Views/modifies file attributes
      PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6884

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe
1⤵
PID:7500
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iozqe0zu\mjjey9c3.exe
  2⤵
  PID:8292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe"
      4⤵
      Views/modifies file attributes
      PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9956

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe
1⤵
PID:3328
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wifqzhc\gggfcjal.exe
  2⤵
  PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe"
      4⤵
      Views/modifies file attributes
      PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe
1⤵
PID:10392
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uavx6wx5\wd8ylty4.exe
  2⤵
  PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2289422f33076f893a5cbe259128b033aa278a60214e9b5b1408f71d97ab8ba2
MD5 f61a19c88d8e2b5ca8fe9ab71c2d2b25
SHA1 89b9addb6061b5bd72f7470300bafc3608afcc72
SHA512 9cffe2a6462cf7a9ef27b7525014548a4a144feafeeeb31b48ec128e4902578719582285f989663e1787fa4457f5c91bec7df3a715cd6c58435d94b0dc1d5011
TLSH
T126D0C0B2B3C1C300C4062135641003813B23013420CFC22300F9400CEC7400483DE18B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3e4d29f389f22b7aba831d792a18a6d329c3024e5845133d62f1b75d1401c5d2
MD5 b4f7a5194e8c8ce6d8a661aabd23d199
SHA1 1a54e2903379ab8a3255ce870f231f38990287b1
SHA512 4da660ef286efd9fa8727fb0d13c99e4075c27d6029d602dcca506e95839f86b206c5950dab64b8fac9fd5f13f2e35a22c2d8a9cc2f3aa9a5add500b5adcde42
TLSH
T181D0C0B2B7C1C300C4062135A82003813B23013820CFC22300FD400CDC7400483DE18B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 281KB
SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
MD5 1ab137d449ccfecdcd483a00d1b69e2a
SHA1 2c48acc7780d67fe3022e7576b1a17361065e4b5
SHA512 2f4fb03db68c50c32728382c0d42b95f420e4c4d9432c75bc5da4306d8b5dc4534974403348ba777201c08ae942987aa943df12139b5aaf613efab9d931417ac
SSDEEP 6144:egMTfogGx/cMMx2HO8W7xQPXMW3np2Bt9b/MY8Ss9/:eLcgGx/ctLH7xKX1npavbUYw
TLSH
T1175423305FEC8263FA0F82DF4366F8A5160FB5C96CBD77389291E768D9069580FB5042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 48KB
SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
MD5 7fe007c57ea8a8682c097519166c4943
SHA1 7de32a85a9c2e094c62d5c393a44e9d4b0ee0b28
SHA512 298499a176722aee739bc846b96209ff4f618c7ce305acdb1f930d4e6be5961b411bed13363d1d766ccc5c470facaaee9bfcba11b1c04cf4e2de9b952df32d0c
SSDEEP 1536:KkUOL7TTaDZ3v+Whww93ZrTHjLgOoXRk/a:ZUGuFvnhww93Zr8hBkS
TLSH
T1962302E24F47584EA81B6BEBDC91564F3CCD00A519F06EAD143F81941AD6E858C88BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 90KB
SHA256 b48363bf074f8091eaf45b3e2537fcd7234e337968ed1eee25a24c4baba60911
MD5 8ac195ba169d961ba21212bc05bfcae7
SHA1 551dcb86b5d682b00c1ad2292b92c6e203f9913a
SHA512 f392f38edd67b36ed03710ecc2bc1a41c9ead7d0254d5b5b11f191eb7cfe35956c3284378a8159850ccc2a841afb58ed990eac3312accfda51a900cc6ed81b6b
SSDEEP 1536:jOc80HUHZxmCk5REHO2kDt25RNr7aydZ5h5xdrOIWizVjt91CcLGeNhc9/mBI:jO100HGCk4u3c5bhwIWiFNCcLR6D
TLSH
T10793024D81A248FD19ABD77563E7F17A0E578E49382A13188EA512033D24CB5AFB337D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 105KB
SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
MD5 68b11256fdb00ea264efc414a3081289
SHA1 edaccbe8eb8e0326944b82d03d00be43460e2d7e
SHA512 f8db4fdd6d8315e3151790263a353bf89666dc675e13ef6cf3b084e05f6c03b596c8707fadfa43c42d7201fb86680e4574f0a0915518a5d5911c0d1a0bb0f9dd
SSDEEP 3072:ym0RR8FYstRkmRYjNUUetU+0Q+FgPv474lJstNMWL:SRR8Fz+UUSmQ+F6wVNMY
TLSH
T1D7B312969BE7F3DCC165A8F78949F361D01C6EC81016EB6691426337CFA9001078AFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 149KB
SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
MD5 dc396e633ee01774f0f0b2f1071a566d
SHA1 46e628c30392dcac3b041b5bdfb5df890231d143
SHA512 5bb2742d2d0339e1958cf57c7f8f176a1eb7160436fba9ab43d8f9466a7b0f4a40c7720b03878802474778a5cd1712e68508c5cdf73820cf674341d1e99c1a98
SSDEEP 3072:cbzKhLEOClRbBX7XiCNVHkz9JHXslX76tejVBedwYEdidbKjcDO7MA:c36lShBrXLkz95slL6qvYEdu+jJMA
TLSH
T16BE312182A23CED690EF543E9CF37CA7762F6D902F50599909B3388C524CDE19B5B398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 21KB
SHA256 a8d4cef7e4495cefca79668bdf0169ec8b19abb437b2bb76e68ace84b0a1c10b
MD5 c5c01009251e0503fabdcdcc9664df93
SHA1 6547b070cb480be57ed8c6c59a303b990b4102bb
SHA512 efd799307bd7f4a990892dc30a3a3ccf42ad6d20e48138290f759a926e5c91f29a252a9b3841e323e82c9984c0b2f5df4abd542ae58c377fbcf6036346e4e755
SSDEEP 384:HIbUbl0dWc7hcmlhsOnlWIPrZ2+LWFvXLwNdTqx06vgFmUaWDzXFejtOb:HIb9Z7pz7lzPrZ2hwNULvglDZe5Ob
TLSH
T133A2E1E3C9294B59FB8FA938B16E19CE6E665348E053C23C80872E81761DFF15D0B46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 92KB
SHA256 06eb39208883d683d1bdced76746506c53f9eb004a26b546c833de9597c68f5e
MD5 71f8141525673794be71853eb305f43a
SHA1 3950a35fef794d40d4cc58948c6eebe7727aef6a
SHA512 fdab2e4fa496ace5b8861c5431e4de89d0b91202e626343d8fa07ecf8e66380cae0cb1b9fac94bc7208ab1a5d819683638069791b364684c7280645656f410cc
SSDEEP 1536:ZrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdyk3:3+dCdU1UKok0HaFA9wRw0YuoqsmGeqOe
TLSH
T1F69312BE8E3D675A000DF32C46DCA14F80AD4AC5D901E3DA07ECAADB4172C195E384D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 76KB
SHA256 bbdb4de36778b9dfaf0d76f72ff5eee62586cd6f885d5f60b21436c64f9897d6
MD5 27133cd77bad23037dd37ea625f629be
SHA1 7d684f9aae9346022129138bad558be1ae13c93a
SHA512 3b42a4bc7f4bfc67133b6771b0bf30bbba215124e508b728ca9f42050887bdb7f98dd8c55c82193ff50ce5847a9e4ccecbbf3d77c50fef5aae177ae0f22a5e6a
SSDEEP 1536:zK5VCBgVlaRCfvydYadgqwEcJweg7MixcejkC+mQBYaNlrW:8hVO35dOEcJaMiFjkCEHrW
TLSH
T1B77301BB417F83CB014E9A5D1F46D099034539BAE6E961F120927AE437EC3B902635FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

328a511c44506ac7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\328a511c44506ac7_0
Size 591KB
SHA256 4026c01fa787b95b8a32ebc566e42f156e76c3083ee06102ea1456625a29aa62
MD5 9e28e78457c2c5541d5f7a5e788f6cb3
SHA1 7658f35e99d1d0d8ad871391be40545813c0f687
SHA512 c6348932203b3e58b49f18bff1618c231009b9a053e40771e0b72ad64e168fc4e7b83cb19d66c4cbc6eac179cbe7085e100354a4a6e1c3a2f57c66789b572199
SSDEEP 6144:WxpbEq23dxUA7xJQ2valVZoVroYdK3MJfJoamWBKHwZEA/52blfk:PqMyeHz+ZoVE4fJofWBKHw5/5glfk
TLSH
T1BBD4F6080790EA59CF7623F501A38953A73581482EC7E727A1E5B7363D493E25E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d298bfd6b2d7e16_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d298bfd6b2d7e16_0
Size 545B
SHA256 0b4acacd60c3e6dffe740ce84c226d99d28d64ef02e4297c4767960405d3c2ff
MD5 ad0d021dd1fe382ed4907ca86ed1d4e5
SHA1 130b243d1bd7adf3e65c94387d2a9d5832b52ebc
SHA512 00153c7d61afdd5ff6216e94c3e8d88b45814b391434abf0174dee833366ccaf5a1be6e405d659064a0ca61b736bd57e74f4d6e65a3fa703d8ae1950a885dc41
TLSH
T186F0E1438148F802E6210AB849A6D3035392C0A408BC85E2801830D33547C35385CBF4
MD5 SHA1 SHA512 TLSH

Submit Download

3d6cca4c2df8e53e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d6cca4c2df8e53e_0
Size 284KB
SHA256 898e178895baffb05a840facdd312894af244bb81ae6cb6098798ace1042376a
MD5 b0cb8517c0edc23ca6628a741b094946
SHA1 fc2795573daa58737095487acf74f5c71744727f
SHA512 5a73fa01eb58d2c26d69e716bf2eb5f4b2ed5b2cd1ef7d8de6cf5777589a2dbd27ded82d57d4777efb24ad345165bbd50d1c53d9400a9af7e6fe8764291700bb
SSDEEP 3072:+efpak+k0CdgMn3bib7AAR328rVrY5myD+3g82NH05zyf6E5fs:+eRak4/Zk8rRY5myD+Q8sazyf75fs
TLSH
T1CB54D6651790EE25CF7A23F542A2C953A73150483FD7971771E4A33A3C1A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a6ce2bfc8f7f376_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4a6ce2bfc8f7f376_0
Size 472KB
SHA256 8d51a21f32e04c41f4faa1edc371ec329275e24a3fb7c798ace1090d91d87f67
MD5 f2f8ec7438b07a3948fd7a6308a05a79
SHA1 4c45226cbf99d3315b5efb25f102310429b2700e
SHA512 b490aa7b0d24fbed544f2b98eec31d1ca12458b99d82ff24e3cce1facaa2a0df571c448863d1a532fcac363b6bc7acd9a5ffdc174f3a994860a1a1d0e3304d84
SSDEEP 6144:EG3x2zJcj4zhuUM4FFbnLMlerr6858WSFXMZQkkZDmyAHZ+f7D6:EG6OjcEUtFN0erCcZ/kZDg0f7D6
TLSH
T11BA4C5491790EA55CF7623F442A2C953A73144497EC7E723B1E8F73A3C4A2E15E4A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 47636e41ccf4602a7704b63508c6b5a9593fefb96f38df119646ad20d5c26b81
MD5 1cca0abbb327f1a7e64416314bd523df
SHA1 d6712ce5b9c04d0c4902da566498f60a98041dba
SHA512 04ea9d553c2d7214ef8e3176254860105f1423e488d9b0986af0c41441f4bfa25b54cc18ea4cfb38191529cc827217440ba9bc72c5d52271138c9c6486bb6095
TLSH
T19ED0952F444DA421DB595EF0FFAB6217C135C8564CBD80D18460717351047B8F40DD15
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 ddf7c449bd636768332aaa7c8538efcb2104f8d5d867b27a6347514645946807
MD5 80f44a8e626c4d88c699c72ce5bf3267
SHA1 f84861058c60510e861af7fb9425ebeb83048991
SHA512 a8aaa90bf8d0ea093b9d8b45b1d3e9b8a9375e2799df972b5c350925581726f99901f9f68fc29f1b08edd0b4b4331a333b35fecc30a9add7e55043aef9f3d837
TLSH
T1C9D0957F045CF425CC384EF0D567B405C5EFE44C0D1DC1D4D10410D36D89BB6689D550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b56ed73-eb53-474b-b6bb-19836e529bc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b56ed73-eb53-474b-b6bb-19836e529bc6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 92fa7994f57badcf2adee8cdf20c54b394134c596f972db65a0168db70fe8e2f
MD5 9f0defc1f230541a56c353def871faa0
SHA1 274744bd48612bd8773663082ef4b1bec009f69f
SHA512 949458d38db85536e5e0d3914c0b7df3017fdf0160508c23af7cdfe35c2c79caa65a81888c892bcc5f44ad61911eb536d2cf3a819f8a4e738481b05a1b22f6ae
SSDEEP 96:D5OhcYMwSkjz4tgiQBtahVKbjbwBzB9BjgQl:D8hNMwSkjctgiQbahwbjbk17jgQl
TLSH
T13891CBF6C7E5962DCC2152F0EB156E2FCE2D091553283C2AC9D5EF5BA7E2870E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e638d011be8a707162d5de7d3ea7c01596f2f48f63fc452b0a934e30372c2dba
MD5 6c4a86895f0b6a0628154ae2128d10e1
SHA1 9cbe8d83ac377a513cbd23af214bb85e8fc056f8
SHA512 773835e4511c8dae474cf204d9be05aa013c0a399469a3f7caa48149547c5c467a0b76773bda60963a787e7b7a822c0e174a4ee15ef5848d87f53de66d766713
SSDEEP 96:D5OhcYMwSkjz4tUhVqwBzB9BRHQ2b1VRstoQl:D8hNMwSkjctUh0k17RHQ2b1VRqoQl
TLSH
T11891CDF6C7E5962DCC2152F0EB152E2BCE2D091943183C2AC9D5EF5BA7E2470E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5a3609385a75832462048f5e8b1149acc69c11c51268beed66f127f410b1f2f
MD5 9432e451a9d363a937e2c7183969a40e
SHA1 1d69f9e9fa7a0e8dfe02279e4f9efe88ef3d9d89
SHA512 19b1ca7de1a68a0d915762124ced2d4bea6815c584d15954339ca1aa120fcf767434b97415cd0221987e2876f7e175ee793f4dea77840663ccfb433e27320c0f
SSDEEP 192:sxZzRNyM/jK1Ml8MjF/fUsXYFEdpLlqN02FG/W6+WNiN1lKxd+lZYBNZeRIgyJ:sxZzj7F/fUsXYucabkqKZVO
TLSH
T16352FA52AA346A778DEBD219F950BF63D2F50462D2900E54AAFCDD1C04F6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f736de175354666345fea49312b89fc6368450e154dfb746f422c78bf656512f
MD5 8d4b9ff801df18790f435c3f82df64e4
SHA1 c46fbe198855b9192da3fd752bfdf5f0c67b82f3
SHA512 18e979047be6df1d3415376feb719082f41e63c6dbe6438d95adbcb8cf5b65e532062dbfaf572a4f74f4e5d992773281075ad39a44972634771caf2780cdf18d
SSDEEP 192:sxZzRNyM/jK1hl8MjF/fUsv4l/zkdpx8E90hFG/W6+WNNXme6ozB+rBbG4hYB+kG:sxZzc7F/fUsAlIQab5Ar84hXR
TLSH
T1DB62E756A6346A77CDEBD218F910BB63D2F5146392900E54AAFC9E1C04E6BFD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 95a1b1762b881a6d370932196677569a2fff05b8bf0e9d1038d8b7f349228824
MD5 4c0536648306b4589290160bca30aef3
SHA1 c82c10f31bebc6a9dd332538e5688935ed402d9b
SHA512 8d8c744c32be5d049628e47f1b26847ad7be7ea11e9c8952b3253bc7322013b76f249729ceec00d50d66cd2d61bf2cdc98c6c237807cf57453ffb9b5fe3ed376
SSDEEP 768:sy8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFALl6opdfroak3Un1:sy8iJANWvx76ru1jayALocdMhU1
TLSH
T19CE2FA3B680CCB7E4F844E9CEC2A6F966ED801CB5B944D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 de469c9f5c7be12f699de26213d2473df3b7de4f985e8dda78672f7887c8678d
MD5 5ae1c88c3feb7c3aeec44acbe15a8f16
SHA1 166f54720fa3a305a376ea4e66f66e6640c85581
SHA512 78ab0325b39a585e5d359d51642c25afd7cc7456e2a1fcb813aafda6d719f624985435563369ea32a057951909e05f5d6246bd0c769467ce269cbdd3caf9ee88
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGC7KKkEGq38DH5d/:DvmbPVddItkfvvLFRU3v8B/fpYhv
TLSH
T1C691711131BF42822C3F6A0CD195AB1B769171633014A92F77AE01B14EA7E251DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94eb9e28-2367-438c-a357-e5e337d50b6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\94eb9e28-2367-438c-a357-e5e337d50b6b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1f5f4e43d47b3fa45d597b0c4e33c5f8ff5f10022bcb737f6776e6ff877113b9
MD5 4ebbb428a43ea7f2444409e0014da2ad
SHA1 99bad468bcad90f93f545d8e13578eda8c555562
SHA512 932d611bdb130d1f1c75e09d928e216df1000dc9829e645230f08689bed2072e159fd1f3b3204c03059bf4071899e9b80615bf205fd04c49c3eaaa7e3efda4ce
SSDEEP 192:zP/sN+nQjrHSmWXQmiU1HrHHk03M6NkOLImqp29kU:zHsN+nIraNnkBgkDc9kU
TLSH
T1B6423A306879AC279EE7A106F18737239EB410BBD9C46FA4E5D89F0C04C739C270B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bebfd1eedfb4a9cb9f3f1faef58de4cb811e1ed12b99df050ef8425f8bc2f589
MD5 7c0bb95ac2dc8f8c61a0901edf977be5
SHA1 e289796c629054317b8dd0fb49a2a28de336c0d3
SHA512 95d9380437fb28eb54b1864c6360e5d57fdd1323e618ea004eec52bac48efc59e5e04c586176e7d4f86b3987154a61d538e195dc20c6832ca632888b189f32b1
SSDEEP 192:uuPMsN+CQjrHSmWyQmiU1krSuk03M6NkOLImqp29kU:nksN+CIrZW9kBgkDc9kU
TLSH
T158424A7168786C669EE7A105F58737239EB410BBD9C46FA8E5DC9F0C04C73AC270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d67e56a437a15646e4a1c2b18f6269180bf1831896bfa529773437c27c7f9218
MD5 7fbbd2b705aa55655a65e805972105a6
SHA1 0501864f60f4fa135b95e309e8c52733e7897fb7
SHA512 9fe553fcee26c9ff2ad81d092d25d5ca55466c010cb9b887ae75348c7a7bb734204066fad3a98e072447df67845253996e58c06cb38890bae2ab6c4d8ac2cbc4
SSDEEP 96:tqONkJpQsjpfmUTqK5ih/cIPURHl8h4otop55nDSB7Pwivh50xy0SFYK+AxADERm:EONf6kDQmiUydyr903M6Nk8cRmqp2U6
TLSH
T1B0122A3168BC6C2B5EE3A505F0C737275EA5217BEEC56F94E5D81A0C04D735C2B0B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 02e06f85169be9561a09e055b559ec738dfdbbc2f2536f7b3aec092e82ab1f15
MD5 70cb70ae5b13fd4ff408528f3d5fb633
SHA1 64216712446c1c49fe045da06031efad4d76c773
SHA512 7e25173df45a735f63adc23788bf43a58bd103cafc65a332a3e0b583397d60b993b767377ab2743a32c4feb41483f257e510111b3397a689bdae70c99fafadea
SSDEEP 192:zP3sN+nQjrHSmWKQmiU11ri1k03M6NkHcImqp29kU:zfsN+nIr9rUkBgkVc9kU
TLSH
T1574229306879AC269DE7A506F58737239EB4507BD9C46FA4E9D85F0C04C739C270B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 87726afab43a0f3cc3d4bc20d0b2964a228b5bb23fa4cfa4cf35e2241ef0cd0a
MD5 d7053f21020d43eb431ed54a6ad73a9d
SHA1 823ccfa66a8276013e546c2df093bc5fa9ae7efc
SHA512 7da78c8ef0082d0609e613d7aac9aae61b5a4a32969d14ae88ac24ec8ad343860c0a149de3b2645c449126f6e2f10b08ea35a4d5fb666984c0551eee093842e1
SSDEEP 192:zP3sN+nQjrHSmWAQmiU1crDgk03M6NkHcImqp29kU:zfsN+nIrzOskBgkVc9kU
TLSH
T1FB4229316878AC279DE7A506F58B37239EB450BBD9C46FA4E9D85F0C04C739C270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fdffbd6e51b57be8fb25e43a833b0a6e6b04ce832842c6af5fe1e2c286a1782d
MD5 96543ad1c9145daf6fd3de1e7cd0ec1a
SHA1 441a9a96588be2697c08e70640ec2b5d175c6579
SHA512 d512d879aa2e00b0dcccbf85ab794fd7ee5e7fb3d60c1769b3a992d54db845ce1969e20317aa011a019ec045a6f42a4c4222134a4f3f13d07d2c385985fe5d75
SSDEEP 192:zP1sN+nQjrHSmW8QmiU1Iro1k03M6NkHcImqp29kU:zNsN+nIrtKQkBgkVc9kU
TLSH
T1BC4229306878AC279DE7A506F58B37239EB450BBD9C46FA4E9D85F0C04C739C270B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 84bfe394ed756a493847783722536e72c3b955456f60ee0e40fd91ab3b61359a
MD5 329768f5427fd21224d93e2a2d7b921f
SHA1 a7caaf06eafdbc1ab6398f211a685493cfa9b920
SHA512 cc412e1efd1849dc032543cc4b952f900772e846afecf9e4486a5e0030008a85847551645854659dd6ab3e8daae8d701ebc3c662487476a032b8b795ba23a8a7
SSDEEP 192:zP/sN+nQjrHSmWAQmiU1arWak03M6NkOLImqp29kU:zHsN+nIrv4ZkBgkDc9kU
TLSH
T1724239316879AC279DE7A106F58737239EB410BBD9C46FA4E9D89F0C04C739C270B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e2c07834c051d762c4cbed265a6731e66aefe8bea38426365d805e1d59fea79b
MD5 e55406cdf2d24d2e319f2568a77bb3a1
SHA1 c781ff5864382743fea5ccd2141356362e15e425
SHA512 0d3f2f0f6ba68de0b789c3a677c126225b248fcaf7f516a8dc1d413429a5231d58c555f4f6906e699cf14e45496b5f04aed7e0721eb2d8f659630d7d87f12882
SSDEEP 192:zPzsN+nQjrHSmWbQmiU13rfbk03M6NkOLImqp29kU:zLsN+nIr+JDkBgkDc9kU
TLSH
T182424A706C79AC269DE7A106F58737239EB450BBD9C46FA4E9D85F0C04C739C2B0B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 906a7fbacb5e66d30464f87f9cf4f0fce4c008513fed51987377a6c5471c56c5
MD5 87d75d42babbc30e7db12a285c3b6d88
SHA1 f21e8b4b501f8501d14f07b27de1d407e9a662b0
SHA512 147bd52cd37174d3f1577390c363618c86b69657b94a0874d1a9a11903519acf56215b0e9f7ca6702ed785220335c2eef59bb9c4afb6e82528bb52ccefeb9efc
SSDEEP 192:zPSsN+nQjrHSmW+QmiU1+r8kk03M6NkOLImqp29kU:zasN+nIr5cFkBgkDc9kU
TLSH
T191423A706879AC669DE7A106F18737239EB450BBD9C46FA4E5D85F0C04C739C270B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 69e410b86bb33ad29389055857cb0bb7e6b46f7552ab4f8c1095428815ff2988
MD5 8fc7fe96205e8e753912018749b00897
SHA1 832c5fe5f63eeb549d7b0c352b3b05b96c8aa03c
SHA512 80d3f861d123b0c02cc85db92ae7b4da20bdef8e4392e5c0f0cdec772279b8a243baec048afffad99182791dff41e3fd7d9597cfbd67faf65167a5370167c326
SSDEEP 192:uuPssN+CQjrHSmWHQmiU13r+uk03M6NkOLImqp29kU:nUsN+CIr+N5kBgkDc9kU
TLSH
T152423A7168786C665EE7A101F18737239FB410BBDAC46FA8E5D89F0C04C73AC270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 78174dc9605d0d0b6973c858e3b42884483cff4ee9d82d521804678a5e2f7548
MD5 5be90f25ca027b780a09fe28b0f2aaa8
SHA1 a089eae05dce0bf1e4e5da4255f71f611cbb7acd
SHA512 e0b7367cfa18f0afb12bf519b0534d8c7331d21ddd3448f6ef647370f578b17448c3104b3cfb58a8546f43eac1ec4744243a852335907a59876421758dc5389a
SSDEEP 192:uuPbsN+CQjrHSmWkQmiU1jra6k03M6NkOLImqp29kU:nDsN+CIr7pJkBgkDc9kU
TLSH
T1B7423A71687C6C669EE7A105F58737239EB410BBDAC46FA8E5D89F0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 70008928400e59992f03dfbda0cbf22fc0a888650669d2e04ef78b47699d5642
MD5 f50d5578d41cd095909fbb39d0831728
SHA1 a6805bdcf2c7c6c2accf68abe010e620ee84895a
SHA512 9d5b258c19ed5134b18c63c22cb2230fbfa93df8233ba77b322d4ae34d526f2cd7fc0213f7f289f4ae0dfaa419a06e664469b025ee2fcd225a94821e0e047934
SSDEEP 192:uuPRsN+CQjrHSmWGQmiU1hrestk03M6NkOLImqp29kU:npsN+CIrxPeMkBgkDc9kU
TLSH
T1DC423A7168786C665EE7A101F58737239EB410BBDAC46FA8E5D89F0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8a34f5cc650aa28b566ef5a447cad288a9e9e7592647c007c011fa0ebd9baad7
MD5 903a9455027fed5d0d0514aaf8143957
SHA1 7a06464cb17bd37c0d04c20b03ada8570365ff34
SHA512 55306e1457a34f42f101929abd844ee0865937398cffc2e523cc5f3570063839e636a9ce29d1c668d5565195f821c4d4420016b993e1e849861dc702ac51a4ae
SSDEEP 192:uuPusN+CQjrHSmWGQmiU1br7nk03M6NkOLImqp29kU:nWsN+CIrx9DkBgkDc9kU
TLSH
T133423A7168786C665EE7A101F58737239EB410BBDAC46FA8E5D89F0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ebee858e51e3801c5f4ef654fcc354c563a640ef4aa0dce8a6af41244d346c20
MD5 125cb260f92ea5ab7f863adb3aba5b22
SHA1 a89a98fe3079b1c6ee8d464a95216d8c7af3a35e
SHA512 035301ddfe01dab9c859caaebc7f8bc199543ac09bf72d2ce3daad55c2b3f32c9d08553694574392142bb9966d5aeaa45ee24fa4a441cea2f836678fce90aeef
SSDEEP 192:uuPmsN+CQjrHSmWWQmiU1Hr26k03M6NkOLImqp29kU:nusN+CIrjx9kBgkDc9kU
TLSH
T125423A3168786C669EE7A101F58737239EB410BBD9C46FA8E6D89F0C04C639C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6a200d528cc181dce265c649a1e62a37e8bda12b2217b1417068508e1e0559c9
MD5 db87aecc9f814663c83f70c76c238bac
SHA1 d17e35a2d81a9c222b3ca5c787c9dfb4011f647d
SHA512 b1e32afaf2131dc6714bc702b5120ac2af363da4eb1e26c622895fdc236a7ced90ecd4723e6a8031f637ffbdef53dc0d28903b9f290ec2498d735d92e1561cbc
SSDEEP 192:uuPhsN+CQjrHSmWWQmiU1Urhhk03M6NkOLImqp29kU:n5sN+CIrjijkBgkDc9kU
TLSH
T163423A31687C6C665EE7A501F58737239EB410BBD9C46FA8E5D89F0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 13031445b3b351d1e800cd1fb6816e833cd441fcf3b746c23d5c54d353685558
MD5 f8702b6efb4d638816e7efdfa6ed9756
SHA1 405aa49b5757402e46b5c1a0c6368b89db2f3024
SHA512 0539765fe0d46e6987a24294dbfff4dd7ab961a9c3366c379945fa09f70de304113cbf9772003fb89408b738ff84c8739697039ed05c4b76c9f73eaccc0ae3eb
SSDEEP 192:uuPMsN+CQjrHSmWAQmiU1przLk03M6NkOLImqp29kU:nksN+CIrTrXkBgkDc9kU
TLSH
T1DB424A3168786C665EE7A101F18737239EB410BBD9C46FA8E5DC9F0C04C639C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 34cb266288e18829ad399013c4d5ff5d156a391c83ec044f6ab830d14c920a69
MD5 9f8a05ffef142057159794d79d8aa5ff
SHA1 9937c9adb099311d4450add408c39f0008ed0da2
SHA512 4bd577c72cf02777017dda4281907d4457b5d29c19afd7e28c76be9b5584667db041ba0e94f497dbe8030ce09d956ee43c2acbc52ae4e8edeb160edf6b0173a6
SSDEEP 192:uuP8sN+CQjrHSmWnQmiU1FrsIk03M6NkOLImqp29kU:n0sN+CIrinVkBgkDc9kU
TLSH
T15B423A7168786C665EE7A101F58737239EB410BBD9C46FA8E5DC9B0C04C73AC270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 738b482a2e5231f995e05f2e3f76ed7ae3352804f4eff96b65aa1370dd65e52c
MD5 3a5eac3f90c142d362a3704a725d278a
SHA1 a2015bc5d3334cc9ee8f755af851b71c9f62c7d5
SHA512 3e070c4bfe7b601e5589471b61dda9ce8d88967b931417c2570a17900b52711f8134e50ac14074fc11b989d9317428329a6b0d83d31bbcd1f1f52fda6e0a9162
SSDEEP 192:uuP8sN+3QjrHSmW5QmiU1irb7k03M6NkOLImqp29kU:n0sN+3IrEAXkBgkDc9kU
TLSH
T11352397168796C679EE7A101F58737239EB410BBDAC46FA8E5D89B0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d95a9e2f946cb5116a417b7889afaf55bae8eedcd2331348fa3decb5b8b5d59f
MD5 5d11e2b85c5bd833ac5597921884b786
SHA1 9b2376a2943da73fbc40cd50d3cb8e909f8938b7
SHA512 b112fd1bd96b15387bb2104c1d01d49c79adaee0aeadc46be19e2e50fbca8ea271bd5616a8e468a0b5f9bf45fd940a4e07508d62fb5542c49ae8b83541e2bd58
SSDEEP 192:uuTasN+3QjrHSmWeQmiU1srpRk03M6NkOLImqp29kU:n2sN+3IrluHkBgkDc9kU
TLSH
T105524A7068786C279EE7A101F58737239EB450BBD9C46FA4E5DC9F0C04C639C270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bf042bb71a43cfe6ae19fc44de9e1fab561ee88a6f5e2a4c4a867596518a028f
MD5 6da1d9b0cea34a38fa1fdd0ea6fd79b3
SHA1 5a3ae3377e12c02e3433a6fe156794f924c6acbd
SHA512 7336722ff55a4f49a79dc76651dcfb143a6b5b2eada307e0e4ff9f571c62cc9e7e5f9d0ada8175e0bc6ca9ccbbbb2ca2d6cbec1fd28c66b6494f886b43bb6ff1
SSDEEP 192:uuTaAsN+3QjrHSmWeQmiU1nrPXk03M6NkOLImqp29kU:n7sN+3Irl5PkBgkDc9kU
TLSH
T184524A7068786C669EE7A101F18737239EB410BBD9C46FA4E5DC9F1C04C739C270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 aa84b20cbaf9b904ef69b69ad966db81d26ce31166cdeab88a7172c9987a6d1b
MD5 1215c9d9e3d21669ad4193fe7d5031ca
SHA1 b636cef80847ec39c5fbbacb538272250f05bbf8
SHA512 b808f64f7dd6b937f71bb39997b647dae1da870e342dc78db36b2ec5bfbf7768aa9956a03ca4818d6748599e782a96146542ecedcccfe3ae8bccd1bd6e4e0afb
SSDEEP 192:uuTfsN+3QjrHSmWqQmiU19r9dk03M6NkOLImqp29kU:nrsN+3IrxbvkBgkDc9kU
TLSH
T184523A7068786C669EE7A105F58737239EB450BBDAC46FA8E5DC9B0C04C639C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 7f795bd2dc85ac0b95f0f0ddb1fdb473c8d1eed83a7b4fa5213d76456b6a0b4f
MD5 6dafadb8a936f3f2fe1b68c69dc0f374
SHA1 4d8bde7679c2fef7103786969c96fcb057cc6379
SHA512 68613012450d36fe8b70636bc29955be8b0e406d4f50625138087225609547028536468a8200543136d15fa698d4332df6f4824eda3e95e872d561b6c5272e6e
SSDEEP 192:uuTIrgsN+3QjrHSmWqQmiU1urT/k03M6NkOLImqp29kU:nmgsN+3IrxwzkBgkDc9kU
TLSH
T11B523A7168796C269EE7A105F54737239FB410BBDAC46FA4E5DC9B0C04C739C270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2d6c3438587760f2c3a09ee3bc848f45eeb07f934685eb3204336c044d9a3daf
MD5 1cc7f64958d5e2bac44f64ba3135e074
SHA1 1a1dca2b51491d66d21024b16976e82115449ba5
SHA512 ab697ad9eadd1cd76ca1175d407ea02c59d2b414f1faf0233980521a88fa26c4b472dae2b768d9188d26d0ce6cb5a883817961ea07bb67ce6b37544b32cae12f
SSDEEP 384:ntZcI8gsN+3IrhXlkBgkvcnTKwBODNZOCPKDD:13QScnewBKZO88
TLSH
T177927DB06C7C6C269EE7A505F44736275EF450B7F9C42FA8E5ECAB1C04D13982B0B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 080dee424660f8ed4b34911dd5e673c1ca2a44f6016c52ee38394f2764d07884
MD5 20b71bade685e23f30bfc068d6785319
SHA1 b9fc1000a8f29527760f96b2b07fce9c6a1e9f8f
SHA512 20b3f98500fec0b6e43565f91352ddab23b72bc984359e349e048032c45ad89b802b91b4ca20f01486cce271fcc95da7ab18d86741c5d805582bcd5944733a74
SSDEEP 384:naZcItsN+3IruNWkBgk/cnTKwBODNZOCPKDD:Yt7JcnewBKZO88
TLSH
T165928DB0683D6C369EE7A505F54736275EF450B7E9C42FA4E5ECAB1C04D13982B0B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c041093adedeca3da835327dd58e5e326661ee4b3b639be5bb301b3964568c46
MD5 786ef7136d3adfff2bd7501cad6b38ba
SHA1 9e642698b20373706f85274c7a3caf9e75e77e7e
SHA512 7fae13c5c84343369d78bfa0888d11781e0504f98ecba04f8bcdb354698f396ae494fe83de482a6c88a01aaecfad5d14e298ebeb4ca7c23741506c335e0dd89c
SSDEEP 192:uuPmsN+CQjrHSmWcQmiU1IrVtk03M6NkOLImqp29kU:nusN+CIr5+LkBgkDc9kU
TLSH
T150423A7168786C665EE7A101F58737239EB410BBD9C46FA8E5DC9F0C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d1b3cf98d6d9b4e17fb3d18b64032c0ef29f8009493a778b560e1da67be1be19
MD5 2eadb000672e8a9b00d7da5467e5275b
SHA1 7f09d76c4149e52e642a71b3b6b00a697d6d09c6
SHA512 f9877a1a725ddb07655ce232f2ad093248ff17518e1ff0a6dede482616f32215418e4d8ad5b7a588cee8f7885d3990a4e707864f6f4f77191f56cc6642f0dd32
SSDEEP 192:zP8sN+nQjrHSmW8QmiU1drexk03M6NkHcImqp29kU:z0sN+nIrtfskBgkVc9kU
TLSH
T16F4229306878AC669AE7A506F58B37279EB450BBD9C46FA4E9D85F0C04C739C270B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 033a2eb5faad82df8c0768a6b3d3949446e806311a0077cac77a7de64b934fc0
MD5 9fe45f75ae856c125e99b6cc55d6c415
SHA1 b73a07923270ec462a939fb55cb9c1c228d4f35b
SHA512 65f64dc77975733bc745d7dcd689af0d516b4975a7867c574cb66e80a51ae0ef1bfffe7eb190977b4238a8d26de56beaf2330de60126c55efd432438d4f7f15c
SSDEEP 192:zP8sN+nQjrHSmWAQmiU1Or9Ok03M6NkHcImqp29kU:z0sN+nIrzcAkBgkVc9kU
TLSH
T19A4229316878AC279DE7A506F58B37279EB450BBD9C46FA4E9D85F0C04C739C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d33d359acc4638c31eff4e072cb47de0038ed61e2ace6e1f82fea395c08044d3
MD5 6a92ce93431d3335ba8201ef466cf145
SHA1 b86b7f53324cb477f9cece0f5d209cf4800c21ba
SHA512 a3b2745a72eae25f8715c33b5d95acbede152866229e582bc8a0d3eb9746b212a68259c2fab328452c5ce149929e022f674e1a6944d0e98bc7779306a1a4129d
SSDEEP 384:nsiFpZcIV3sNA8TUNTUlIlGIrXBp0DfQdBgkJbKVgJg9kg:XFhV3dwg/VJ8gJg9D
TLSH
T148B22971D8A8DA2BEDF79782F64676579EF01163C9C89ED4D9D8AE0C00832ED170AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 51bf8098b0b8ea7779ece44a1c0d5d67e81c07bfce717d682c0a264db9eb26c9
MD5 601a2002632a60018a95291d6e9d5e90
SHA1 2b9e28eae246199f4b1ed0a1bf839274c117fa20
SHA512 b18a751cf034c918d704eb17f302d77b70423820760c562494097f02c1aef20afd35956ded2da6264f819eb6977dffd0b29f2e0c7dfd33c56a6356da1e24c2fc
SSDEEP 192:uuTasN+3QjrHSmW5QmiU1Pr6ek03M6NkOLImqp29kU:n2sN+3IrE15kBgkDc9kU
TLSH
T10A524A7168786C279EE7A101F58737239EB450BBDAC46FA8E5DC9B1C04C739C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da1f06ca3d8831cc25a81f068cfc2753882e90d863b7377d1facbe0fa8163aed
MD5 f2c4741cfe072ca457d1cfa10426d636
SHA1 ec5b0b8de366054f77a38ee6be01b1d7c2e448d8
SHA512 11a35155a5a53dc3769fc3702d3e5e66037e6e4f1993355b5e47170967835eda3f3f192c957081b63e307b2463f39e1edecc0394e5ee0e7e1707e8f1caa8b663
SSDEEP 192:uuTfsN+3QjrHSmWXQmiU16reqk03M6NkOLImqp29kU:nrsN+3IrK05kBgkDc9kU
TLSH
T106523A7068786C669EE7A105F54737239EB450BBD9C46FA4E5DC9B0C04C739C270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8151872392780101062d72438d731a2d7c129e590a0e1ff7cd035de358ec0792
MD5 5e9e07b3d63e51c8b1bfe8727f2782b6
SHA1 c6b75be029efe03d45eeeb0103ae0112616f6634
SHA512 edb004a478ea8960bf87862576ef5e8b470995768c0d37c3c4e7da45ff1d3acf4837e63b95c698bad4a8fbb4818d5aeaae29b93e0efe73a10cfdcb3ddaba63f5
SSDEEP 192:zPlsN+nQjrHSmWUQmiU1Krf/k03M6NkOLImqp29kU:z9sN+nIrXE3kBgkDc9kU
TLSH
T15F424A306C79AC669DE7A106F18737239EB410BBD9C46FA4E5D85F0C04C739C2B0B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 58ee760947f8796a2c087b1ba538fa3c3fff165367199f38e26c733308695183
MD5 d9e8e8e94dee5a17d4184b70768735c0
SHA1 87b6def1b81673a5079bb4d56a885343c4eea837
SHA512 8ad5fa01830ae5d5462475150c69003fab862370bc2ac8c218390b8768576c3acc0abdceb78c70c823fc60080a3f6be6e25a7cc6c5dc0fdfbab5e733a4aeaea1
SSDEEP 192:zPlsN+nQjrHSmWAQmiU1RrAsk03M6NkOLImqp29kU:z9sN+nIrvnNkBgkDc9kU
TLSH
T1294239306879AC679DE7A506F18737239EB410BBD9C46FA4E9D89F0C04C739C270B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c6b50f2720377d6d458cd510ea3834833b3e8c3df5f96da2d360f98871213f6a
MD5 da71e51c85d891171035cd49d493e66f
SHA1 e00425238c9d75e10f4d07105777cfebf0f8e2e2
SHA512 fbdd0f451524747fff53fd038173ecaa2dd0c81098f983edcd3f7ceb84194dffdda4be13a4209759dc65bbd493f7aa934d81c676119267b9d4bde4d8dc7d1b03
SSDEEP 192:zPcsN+nQjrHSmW3QmiU14krr3k03M6NkOLImqp29kU:zUsN+nIr6SojkBgkDc9kU
TLSH
T173423A306C79AC2A9DE7A106F18737279EB450BBD9C46FA4E9D85F0C04C739C270B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 dabe6ba9b14cefbe4894586a1d79723ee069a2a5fa4556145fe50640a22b574a
MD5 f5f59c99f838fcf080a295d85da30db3
SHA1 8d3d89fe146a56c8311c7d9b68d68671150526de
SHA512 7e8c43049127f75ccd803db00cbfe5bf2ddd0fcf65af1a68c127290edc07ffb568f23ee239659cb2fa3afe05e69c20fe19882b9ec7669a2cc81fbd2190856270
SSDEEP 192:zPcsN+nQjrHSmWbQmiU1Wru+k03M6NkOLImqp29kU:zUsN+nIr+Y9kBgkDc9kU
TLSH
T175424A706C79AC669DE7A106F18737239EB450BBD9C46FA4E9D85F0C04C739C2B0B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 29fc3b753476bd59655e8981c01027a23162691119ed4f8e26693580989d019b
MD5 446042cbf5fa9ccee68a5e810eb93e35
SHA1 2af06dfc81bff88b2dce0f6c04e0c94ce7c422b2
SHA512 3d4ce1dd79d43b503d987a21e1f011ca7673bfa030a4320dfa6d9d32e7a3d841450fc9a67b6f2b9f5d81304a0debcb45d2ba31d47a327a6edb5a1324e24165ac
SSDEEP 192:uuPusN+CQjrHSmWiQmiU1lErmmk03M6NkOLImqp29kU:nWsN+CIr1HIpkBgkDc9kU
TLSH
T1BB423A3168786C665EE7A501F58737239EB450BBDAC46FA8E5D89F0C04C73AC270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9b18519681bd7d157851d695af7ed02dd13b530918be9752dc93445fffd2d374
MD5 273e340d34f96a3d1f415f3d720a1403
SHA1 04944d2e97d13f08b544b0bb8439b03108d1677d
SHA512 46c48780f94ebf5d8f38e6b4f50d54d9ff7e97ff71f62e7b2fa244dff3d921f64be43634ef53a9f998e366aa8b05ad85eb53ac5911c78c1fa67263925968a916
SSDEEP 384:nsiFPZcIQsNO8TUNTUlIl3IrRtb0DfQdBgk/cnTKwBODNZOCPKDD:XFHQTwgU3bcnewBKZO88
TLSH
T19FC24A71D8A8DA2BAEE79785F646765B9EF001B3D9C85ED4DADC6E0C00932DC170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d689389e7705a23129b06067475f438402ba9af61ceacf5fd71ff9d08e1a03c8
MD5 992b98e63d08622de3028bf95913f84e
SHA1 ba77c44b30664fc61d04dfa23535a73d87d260f3
SHA512 b97c849068fab51969eafd97e27cb866eeeaf3338bc0091ed89e72614f6221e91ca257fdf06902bae4e00ae0be885fffb6f94d177e327a6a3017346121dfe91d
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop555DSBhPwivh50xy0SFYK+AxADqQI:gONS6kDfQmiUyLyZ903SQiZFjU6
TLSH
T1DB02F93568782CABDEA3AE05F48737275FE5212BEAC52FD4D5E81A1C44D724C2707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 209b27649e69b5877ab88c7a258b9d5a6b9cc8dc8046246cc29500713d9d9d36
MD5 d4b5f355593fba816d43c63817b96675
SHA1 572272c9d4b2ceb8f8644e68be4705fb35e20494
SHA512 f91a228f4bd2b0b6f49afcc9a5bbb5e97eda2881a561803963efc4cbe37a4742a8d805377f2b6c70f4a3a50e438e723a990ce39d3ff52440e3ff9370b665d6e4
SSDEEP 192:z1ON+6kmWlQQmiU1KrGZk03M6Nk8cImqp2U9:z1ON+6ZzQ8kBgk0cU9
TLSH
T1ED22183068B87C2A9DE3A505F08737639EA5107BEAC96F94E5E85A0C04D738C2B0B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 38581f1e04dc220da1bdc890a397737609f47d7c1519716dd09e9177b421925e
MD5 54e744e0e252cc020ee1dbf75eccd30b
SHA1 040f3a3c45ddce553a3ecdf6bc570da29b52f365
SHA512 a9d725d69ddb254d8516efabf6d875dab642a389aec8636c0fd95e6650ff27b3b81e4721b30c2f233dafa8d84c94ff146febab53ddce842d08f068cb5ed439f5
SSDEEP 192:z1ON+6kmWlQQmiU1Jrxyk03M6Nk8cImqp2U9:z1ON+6ZzTQkBgk0cU9
TLSH
T10022183068B87C2A9DE3A505F08737679EA5107BEAC96F94E5E85A0C04D739C2B0B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bc911a18e438b17c96db7bfc67808edc1979c59d6784b4ec9bfacb884768fcfd
MD5 821cce4e928d597fc5fa1a504cb940b3
SHA1 0c991fa6854df1f3a0958dc3b338c80db922fa4c
SHA512 d7400113df815f52056ced871147ddd809b6814f21e3675a0d7e1db7f5e65c8c6137e484284c6507303c00417b633239d6106556f259b0676fd467453d69edcb
SSDEEP 192:uuPbsN+CQjrHSmWHQmiU1WrvLk03M6NkOLImqp29kU:nDsN+CIr+kjkBgkDc9kU
TLSH
T1CB423A7168786C665EE7A105F58737239FB410BBDAC46FA8E5D89F0C04C639C270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9304b9b7e7547ef2bf656c6de8ad1b52bf9d3b4d9e1f797ff01a98551c6dd5c8
MD5 ce88d4120d84580dc2d49fffe008b5c6
SHA1 26de7be0e7355acec31564f6be6f5e70b2ee366b
SHA512 0c560c8c1bafd0597c3494c5625a4a3f10cd76d17318c7d3066874910b61a8e6bbc6f331bff3d0b4a668eccf6241ce6fc3f44e183bcbf7e52b8c9d35408e6715
SSDEEP 384:ntZcIvsN+3IrhCHkBgkvcnTKwBODNZOCPKDD:1vFAcnewBKZO88
TLSH
T188927DB06C7C6C269EE7A505F44736275EF450B7F9C42FA8E5ECAB1C04D13982B0B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b12046c669d3c591adc1ee828293a6495754f2b9ef995ff202674efc764dd803
MD5 20eeb4c750e3245cf4c88b6a5f654e4e
SHA1 862255614112ae13a7156930395481800912114f
SHA512 ab9b4622a7f2a4cb1baa154c5fdd1590b911b913008a5c6a0e2599503b296ceb2a1cd9a97d1361d468ec9a7d15fd1ad812aab32417583000f852f9bdbb7ad8c8
SSDEEP 192:z1ON+6kmWlQQmiU13rS8Uk03M6Nk8cImqp2U9:z1ON+6ZzFSHkBgk0cU9
TLSH
T16E22183168B87C2A9DE3A505F08737639EA5107BEAC96F94E5E85A0C04D739C2B0B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7903bf7e815e59ce8ff8e96d810374e86f1c7b8b73867562dafc5a289d27bae6
MD5 ef811894726436b529842a30b214f320
SHA1 a676fd8155f395d79fefd76484130d5021d801b0
SHA512 3a155f19ee9870140274526111117a42c542383747ff15c0ba31619d5d95b639e3dedf2a0c02673f1b754cdbf015969fcddd58961bd9ba4048f4e2dd5a7661f8
SSDEEP 192:uuPCsN+CQjrHSmWAQmiU1QrOSk03M6NkOLImqp29kU:nqsN+CIrTSNkBgkDc9kU
TLSH
T153423A3168796C669EE7A101F58737239EB450BBD9C46FA8E5DC9F0C04C73AC270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 248905f952625071e67043554da100e0f5dfdbafe29ad643069ef943135c86bb
MD5 7348978f6dbeda53b951f25b2c02d585
SHA1 9d682da737967579ffddc56d2b275fdc83be6940
SHA512 12b2de0d9b34ab3fd51c77e30c14f3a6f9644b6ceb783d212ab965aa8ba5e70cbe9d42e50e5e4c1d4dea564c977d355ccbcce42aef77878a56c421a201f67886
SSDEEP 192:z1ON+6kmWlQQmiU1ErY/k03M6Nk8cImqp2U9:z1ON+6Zz+AkBgk0cU9
TLSH
T17E22183068B87C2A9DE3A505F08737639EA5107BEAC96F94E5E85A0C04D738C2B0B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bde79f1e-50b1-4fa1-b971-f90a67cc424a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bde79f1e-50b1-4fa1-b971-f90a67cc424a.tmp
Size 12KB
SHA256 621b04dd87da7f54d28b2adc7552c11b1860c0ad6173db06b1f5e4cb4f0c5f9f
MD5 d5b2508747a661dae7e0dcce95928f6f
SHA1 7a2d2ddeaa37f9af2e1be60dd087738ad8b50f78
SHA512 fbefbf93b8563db2e0725e0093560cba737d906385cb66900a6d83ae68e0c43e05977ea19e386865634536b985f54515d12c85d7008fa05fed6742092b8e11a4
SSDEEP 192:uuPSsN+nQjrHSmW+QmiU1Lr59k03M6NkOLImqp29kU:nasN+nIr5BnkBgkDc9kU
TLSH
T173423A3168796C669DE7A106F18737239EB450BBD9C46FA4E5D85F0C04C73AC270B51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2c1f9b8-ae66-4527-809d-830c33dc3665.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2c1f9b8-ae66-4527-809d-830c33dc3665.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9ebc7a7422972567c6fbce1ec1e4f898e94da08513930663ddba42f76ef2302e
MD5 84f01c0a7e4cbc740511096d72244121
SHA1 e0488b75a47d6d02b255c12544703c30e79d6f14
SHA512 d2321d0f997f6d67446805fdd1dcc82cb546dc0b652c77f51687227c7ac7140c9bda1d8d3e165b0ecf38954d1a206220cf8de97ce812a83cc5991b8aa3961c97
TLSH
T176410758BAEA1148B3B72F56ABFAA85D487AB8762E07909D10110E4E0573A00CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

0c5cb4d4-a9c4-46e9-88f7-86ea8e18b6d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c5cb4d4-a9c4-46e9-88f7-86ea8e18b6d1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18642\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f89e82a5-4601-4a96-9bbe-1389767ddcf9.tmp

Path C:\Users\Admin\AppData\Local\Temp\f89e82a5-4601-4a96-9bbe-1389767ddcf9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dda9ec2c-4e78-41a6-b0db-330b4aa01be1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1964_1723632454\dda9ec2c-4e78-41a6-b0db-330b4aa01be1.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

858h21xd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hiozi32n\858h21xd.exe
Size 5.4MB
SHA256 8fd8ed7459c026a542e961e2d3f4f4f9d5378ac3ba587d885e94270314837cf1
MD5 e71a0e198e0eb52a961502c408a90f25
SHA1 a0da3eeb76a183c33531179b416da54b856ff488
SHA512 f21ef2a150a6499c09722f95aab70fcdafb26b4bc2ce91acc617692bb69bb337f674233e33ad9b1d0bb391d86ca7ae4f6a22443a7b23c3ecb4ae19bc78291a0b
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrN:k7ICteErownP0oTcMsABqlkgczZ
TLSH
T12E463308B3A809D6F6B3D53D81565211D872B4264BB0D2CB43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5240-1366-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1615-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1633-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1599-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1550-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1477-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1799-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1237-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1806-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-709-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1107-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1887-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1908-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

memory/5240-1911-0x000001305FB00000-0x000001305FF74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads