d2f105ba4c607b27d84a19c6dbb441691a97139f19198dabc9c9b357771448b0

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260802-n8v7ashf97
SHA256 d2f105ba4c607b27d84a19c6dbb441691a97139f19198dabc9c9b357771448b0
MD5 1f911ae442c0f02e8cb8cd9d42f706ff
SHA1 e1529658df04d435e8db8e9afda7040664034b00
SHA512 97e2c3b1f93cd2248c93e8ccab5d76007a4b38ca79a5644721795b6722d0bda57736199f94616986a882c801103e58dea6ac39454061799d597fe079ae17dbf9
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMK:9XhICteErownP0oTcMsABqlDQk9
TLSH
T197463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9tzu4.exe	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9tzu4.exe	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Loads dropped DLL 12 IoCs

pid	Process
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\7c9ah3oe\\5jx3e58q.exe"	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1398	ifconfig.me
3253	ifconfig.me
4442	ifconfig.me
5526	ifconfig.me
9313	ifconfig.me
11418	ifconfig.me
523	ifconfig.me
2802	ifconfig.me
8726	ifconfig.me
130	ifconfig.me
11685	ifconfig.me
11932	ifconfig.me
2	ifconfig.me
196	ifconfig.me
4319	ifconfig.me
9185	ifconfig.me
874	ifconfig.me
1294	ifconfig.me
2015	ifconfig.me
2159	ifconfig.me
5351	ifconfig.me
5714	ifconfig.me
1961	ifconfig.me
4507	ifconfig.me
11102	ifconfig.me
11812	ifconfig.me
105	ifconfig.me
2324	ifconfig.me
6811	ifconfig.me
10365	ifconfig.me
12710	ifconfig.me
2992	ifconfig.me
5240	ifconfig.me
6202	ifconfig.me
7109	ifconfig.me
11225	ifconfig.me
13244	ifconfig.me
6472	ifconfig.me
7967	ifconfig.me
9433	ifconfig.me
156	ifconfig.me
174	ifconfig.me
459	ifconfig.me
508	ifconfig.me
6449	ifconfig.me
3403	ifconfig.me
427	ifconfig.me
480	ifconfig.me
13208	ifconfig.me
129	ifconfig.me
1223	ifconfig.me
1784	ifconfig.me
10171	ifconfig.me
6093	ifconfig.me
326	ifconfig.me
8862	ifconfig.me
270	ifconfig.me
314	ifconfig.me
3549	ifconfig.me
3640	ifconfig.me
4333	ifconfig.me
13074	ifconfig.me
4187	ifconfig.me
11305	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5660	cmd.exe
7016	cmd.exe
2312	cmd.exe
1880	cmd.exe
4604	cmd.exe
2472	cmd.exe
4984	cmd.exe
5056	cmd.exe
6160	cmd.exe
6272	cmd.exe
7008	cmd.exe
5272	cmd.exe
5264	cmd.exe
7560	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe
5588	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5588	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4824	3184	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4824 wrote to memory of 5660	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 5660 wrote to memory of 2720	5660	cmd.exe	92
PID 4824 wrote to memory of 5588	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 5588 wrote to memory of 296	5588	msedge.exe	94
PID 4824 wrote to memory of 1928	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 4824 wrote to memory of 900	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4824 wrote to memory of 5532	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	151
PID 4824 wrote to memory of 5024	4824	2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 5588 wrote to memory of 1172	5588	msedge.exe	100
PID 5588 wrote to memory of 3804	5588	msedge.exe	101
PID 5588 wrote to memory of 3804	5588	msedge.exe	101
PID 5588 wrote to memory of 3804	5588	msedge.exe	101
PID 5588 wrote to memory of 6100	5588	msedge.exe	102
PID 5588 wrote to memory of 6100	5588	msedge.exe	102
PID 5588 wrote to memory of 1584	5588	msedge.exe	105
PID 5588 wrote to memory of 3972	5588	msedge.exe	104
PID 5588 wrote to memory of 1584	5588	msedge.exe	105
PID 5588 wrote to memory of 1584	5588	msedge.exe	105
PID 5588 wrote to memory of 3972	5588	msedge.exe	104
PID 5588 wrote to memory of 3972	5588	msedge.exe	104
PID 5588 wrote to memory of 2700	5588	msedge.exe	106
PID 5588 wrote to memory of 4780	5588	msedge.exe	107
PID 5588 wrote to memory of 2700	5588	msedge.exe	106
PID 5588 wrote to memory of 2700	5588	msedge.exe	106
PID 5588 wrote to memory of 932	5588	msedge.exe	108
PID 5588 wrote to memory of 4780	5588	msedge.exe	107
PID 5588 wrote to memory of 4780	5588	msedge.exe	107
PID 5588 wrote to memory of 932	5588	msedge.exe	108
PID 5588 wrote to memory of 932	5588	msedge.exe	108
PID 5588 wrote to memory of 1612	5588	msedge.exe	109
PID 5588 wrote to memory of 1612	5588	msedge.exe	109
PID 5588 wrote to memory of 1612	5588	msedge.exe	109
PID 5588 wrote to memory of 1920	5588	msedge.exe	110
PID 5588 wrote to memory of 1920	5588	msedge.exe	110
PID 5588 wrote to memory of 1920	5588	msedge.exe	110
PID 5588 wrote to memory of 4864	5588	msedge.exe	111
PID 5588 wrote to memory of 4864	5588	msedge.exe	111
PID 5588 wrote to memory of 4864	5588	msedge.exe	111

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7152	attrib.exe
7152	attrib.exe
6408	attrib.exe
6992	attrib.exe
6404	attrib.exe
6988	attrib.exe
7616	attrib.exe
7508	attrib.exe
11620	attrib.exe
2568	attrib.exe
2720	attrib.exe
2876	attrib.exe
1872	attrib.exe
6284	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_1f911ae442c0f02e8cb8cd9d42f706ff_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe"
      4⤵
      Views/modifies file attributes
      PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffdf107c188,0x7ffdf107c194,0x7ffdf107c1a0
      4⤵
      PID:296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,15877784367938043323,1506151752817071675,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      System Time Discovery
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,9527810280203591726,12107977020901813005,262144 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,12218317049827799847,237829489239880127,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,15094615250379884559,15549300988126167743,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,1157001269525484886,18045837691127142738,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,2072789522877232651,16876999614813488784,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,3630235432815763989,16173440027026433862,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4420,i,3171411520646311681,7459923458197321905,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4676,i,17041000351550132127,3773651906829511042,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4916,i,4526176923200391002,11130669995820002996,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5184,i,1821886535856008827,10389748886904737999,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,15045533863311505970,11079348438531403023,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6088,i,7279512167524298632,17725016380942271375,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6240,i,2599842768577297876,16031434046287136338,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6416,i,15883143211517537163,11557481318875961493,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3868,i,16674498811533889840,17659544552310331342,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6636,i,17213810767790107415,5780166037702716992,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13491578813470851505,4010182438735277932,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,17370095307755617782,1967615899270424993,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7120,i,6652686222926770798,10096638912617087639,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7356,i,9754955311360375469,6390780691773108579,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7516,i,100524687719985495,6117384902747027763,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7564,i,4931009449195928667,10075411769926967600,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8532,i,1520477524124570306,6380006947722841956,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8532,i,1520477524124570306,6380006947722841956,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7340,i,13272439658178678390,11976658166215083652,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7892,i,11479754888895189567,2556451373660081920,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8492,i,10520818866525263481,5793848607092321070,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8528,i,6976465255634614057,2941209518498918551,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8624,i,17264287429511387556,4435711683582415748,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8824,i,5997779582794181342,18140081568417981168,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8884,i,1713295274635484937,4287179991083303191,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8772,i,17978269314323578543,16763399958168790557,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8936,i,3029051734893791296,11026397825413761464,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8580,i,12361966196747004391,7049519951047512307,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=1604,i,7505135500763830090,17242292587366822440,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8676,i,11681117777211748383,17094085565508229557,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8900,i,5454656613625790709,102542622101821893,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8820,i,15059310339237095285,8097448854213378666,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9980 /prefetch:14
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8548,i,2798507896612835055,17312468615561201883,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6756,i,16949595596690320135,11550766033917963244,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:1
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8332,i,9379706867692974505,339714758862028736,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6708,i,13804728892955441664,3563491208926965750,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10144 /prefetch:1
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8348,i,5719892574511165488,11242538858574074542,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6676,i,2756919672420302650,5325864256510942751,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10164 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7312,i,4760111446842296154,12186809380642118009,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:1
      4⤵
      PID:7276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8964,i,6620311881291117384,172625299974247892,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:1
      4⤵
      PID:7292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7128,i,14226822896664440342,18361003917275545704,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
      4⤵
      PID:7300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8656,i,1785730363405308431,272536896330427100,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7132,i,10111072104877976154,5576248943016339394,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:1
      4⤵
      PID:7316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9020,i,7942488352627389441,1559374941306317698,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8316,i,7848194265099707336,11931201747907749898,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10072 /prefetch:1
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8344,i,2533609386412719327,418987812959560134,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
      4⤵
      PID:7236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8476,i,7042541314030765335,14401040500611051840,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:1
      4⤵
      PID:7252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=6740,i,6810796322279248909,2718935499002049169,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
      4⤵
      PID:7284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6508,i,11801720785871817095,12527255198328733797,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:1
      4⤵
      PID:7308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9372,i,8296384719080226271,1687895254482990328,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10288 /prefetch:1
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8996,i,13560764126173316974,5840633825122666118,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:1
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9548,i,968311969749360889,9579935549190818263,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9396,i,7110350412899387063,7268275520386200225,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6672,i,10025561906808419854,13076897168828363888,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10324 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9488,i,7137482550729643388,8807261446353803182,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10488 /prefetch:1
      4⤵
      PID:7396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5096,i,4799478066550296724,2670973361459261368,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10548 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9304,i,6017933720292335046,2755412704386193565,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10344 /prefetch:1
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4492,i,5869292344406678707,8298498134216183918,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10364 /prefetch:1
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9040,i,3624904605526066220,18355106418062397609,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10032 /prefetch:14
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9520,i,1368998949055862758,15647580477492474312,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10552 /prefetch:1
      4⤵
      PID:7388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9456,i,2636708821101911347,6205717096017704011,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:1
      4⤵
      PID:7380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9584,i,16991111215621868790,1087671767316457822,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11536 /prefetch:1
      4⤵
      PID:7620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4344,i,10601772557975177086,15980282116527493856,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11532 /prefetch:1
      4⤵
      PID:7632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=4064,i,15816874576570335053,8218870683355215031,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9636,i,10128244246992178841,5257085192161663160,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:1
      4⤵
      PID:7604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4896,i,11422059847604760594,9786432963729980068,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11544 /prefetch:1
      4⤵
      PID:7600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9568,i,17717111239077243182,14636007074316190520,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11492 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=5132,i,9760654323937745890,18194249180396884599,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
      4⤵
      PID:7568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4356,i,7668376774071004741,6865244015173446225,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:7636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=5100,i,16153673520672492739,2750711781137948884,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11564 /prefetch:1
      4⤵
      PID:7640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8408,i,7649477358767639331,7016597664125426459,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11496 /prefetch:1
      4⤵
      PID:7676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4828,i,3181505522943131922,10539452236401500229,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11568 /prefetch:1
      4⤵
      PID:7704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8284,i,13726742252613530267,8128167614504398646,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:1
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9436,i,701350046537823679,5785632044510568448,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11580 /prefetch:1
      4⤵
      PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=4984,i,14179047917940453242,7630994371891406505,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11676 /prefetch:1
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=5108,i,5646297295570834017,16017605888945343311,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11656 /prefetch:1
      4⤵
      PID:7724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8412,i,6310307445693735881,6605666517833666457,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11636 /prefetch:1
      4⤵
      PID:7716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=9700,i,17841440624548178650,10764434487037114486,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11748 /prefetch:1
      4⤵
      PID:7740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=4960,i,15063979474518462007,5295863854268373771,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11712 /prefetch:1
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=9728,i,9688201024453906635,15307515906130911878,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11768 /prefetch:1
      4⤵
      PID:7764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9716,i,11895152869005815933,3236079398425471779,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11788 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9816,i,17315476032049190566,184306349098114986,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11944 /prefetch:1
      4⤵
      PID:7772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9784,i,12549189670849354304,17366716100706801939,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11824 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9768,i,1013346606092376172,2555940425381254713,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=12048 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11296,i,3354841930787488796,790965495329252718,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16032 /prefetch:1
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11500,i,6766061261211526765,16337457999253634279,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16156 /prefetch:1
      4⤵
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11392,i,16044966991903807805,1745634127942283848,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16140 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11312,i,12584763478134051142,9666020014472465513,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16040 /prefetch:1
      4⤵
      PID:7812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11340,i,5698967483059084633,16900501182351561867,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16148 /prefetch:1
      4⤵
      PID:7836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11268,i,17234024541195577148,18026093536477549514,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16012 /prefetch:1
      4⤵
      PID:7864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11452,i,2416667678343101939,4652042099856252120,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16120 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=11248,i,2723480081483410691,5102659544094852859,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16008 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11364,i,11664859398748847492,14205877744128109554,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16144 /prefetch:1
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11216,i,16944389485042269585,16645644974425007683,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=16004 /prefetch:1
      4⤵
      PID:7876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=19360,i,10683037080656662007,6108007152788518713,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=19392 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20128,i,3459431894923880661,6964995397300184218,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=19992 /prefetch:14
      4⤵
      PID:8332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20144,i,3781090936448938734,5977288679085418356,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=20196 /prefetch:14
      4⤵
      PID:8344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=19532,i,17648790231773272268,14340354074720196598,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=20236 /prefetch:14
      4⤵
      PID:8360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=19652,i,7409150177301486313,13462010817012253141,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10832 /prefetch:1
      4⤵
      PID:10196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=9300,i,5586304473094953395,14541795256304152092,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=11356 /prefetch:1
      4⤵
      PID:8424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=13324,i,10784775837714320897,2944773823261897116,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=19872 /prefetch:1
      4⤵
      PID:9924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10568,i,16997367594853779914,8270733838723210841,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:1
      4⤵
      PID:9960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=2392,i,7531683662509732623,9988788269514104674,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=20080 /prefetch:1
      4⤵
      PID:10092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=20512,i,9821342212425406456,10815009374294106011,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:1
      4⤵
      PID:11964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=11696,i,5804863617741447036,5440926918020325360,2097152 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=15408 /prefetch:1
      4⤵
      PID:11972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=21228,i,14459818815507357654,17659388597265323332,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=15396 /prefetch:14
      4⤵
      PID:12000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20712,i,4323547756085495351,3318884303669602175,524288 --field-trial-handle=2448,i,18440245601759633545,15298327541687956683,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:12008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe
1⤵
PID:5700
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe
  2⤵
  PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe"
      4⤵
      Views/modifies file attributes
      PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5440

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe
1⤵
PID:1228
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\adpxquoa\kjoazqwn.exe
  2⤵
  PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe"
      4⤵
      Views/modifies file attributes
      PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3036

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe
1⤵
PID:2964
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6oz9mgju\ui2z82js.exe
  2⤵
  PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe"
      4⤵
      Views/modifies file attributes
      PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6640

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6204

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe
1⤵
PID:6932
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kna1giy5\nulspwny.exe
  2⤵
  PID:7020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6272
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe"
      4⤵
      Views/modifies file attributes
      PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6432

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe
1⤵
PID:6772
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x94ydh0r\qbumyz4s.exe
  2⤵
  PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7016
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe"
      4⤵
      Views/modifies file attributes
      PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3080

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe
1⤵
PID:6628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qalixxl7\ovrp2wof.exe
  2⤵
  PID:6736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2312
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe"
      4⤵
      Views/modifies file attributes
      PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2556

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe
1⤵
PID:560
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\te1ej7lu\gj5heuet.exe
  2⤵
  PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7008
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe"
      4⤵
      Views/modifies file attributes
      PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5764

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe
1⤵
PID:5640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\be0xrlis\0s3xp9la.exe
  2⤵
  PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5272
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe"
      4⤵
      Views/modifies file attributes
      PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6404

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe
1⤵
PID:6608
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cgdw8mqf\62mknjob.exe
  2⤵
  PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5264
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe"
      4⤵
      Views/modifies file attributes
      PID:6988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2840

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe
1⤵
PID:7460
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\po3y1d45\za07d6j9.exe
  2⤵
  PID:7532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe"
      4⤵
      Views/modifies file attributes
      PID:7616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7844

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe
1⤵
PID:8044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xvfg8fkx\uicjc58u.exe
  2⤵
  PID:8136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe"
      4⤵
      Views/modifies file attributes
      PID:7508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4840

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe
1⤵
PID:10540
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmc9znv\id8umi1v.exe
  2⤵
  PID:10720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe"
      4⤵
      Views/modifies file attributes
      PID:11620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4144

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe
1⤵
PID:5628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qvgzc5up\dti55x5l.exe
  2⤵
  PID:7544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7vjro81u\f4ehj6qs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7vjro81u\f4ehj6qs.exe"
      4⤵
      Views/modifies file attributes
      PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

19a49d1d-0fcd-46c8-85bc-19c101b096a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19a49d1d-0fcd-46c8-85bc-19c101b096a6.tmp
Size 41KB
SHA256 6b327bbf659532d9876a1d3315aaf7bafaa60a63b9362297bc59026d94e711e4
MD5 82bcce0662080359a1c6b632d9630343
SHA1 1ad7b7b65b9930fe34e141c40e8aecb72df0aca3
SHA512 b89e4f26b9bd2cf49edea9300f0ea37acf62d96ef137ec70cc0695d120635aae38a28d8b1bac0033782555ceffe98392a49ae9d8e42bb9c767dc700bb5e22c27
SSDEEP 768:8rv+4UNbdq3IDE/i0NFJrEnjN3Gac1FeeVH1SCx:8bsbc35/JQnjMaREH1X
TLSH
T1D413BF3069B89E738DEBE385B1877A437FB4126384850FA4D5C96B0D169B5EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d7905d0-e21e-4b2c-929a-f2dc572d20d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d7905d0-e21e-4b2c-929a-f2dc572d20d8.tmp
Size 39KB
SHA256 837251fe45902c893da0c2921bb8dbe59d130e887fa22d41883b9b41a11409b1
MD5 06b6b63f42cf0836fda14daf6307ea51
SHA1 81398b80a08daf07e22f9b7e5f8c97bfe3f21104
SHA512 cae53332ec522014ef647c913837577f324295398865cf549d1f7799d4b9667eb664c88cbfaf536e0a711eb0399967f11163a3c100a6d72995d8b4dc6c9f1838
SSDEEP 768:rrv+4UNbdS3UVi0NFNrEnjN3Gac1oeeVH1SCz:rbsbg3A/NQnjMaeEH1V
TLSH
T13203CF3165B89E738DEBE385B18376437FB416A384850FA4D9C96B0D069B5EC230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 281KB
SHA256 6c54b5b292d647472d60bd49323dca59b4b257c6f0826704b0fc25257e726603
MD5 80486f3f8b694aa31bd04f2179b7de8c
SHA1 6f41c725dde7622cfe3af24819962a7317c74958
SHA512 ed6d865b243b9e1b930f781ebb5fed20eb96abd22d2e2292774ac71aa38f1b178b6e088fe027c6fff44cfe0cdaa2d24de179581288bd0e39b68cecda511aac05
SSDEEP 6144:SNKZ4VFIKiHHSootKMXF9YEf5Eqg5MCG6wGf5vaEJ3dz+jZzyoGU:jmHgSoor3zg53G6w2ZHhsZzyoGU
TLSH
T11254232D013276EC3160B76F156B7A3917EA40DB98C80624178F4C73A66DFD18B8FA76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 215KB
SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
MD5 faa448f8e8442acef549bffc5e6e72d7
SHA1 91782643a1efaae7d5ec6d012b750607a7dd45a8
SHA512 aa2e2d7173ca62ed0fdcfcb37cbbb67adf60b0cb6e86903a866d82fcf5b59a0b97d6f0d5b3604d30bf03d675649c61448462a8483af2952a262443a8730ce4c9
SSDEEP 6144:v3+D9KZPOManuaayR0HsFpJUjEAteYkc32HhGxQ/4koo5vVHkjo:v3s6GMsNRQsejEqgcMhGxmionkjo
TLSH
T139242314ED7D5F593AF2D99F951193CAD1F3BE0B909486AE1F2F441726082C471EE0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 06857d039149dfb70a481db352e48bfe72ca9d9798976fb965163631516b8a22
MD5 e52e8433a107b4e4d4a7e16b2d24234d
SHA1 e1cf33ed1a6ca5578e5eff6e85f7a58a38de5b56
SHA512 f9f31057775d5621bd00ee23b2438cf482c7a46ab100134f2faeb7b3bc7a778174907940322eb61eb4a76cb9e0b222221d9e892a0e894ccc421b2ccaf98eddf2
TLSH
T1F2712DC86F11CB99F75645BC67E185A832F1D8A6E68B9AB4CC491DF08802F5433C2953
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cd0227a9cc81de0827cb72a9eeb6fea7d778289d84af21bc0c09f6fea83243ba
MD5 9608650b2e4f13775cd653d11b574bb7
SHA1 0a3ff324e921d69a4a064fc4f940a9532e1c2cad
SHA512 8e850287fe3fcf0ae8901ebe645be232a1073daf46f7bc51cfa4a9a9d64fd283cd0caf19940a5a46d42d2403ee0e11412fa4d8ac0e17f4d03b8a44787db9ccc4
TLSH
T101612EC46F65CB9DFB5649BC67E1D2A832F1C865EA8B2A74CD491CF08802F5533C2963
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7197.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7197.TMP
Size 3KB
SHA256 0f451f08ddf10a8c5943319fa36650ffd8f770de096c3071671a9204a433aa45
MD5 8b4ee6f0e60bf3f3e66a99d94e338afe
SHA1 a8bfb95d0110e88f8e53d3d3c3c4335a027001dc
SHA512 68203bc88711cc8cccb5f9ff0a400816c784aa2f54d617ab80f4477c3310432b7f1352c3c5fe6d1654aa6906d607ff5e4bc0e5647fa2b4326b72c270b0bf739f
TLSH
T128510DC56F25CBD9F36645BC57F1D2A832F2C8AAE58B2A34CD441DB04912F1537C2963
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2f946f4e7de2c5d73e892b491219792ad4cd0dd8501fea9e7d694f1b561e4f93
MD5 2da0666d0bc893ecf35bab32ccb324da
SHA1 facb7114e8e0959115caeae70ce25ac5033b8170
SHA512 5ed35a46b1d7f4c521287c74c75d9253570b3e02ad1e96b78279a04e9fa3a604b08e481657ee66d8ec7c4b0a15c67b7f23f66fe38eb633e6c3be04895a322c4c
SSDEEP 48:YALlmV5747i70mVPsJFVRsJugmgCCAseHQzsSfoKsAVsTC7wEsUXm8LtGit9BQsv:DW0eoBXiZk0D8GwYXbLQizBJhoVqIW
TLSH
T1E391BEF7C3E8962D9C2156F0EB152E2BCE6D0915431C3D6AC9E4AF1BA7E2470E100A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 242bb1e3c91c3981387f5e1245beb7bc091e6fe14fc2c2d14c8f214c64c8e44d
MD5 61ffb74a4ec37b219fe8f7c5eb7e2b36
SHA1 8e840b9b6909afd0395afdc088533c0542e46c07
SHA512 4eb8a84efbe8ea17332e8aaed20bcede4eaf5498e0d475c3616792118a51fcd21ed6b0afc2468516da1f88be4d2b36e655559066d70e0d024383685ce6a329d8
SSDEEP 192:sxR9rCs/fEsqNISKCA94/pzoA8pKe/P8FrHg6+WNsM4dHfZYB19g6SzGp5IgVrJ:sxR9es/fEsq1Z8VGx5QhZ8Syb
TLSH
T1B242F856A938AD3B4DD7D219FA15BF13D3F91032A0D11E58E7FC9A1C14EA6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97ad8da905a4b3f036c8db112d1237d6cba9244f4cf687bee731c383625adb6e
MD5 8ff38079d86d39d652197dcbef5991a6
SHA1 ea159136c7e47bcbfd8614c798fdf4a3ed0d7bfc
SHA512 37d470a0f02adf43e05749deb9fcdd4ca3dcff9949f5a10cbc3989d264025ffb8585540960889f63f74d772bb4c22866f3e4ec6068b4f393658e986781055f39
SSDEEP 192:sxRyrCs/fEsBNIuKCA94/VzoA8pKJTP2SFrHg6+WNsM4FRezsrxpNfYB5A9d6Szn:sxRyes/fEsB9Z8/ix5QmYJfcSyk
TLSH
T18D52F956A9346E7B4ED7D219FA15BB13E3F6103294C11E58A7FCDA1C14EA6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b39bf2faf15d6d8741d898bbf9d13fb0badad571cbd46ab0e06fc7b8d562b052
MD5 67edcc3dc60231e999026376ca418401
SHA1 043379598ab0d2cbd9dfb07670e1a2e468066c70
SHA512 6045e41105fa853f97b8f9bd1498eb41e5603526bedaac132e06191582b4111b8940a927c40cd49e590d6f84b886e0503268de193b0328d876eab093113afc1b
SSDEEP 192:sxRyrCs/fEsBNIuKCA94/izoA8pKN2PhSFrHg6+WNsOtrRezLwJKSZYB5A9a6Sz8:sxRyes/fEsB9Z8Isx5jsgpZLSy3H
TLSH
T1F9520856A9386E7B4ED7D219FA15BF13E3F5102290D11F54A7FCDA1C14EA6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3a5c06a2d8434fb08ef8b24a4b62957ffa21f3362795517e9af4376c17bc49b9
MD5 d73a68c9680fc3f7f16b42ebc05d023a
SHA1 a72d8764fb80803ef53f9e4781ee5ba513527853
SHA512 1c61a47304a5f6faf062e9fe2994023bee1ab178270d8e6f7ff6efc8b4def52a00ee3065b2482d5aa7bc2c045756adafae2d1cb2518eecc7bb6d7d9a2cfd37b8
SSDEEP 192:sxRirCs/fEsBNISKCA94/TzoA8pKMeP8FrHg6+WNsM4FZ9dHfxpNfYB5A9X6SzG4:sxRies/fEsB1Z8Prx5Q9hJfaSyk
TLSH
T15F52F956A9386A7B4ED7D219FA15BF13D3F6102294C11E58E7FC9A1C14EE6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 33239c1d87e2a81de911482bb5697a66476144d1d5671ae3a0242dfb1d746515
MD5 7aa47966e6d933fe384c12c0cd500cd3
SHA1 07dfd8c3ce14eac95972565d61177fa8faac28d9
SHA512 e87d1f3c1c8f2e67861d3b2a423ca3a951a11a2d1dfaf00d9532de35e921be9a7f79a903c13588b57454455aa510695c2b1e68a6c0a1400fb1924c1616d8f06a
SSDEEP 192:sxR9rCs/fEsBNIuKCA94/lzoA8pUN23h8FrHg6+WNsOtrsIzBQN7JKSZYB5A9+/+:sxR9es/fEsB9Z8nEx5jrkpZHSy3H
TLSH
T193520856A9385E7B4ED7D219FA15BF13E3F5002294D11F48A7FC9A1C14EB6ED620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fa2903f2c17d7ad711b9804b9663483ebbbe1825fe43305e471bd055c490ae77
MD5 e3478e509a1f3732fbabe4446738d19d
SHA1 263f96a1eaf5a7849b3726e290bdfa1be8669537
SHA512 f68beb778fa8d7a6f4cd546ea51de61ca415f48b4edd3131745a71a247b329ec467661d4dec42afc498f696967757ddff74777eaf6ce2ab00e9b44e2df553380
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc16fropLnmxM:azfWMdE7J0Wg/XfHfu1jaYy6MpLN
TLSH
T1A3C2FB3B640CCE7F4F800ADDAD197EDB6DA802CB9A98CD5047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a833b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a833b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20d38629e9a81d0689b83500fdc9ed16c235b0db459bec0b9d8252a427b22ab7
MD5 84e7f8d1ced208e151fe23e462088a53
SHA1 4f0e9c168c75ea4b79d27fb6bdf802e0bfdee64c
SHA512 5307128c97657a65ac2a1e24dbcd0097683f0a355acc4fea4cf68c7bb7a4c0c6c007287fcab3d3ebb5c4b93578b2446f5df637df1ed75219ba41c99f22bf8371
SSDEEP 768:Jj3GDdni0NFYrEnjN3Gac1Fe2ewBKZO8W6:Jj3G/YQnjMaR2evZT3
TLSH
T1F4F2CF7439789DB38DEAE385B5437743AEE0026398C50EA8D6DDBB0C15976A8170FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5a0eaf0e7a718533eadcf8e12136315ae5dfc1a4576aa91e0b8c2ac4db93a309
MD5 99293e101836c406a38f03ca811a596c
SHA1 b0814e6435ecb832213c77dfe7905b12402e064e
SHA512 124e7e05e6f1eee9e4c224dfe6632649f64cefb76517b0b74fd4cc2965c007adb817d10df710975ad355c694d3e32e8f79f91e26bc322d07589c46f790eba562
SSDEEP 768:HFHI3rwgTDyesNF7rEnjN3Gac1Fe2ewBKZO8W6:pI3y/7QnjMaR2evZT3
TLSH
T1DA039F75A968DEB79DEB97C5B7467643DEE00263C4C84DE4DAC9AE0C10971EC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4309d36c28e9bfcdfda874a927784461228f6367d7c000368d20fe301bcbcc90
MD5 c71b02efad48e2e8a8051e31e8b291c2
SHA1 a08ff88825a1d28b711c68e2ce8c660596bb62c1
SHA512 3a51b6faee3fa8c767b3d9d03c349c3f4a00b90ff49359a596a3caf2a1719915f0bce4fbccd331c8a35e7fe3564482c9f5ecae83b66ac5507fdd21187f1f891b
SSDEEP 768:HFc93rwgTD14sNF7rEnjN3Gac1Fe2ewBKZO8W6:m93B/7QnjMaR2evZT3
TLSH
T13A039F75A968DEB79DEB97C6B7467643DEE002A384C84DE4D6C96E0C10971EC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8055b77ce7b520b8399dc4d3153d1a8b349185002c4a0dbec1853a6045bf7f49
MD5 b0ace931eed1c9321e724b155f33569f
SHA1 79c3a3f3451f19354bb0c6c5bf28382173af7a0a
SHA512 0ff144134430eabb3f4c48addf3d07040866f0ce89f7fc85d7e5333c59769b4a977f73381c1ca6cdf62df21e9fb9aae628275f72d7b83678cf4573a2d43f5e72
SSDEEP 768:+rv+4UNbdS3QDi0NFNrEnjN3Gac1FeeVH1SC8:+bsbg3+/NQnjMaREH12
TLSH
T1A703BF3165B89E738DEBE385B18776437FB4166384850FA4D9C96B0D068B5EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4906eff7801ef2aa1bbfac7f4d0a4ba572d9e3df7459dace92f1a12ec2bd6867
MD5 72de76b070079926d2e08251b7dca8fd
SHA1 cc40bb87496581fde437be17136402fa6ad358dd
SHA512 5f16896f1d63879117ff320dfc04528ceaad5baf014997072722f41d029b15febfe8674fec7edce6a7f9be1b2ad491b870229dd73d4eec7eff55921afd97421a
SSDEEP 768:HFf33QwgTDPesNFgrEnjN3Gac1Fe2ewBKZO8W6:V332/gQnjMaR2evZT3
TLSH
T1B1039F75A968DEB79DEB9785F7467643DEE002A3C4C84DE4D6C96E0C10971EC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2077424e6ef32159e8a3e97c53170b8b302da5c72c30d68cda1c72be4200671c
MD5 63a9003b4f1119e9ee1dc51fe833fa2e
SHA1 72571eba38d87c25806fc4f80594462c91ff49f4
SHA512 ef1f1916b676e38c567f7d6a8671d2714fe2afe5e77bcde57d8453f4b66adc410983bf0e61161309ce871d925fab8e0ce2f60b63d61dcb7c6ca377dbb4b25556
SSDEEP 768:orv+4UNbdq3IDgXi0NFJrEnjN3Gac1FeeVH1SCx:obsbc3d/JQnjMaREH1X
TLSH
T15813BF3069B89E738DEBE785B1877A437FB4126384850FA4D5C96B0D069B5EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9ddc38d1eb05fdc75dc3e62418e7157ba54ab2c4072961626b5e355ce031474a
MD5 2296dbd067497ddddd275081b92b9723
SHA1 6db9b7496a3320aee2f9b22da01e506afda21d95
SHA512 6ddd843fe1e7602a88ad371fc09680bcd5428a1c274cd62c18e6776a4de107d7c2048e1f6b0b69456220f87a5286be2c0fb1a837c77e162a877b36c6a11232df
TLSH
T191E00103E30046FAD06C273080C72B243BB7C135138343079E204179BD203006D238A1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a4d18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4d18.TMP
Size 392B
SHA256 d434daa08bc0d78e321d516e674e2bf19cfef1b13bdb6d3ce6e7d92a8e82f402
MD5 648bf8469e14b856ff5fa248cf9b778c
SHA1 403e9436fd4d3a2cc432a17b53021da0a883e89f
SHA512 036ca377fa675d20058bb589d74385014a98c2154d4a7daf601a5fe722a4b200919b61b0b86386b9f50dff11507f98d327d94ff53529e55eea1ff3f9a454f1c1
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2217be78-f37e-405a-ae0e-6a41c863f4a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2217be78-f37e-405a-ae0e-6a41c863f4a3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31842\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5jx3e58q.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7c9ah3oe\5jx3e58q.exe
Size 5.4MB
SHA256 d2f105ba4c607b27d84a19c6dbb441691a97139f19198dabc9c9b357771448b0
MD5 1f911ae442c0f02e8cb8cd9d42f706ff
SHA1 e1529658df04d435e8db8e9afda7040664034b00
SHA512 97e2c3b1f93cd2248c93e8ccab5d76007a4b38ca79a5644721795b6722d0bda57736199f94616986a882c801103e58dea6ac39454061799d597fe079ae17dbf9
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMK:9XhICteErownP0oTcMsABqlDQk9
TLSH
T197463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4328-479-0x000001DF05860000-0x000001DF0590D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads