b32c6d3d9333192ae25ec555ee75144f8bf124d87cbb23c2e9040ed1a63ac567

Analysis

max time kernel
4s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260804-m5qlzaycka
SHA256 b32c6d3d9333192ae25ec555ee75144f8bf124d87cbb23c2e9040ed1a63ac567
MD5 846e060d5a41c23cac2d24c441afbd87
SHA1 a1751f9c68b0f77c346b7ec12d661f02889145bb
SHA512 b038ad4c6442d14735dd694001053137ac45677a3f032d3d8fbe6807562c76eca62466186f32646c7064020546316359f51ebfce40eb4ce8373520d0e26d5696
SSDEEP 98304:gvLgtINFnICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkH8MaM66Pd:jINdICteErownP0oTcMsABql4A6F
TLSH
T152463304B3A809E2E6B3D13985665221D572B4254BB0D1CF03AC9B662F777E0AF3FB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m1s607.exe	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m1s607.exe	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
5316	z2dby81n.exe

Loads dropped DLL 11 IoCs

pid	Process
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\ogadfj2q\\z2dby81n.exe"	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2442	ifconfig.me
6564	ifconfig.me
7694	ifconfig.me
667	ifconfig.me
1535	ifconfig.me
3168	ifconfig.me
3291	ifconfig.me
5121	ifconfig.me
7804	ifconfig.me
8031	ifconfig.me
8552	ifconfig.me
4979	ifconfig.me
7242	ifconfig.me
2114	ifconfig.me
3947	ifconfig.me
7897	ifconfig.me
548	ifconfig.me
261	ifconfig.me
2207	ifconfig.me
4689	ifconfig.me
6489	ifconfig.me
6939	ifconfig.me
500	ifconfig.me
323	ifconfig.me
1591	ifconfig.me
3610	ifconfig.me
6445	ifconfig.me
210	ifconfig.me
1327	ifconfig.me
108	ifconfig.me
3770	ifconfig.me
5587	ifconfig.me
6119	ifconfig.me
6132	ifconfig.me
7534	ifconfig.me
1625	ifconfig.me
2610	ifconfig.me
3048	ifconfig.me
8118	ifconfig.me
8551	ifconfig.me
328	ifconfig.me
1844	ifconfig.me
6998	ifconfig.me
7685	ifconfig.me
8357	ifconfig.me
2059	ifconfig.me
2846	ifconfig.me
4196	ifconfig.me
7446	ifconfig.me
862	ifconfig.me
1742	ifconfig.me
1867	ifconfig.me
3198	ifconfig.me
7326	ifconfig.me
7552	ifconfig.me
193	ifconfig.me
1428	ifconfig.me
7409	ifconfig.me
7541	ifconfig.me
1649	ifconfig.me
4488	ifconfig.me
7284	ifconfig.me
1606	ifconfig.me
5934	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6980	cmd.exe
9840	cmd.exe
4844	cmd.exe
5572	cmd.exe
8036	cmd.exe
8424	cmd.exe
8536	cmd.exe
6208	cmd.exe
9528	cmd.exe
12084	cmd.exe
3528	cmd.exe
4448	cmd.exe
9240	cmd.exe
6240	cmd.exe
13852	cmd.exe
1464	cmd.exe
6476	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 4600	1796	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4600 wrote to memory of 1464	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 1464 wrote to memory of 820	1464	cmd.exe	92
PID 4600 wrote to memory of 2904	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4600 wrote to memory of 5524	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 2904 wrote to memory of 1592	2904	msedge.exe	96
PID 4600 wrote to memory of 236	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 2904 wrote to memory of 2544	2904	msedge.exe	98
PID 2904 wrote to memory of 4768	2904	msedge.exe	100
PID 2904 wrote to memory of 4768	2904	msedge.exe	100
PID 2904 wrote to memory of 4768	2904	msedge.exe	100
PID 2904 wrote to memory of 1388	2904	msedge.exe	101
PID 2904 wrote to memory of 1388	2904	msedge.exe	101
PID 2904 wrote to memory of 1176	2904	msedge.exe	129
PID 2904 wrote to memory of 1176	2904	msedge.exe	129
PID 2904 wrote to memory of 1176	2904	msedge.exe	129
PID 2904 wrote to memory of 2680	2904	msedge.exe	103
PID 2904 wrote to memory of 2680	2904	msedge.exe	103
PID 2904 wrote to memory of 2680	2904	msedge.exe	103
PID 2904 wrote to memory of 5184	2904	msedge.exe	104
PID 2904 wrote to memory of 5184	2904	msedge.exe	104
PID 2904 wrote to memory of 5184	2904	msedge.exe	104
PID 2904 wrote to memory of 932	2904	msedge.exe	105
PID 2904 wrote to memory of 3320	2904	msedge.exe	106
PID 2904 wrote to memory of 932	2904	msedge.exe	105
PID 2904 wrote to memory of 932	2904	msedge.exe	105
PID 2904 wrote to memory of 3320	2904	msedge.exe	106
PID 2904 wrote to memory of 3320	2904	msedge.exe	106
PID 2904 wrote to memory of 3388	2904	msedge.exe	107
PID 2904 wrote to memory of 3388	2904	msedge.exe	107
PID 2904 wrote to memory of 3388	2904	msedge.exe	107
PID 4600 wrote to memory of 2472	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 2904 wrote to memory of 6068	2904	msedge.exe	109
PID 2904 wrote to memory of 6068	2904	msedge.exe	109
PID 2904 wrote to memory of 6068	2904	msedge.exe	109
PID 4600 wrote to memory of 4788	4600	2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 2904 wrote to memory of 2540	2904	msedge.exe	112
PID 2904 wrote to memory of 2540	2904	msedge.exe	112
PID 2904 wrote to memory of 2540	2904	msedge.exe	112

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
12548	attrib.exe
9544	attrib.exe
9296	attrib.exe
9900	attrib.exe
820	attrib.exe
6552	attrib.exe
6916	attrib.exe
5788	attrib.exe
9604	attrib.exe
5908	attrib.exe
4452	attrib.exe
1752	attrib.exe
8116	attrib.exe
8196	attrib.exe
8688	attrib.exe
8668	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_846e060d5a41c23cac2d24c441afbd87_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe"
      4⤵
      Views/modifies file attributes
      PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x360,0x7ffbcb08c188,0x7ffbcb08c194,0x7ffbcb08c1a0
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2747152823754603670,8430192991300753595,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,16821146136195406934,13556787363630936366,262144 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,10002014255610506641,16112204495179510319,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17469098622869675471,14097190069541484054,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,5526091766598807147,10607416829185075502,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12003267511245868048,5433446767969515606,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,17461666188703932906,10397544901145191393,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4392,i,16651843620616236495,7636222786251140652,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4664,i,6803742805907812014,12476844387298929060,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3856,i,711605985344774529,13365492638374584617,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5704,i,16617474559801100525,18363924582241046459,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2871361092003849194,15033307210888155431,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15300791910344649318,14108034719729957336,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,4416245655333901872,15038133341778231885,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6544,i,13248821254299323608,3268916163497348165,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6764,i,8179063857402261560,1328155313087861434,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6740,i,5586656291975148598,78670756595488492,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:1
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6608,i,5578243983046664488,3972290407968187825,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7100,i,4350471124941464786,7635451110483126592,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7364,i,16544705633690732657,3971850756570937791,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5488,i,11284215786348112809,7632931560520912358,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7096,i,13402408579897860056,18163957403673110802,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7932,i,11866046985816990763,14843079894061965589,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8220,i,12397315193356541,13653001916285821478,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8412,i,15859810722320165506,9448205934918679730,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8588,i,11611029983138939010,14144204470664386053,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8384,i,476241925108613712,14282649906870504088,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8712,i,16513556356600983555,11487199796014774922,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8796,i,18094984300376299007,5774120615099958552,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9428,i,687659730722635102,16352835906275650319,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9592,i,11418947901041658722,16073680979981980924,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9800,i,7548763372413674440,7444008093494977995,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9828,i,12165263788083760074,15638942719203708650,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
      4⤵
      PID:6968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10160,i,6914855022859532906,7963620401900302375,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:1
      4⤵
      PID:7140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9976,i,18143614578797735359,10867746570555868770,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10436,i,11882340578020720713,11695965219607284201,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10452 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10676,i,5474235643659837899,7749360348664164916,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10612 /prefetch:1
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10504,i,17582818941189709673,1570315624565291285,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:14
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10504,i,17582818941189709673,1570315624565291285,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:14
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10916,i,4840904034227734008,5420587122192436882,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=10944 /prefetch:1
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=11104,i,11774150664184538777,2221196626036222501,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11112 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11256,i,423482729497530632,10117114342963133993,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11308,i,6898936516470258302,13233155559838074064,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:1
      4⤵
      PID:7456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11628,i,12377598147057543634,5251890182844441055,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11456 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11656,i,1184477007465646118,17520840210394759783,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11620 /prefetch:1
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11932,i,4911698255216041720,2461971319838960580,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11924 /prefetch:1
      4⤵
      PID:7844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12220,i,18058644720622499457,2648888423746372610,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12360,i,15332712188081133193,7958835253755501349,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=12348 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12548,i,9753627812317940051,14782021032194871037,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=12208 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12712,i,15219123586959373548,5408776684100949338,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=12620 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12896,i,629653088724702761,1746355198494674431,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=12872 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=13076,i,12124466038873468560,4508043694239030145,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13108 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=13224,i,7450316252907102985,13327721892176463637,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13236 /prefetch:1
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8732,i,3929704153725942554,2616153608670294834,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13448 /prefetch:1
      4⤵
      PID:8292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13592,i,13011812650132505946,7976305091133284890,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13576 /prefetch:1
      4⤵
      PID:8416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13660,i,14645167047619713003,1507698226555766118,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13784 /prefetch:1
      4⤵
      PID:8512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13948,i,17349571325917726144,8271468834025504455,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13952 /prefetch:1
      4⤵
      PID:8692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=14044,i,183064970422405812,17470033662467252912,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14084 /prefetch:1
      4⤵
      PID:8788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=14256,i,14444317230806166178,6698443583476233194,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14248 /prefetch:1
      4⤵
      PID:8888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=14432,i,9246006353263260940,16854771323232159794,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14440 /prefetch:1
      4⤵
      PID:8996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14640,i,5008143982394980603,9634607256547093936,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:12
      4⤵
      PID:9888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14696,i,4670724854617827399,12223540396637258927,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11704 /prefetch:14
      4⤵
      PID:9848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14644,i,3324945270374733279,8022592860252875129,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14776 /prefetch:14
      4⤵
      PID:9924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=14844,i,12446910160306930209,7338976348081705042,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:1
      4⤵
      PID:9932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14840,i,14848936799472184891,13447111181897903465,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14796 /prefetch:1
      4⤵
      PID:9956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15064,i,14175839569776579270,5099395451250335202,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15224 /prefetch:1
      4⤵
      PID:9980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=15148,i,12789348394871481012,250697083796846807,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11788 /prefetch:1
      4⤵
      PID:9996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=13372,i,16082422375029145271,1876018047774793037,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14164 /prefetch:1
      4⤵
      PID:9964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=14572,i,10838917483544948559,14107953046872660111,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11716 /prefetch:1
      4⤵
      PID:10012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12912,i,17312623164521963068,4205060484748028435,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15264 /prefetch:1
      4⤵
      PID:10020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=1276,i,10346993082097850938,8578714685217669160,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15372 /prefetch:1
      4⤵
      PID:10008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8940,i,12205809588800045797,13484787747721193549,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:1
      4⤵
      PID:10044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,2934372195477345234,16404036358854553530,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15476 /prefetch:14
      4⤵
      PID:10036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=13836,i,4441741555607486168,4675017586225252279,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11724 /prefetch:1
      4⤵
      PID:10048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8096,i,15804412006637273631,8264542075437019755,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14236 /prefetch:1
      4⤵
      PID:10072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8168,i,13829679538750069280,3094884857020084285,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14196 /prefetch:1
      4⤵
      PID:10088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=14664,i,924513344497944944,7954582982883940012,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14780 /prefetch:1
      4⤵
      PID:9972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8180,i,9867867452400143640,11113547296128442848,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14232 /prefetch:1
      4⤵
      PID:10108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9260,i,9485567108761407433,17995791301046308391,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15296 /prefetch:1
      4⤵
      PID:10104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9292,i,3119640748754538466,15273059517876395191,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15316 /prefetch:1
      4⤵
      PID:10116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=15012,i,11303142682722635877,9773532007272441690,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15212 /prefetch:1
      4⤵
      PID:10124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=14892,i,13852291621011722081,12332055050949115014,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14100 /prefetch:1
      4⤵
      PID:10084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=11964,i,5007636181742792722,7110884361080270692,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15244 /prefetch:1
      4⤵
      PID:10176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=15144,i,3341307982329217682,15826271792564255498,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14200 /prefetch:1
      4⤵
      PID:9988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=11624,i,14832755458589650233,8952012641855476775,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=12156 /prefetch:1
      4⤵
      PID:10180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=740,i,14802909385595124475,18384538050725457781,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15844 /prefetch:14
      4⤵
      PID:10156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=13100,i,2523543952480445463,4777351549900641676,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:1
      4⤵
      PID:10172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15164,i,4546225466181377796,12830021682590277829,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15856 /prefetch:14
      4⤵
      PID:10192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=12884,i,2935729697332074711,7234727514043214115,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15968 /prefetch:1
      4⤵
      PID:10200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9032,i,8418526648887792341,16879288619879690442,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15972 /prefetch:1
      4⤵
      PID:10164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=7588,i,10751588615975019588,13833416575405014795,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15988 /prefetch:1
      4⤵
      PID:10236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=8996,i,11415955525722157277,11138423088576524374,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16000 /prefetch:1
      4⤵
      PID:10232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7632,i,12353814067683361478,5746657664861521056,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15976 /prefetch:1
      4⤵
      PID:10228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=6616,i,9230626067848451137,11192957370760051497,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16116 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11632,i,2057552963300423977,13990451756942565077,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16040 /prefetch:1
      4⤵
      PID:9220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=12168,i,13805962851369648181,15077534129255510819,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16172 /prefetch:1
      4⤵
      PID:9340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=7508,i,3038402711817651476,6878663130746835457,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16192 /prefetch:1
      4⤵
      PID:9388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11644,i,457254014671467676,10485844736523169026,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16356 /prefetch:1
      4⤵
      PID:9524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=7592,i,6131476953754152068,4613192611825476164,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16020 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10216,i,12555515731316498089,11271121939429111845,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16372 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10388,i,9533659565142704455,16221808401633257804,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15896 /prefetch:1
      4⤵
      PID:9644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10420,i,15776391872705278538,16807344477743945560,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15848 /prefetch:1
      4⤵
      PID:9604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11772,i,5183396262231742088,12915267072171805683,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16428 /prefetch:1
      4⤵
      PID:9596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11988,i,5517032221804780513,4166642367877628435,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16412 /prefetch:1
      4⤵
      PID:9624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=7352,i,10150833060646117960,10330290433107659313,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16068 /prefetch:1
      4⤵
      PID:9332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=15196,i,730829075954022728,10229507182473403175,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=15888 /prefetch:1
      4⤵
      PID:9268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11652,i,5524947079884829871,3570914765757615042,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16132 /prefetch:1
      4⤵
      PID:9276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10372,i,8571333413021439479,13327234628998069932,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16360 /prefetch:1
      4⤵
      PID:9516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=9036,i,12257847072362670643,10281241250967353749,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16088 /prefetch:1
      4⤵
      PID:9264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=12132,i,5919930174503735114,6254644260883989207,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=16152 /prefetch:1
      4⤵
      PID:9256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=21020,i,6619857362951308793,14751604104919595776,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=20996 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=8180,i,4682184833145551376,3036252120122186673,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:13068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=14864,i,9775196764673315043,3941566354753624302,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=11992 /prefetch:1
      4⤵
      PID:11876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15884,i,3361160268165896474,654690378482338935,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=14720 /prefetch:14
      4⤵
      PID:10508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=21012,i,4443829255973136917,11503926320219547185,524288 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23460 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=22032,i,13048703862219236282,9897976756332842376,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23472 /prefetch:1
      4⤵
      PID:8960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=21976,i,12029090930851429746,5705696447311549808,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23348 /prefetch:1
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=6476,i,1352667532222031388,16942257488538902199,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23484 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=23368,i,12151760632907060671,14674946248595538280,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23496 /prefetch:1
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11692,i,16446481757696124801,2047572460908873489,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23476 /prefetch:1
      4⤵
      PID:8224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=10664,i,17213207593702321237,15117833100158254994,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23560 /prefetch:1
      4⤵
      PID:13108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=6232,i,82181296649380040,8716247430180844150,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23516 /prefetch:1
      4⤵
      PID:8940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=6432,i,12870278971112045565,10970143193343432086,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23536 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=11076,i,3705861250027915480,8171062974900176600,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23580 /prefetch:1
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=4768,i,16673365663509842838,17906530873391554784,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23660 /prefetch:1
      4⤵
      PID:12088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=4744,i,12659107564824019248,13898393608404116706,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23680 /prefetch:1
      4⤵
      PID:11924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=6452,i,8567327624676542285,17289139393307963191,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23600 /prefetch:1
      4⤵
      PID:9928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=4788,i,17601432149227236914,17576121589628470925,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23640 /prefetch:1
      4⤵
      PID:10988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=10008,i,14474045365026275947,6704248282673920977,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23620 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=23364,i,10401476590309763313,1205199782737264737,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23720 /prefetch:1
      4⤵
      PID:9872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=9584,i,1174679754607758879,6964738907691019518,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23740 /prefetch:1
      4⤵
      PID:7328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=4796,i,3813628336002070909,17707310141520495841,2097152 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=23700 /prefetch:1
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=25512,i,1688714049634305843,1051494424938026299,262144 --field-trial-handle=2336,i,7212215776297802955,15665673541333112692,262144 --variations-seed-version --mojo-platform-channel-handle=24404 /prefetch:10
      4⤵
      PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5884

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe
1⤵
- Executes dropped EXE
PID:5316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe
  2⤵
  PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe"
      4⤵
      Views/modifies file attributes
      PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4092

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1176

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe
1⤵
PID:540
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9n57l1v\k85032mx.exe
  2⤵
  PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5572
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe"
      4⤵
      Views/modifies file attributes
      PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe
1⤵
PID:5036
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3oc2nfvy\6trwppvl.exe
  2⤵
  PID:6328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6476
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe"
      4⤵
      Views/modifies file attributes
      PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6280

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe
1⤵
PID:6716
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1il7lwxp\7avor1je.exe
  2⤵
  PID:6988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe"
      4⤵
      Views/modifies file attributes
      PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7784

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe
1⤵
PID:7900
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\12w8ypud\1km5jj1u.exe
  2⤵
  PID:7996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8036
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe"
      4⤵
      Views/modifies file attributes
      PID:8116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8064

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe
1⤵
PID:8060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\14x18gz0\na2aginy.exe
  2⤵
  PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe"
      4⤵
      Views/modifies file attributes
      PID:8196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8872

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe
1⤵
PID:9156
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q9ljncmz\bulc6dv4.exe
  2⤵
  PID:8220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe"
      4⤵
      Views/modifies file attributes
      PID:8688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8712

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe
1⤵
PID:9200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg4vcrzl\poasdst0.exe
  2⤵
  PID:8308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8424
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe"
      4⤵
      Views/modifies file attributes
      PID:8668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1800

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe
1⤵
PID:1972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzx0izwz\3floysly.exe
  2⤵
  PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe"
      4⤵
      Views/modifies file attributes
      PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7720

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe
1⤵
PID:5800
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l9m4m56v\ie2e894t.exe
  2⤵
  PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe"
      4⤵
      Views/modifies file attributes
      PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5608

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe
1⤵
PID:4064
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6799kn09\xwxsf52b.exe
  2⤵
  PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe"
      4⤵
      Views/modifies file attributes
      PID:9296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9624

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe
1⤵
PID:9728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rspqi9z\7xgvnkk2.exe
  2⤵
  PID:9808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9840
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe"
      4⤵
      Views/modifies file attributes
      PID:9900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10216

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe
1⤵
PID:9312
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmlf0fnn\a9zuuyst.exe
  2⤵
  PID:9396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe"
      4⤵
      Views/modifies file attributes
      PID:9604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe
1⤵
PID:11516
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yslyvd86\x7o2f96n.exe
  2⤵
  PID:12176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12084
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe"
      4⤵
      Views/modifies file attributes
      PID:12548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:12148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12276

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe
1⤵
PID:8640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vro0neje\uwt2ogsm.exe
  2⤵
  PID:8708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe"
      4⤵
      Views/modifies file attributes
      PID:9544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:10476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:12272

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe
1⤵
PID:3236
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ba784hr\qtnwvv3l.exe
  2⤵
  PID:8392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5s16306\8q5bkbvt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:13852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 281KB
SHA256 cb269e30405c572eb6b76fbb1d2047b97ac4dfc4da0799fc8967d9087e8f9a8e
MD5 f6904b380188ca8078f603c58e272d6d
SHA1 324786a60acae1b784c5fa9c1c0201d87da68bdb
SHA512 57fe98e54fec69745dd6f12f0cea06cc2d9503c24331acb717c0987b65cf40c5babad6df733547eb1a1834de2d2f63e84d98566fca8f01f444077caa3a19c6b4
SSDEEP 6144:RG9drdcaZUKyLIXg+TdYgdaOUxkiglJihfXCJPUjNyw4ifzmFdxQjDZZ:RseaZUQX1ZBdms8fXWQwwdoaPb
TLSH
T15E54230AF3D82950455D7D822FC9706563E6B715AF3303A7CED5FABE1BCE1201ACA648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 74KB
SHA256 d63c747272725b59b0c90ebd0576149fa7810e98ca4d197f30174143be5d22f7
MD5 793cd134a25459406443a33614d11956
SHA1 5e82eb468ece4317dcb7d36c2e88f9a04e13bd5e
SHA512 079dc319a796c1e988fcd9dc0e56a6b4c0ab696d1b2241eb893a5386459971313ab8c60094fe56e9243c362aa7f68eb4b9911529311246ab0f50395a4e45e345
SSDEEP 1536:o+Rwd2OmpJgS1Ew1eEggug5Hwwf6XHuzgtw34A+7RfJ6LlQrzofGx1uP:TRwd+Tje8TQwf6XOzgtwoJF8xQQf4s
TLSH
T19C7312FC4F2FB3B04A238A913E13A46D1ED081469B44636D547C049DBB6ED985D4CE6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 274KB
SHA256 ae7fc4ea675cf317f93207f69ac2b93070cb935453a7855a158d2a462c71eec0
MD5 ec0f91bc88d0196195e5d5eda0c34fca
SHA1 837201a2a152f2ae51ff8db84a983747aef80794
SHA512 3c9f2235d857138d2c402eb9de65965d7714890c47e33aa9827731c5ead7fdf1fb20da30bd12cc49145c5398d6fe394e03f490a64ef322f34c32ecac9032171e
SSDEEP 6144:pzOdFje0AzOVEhE8ogsParNFTLyYxm/Xixa7u8N0T:pSe02lPsP4jVxmfRXeT
TLSH
T13154223DF838D3F4AA53DAF929F3952B2030D5AE990E600AAD7CA87407D56552B2C730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 219KB
SHA256 da0086e36d11e350d17af1800dd62aedaaed14111dbcdd5a47acd04806e4acf3
MD5 fadddaa6962cad99c5d0dcc6c0a95391
SHA1 a5cbceae83b1c5e74aecdeb1c3bcd2d074785a56
SHA512 798c7543e23cfb34b697d294e2ebae0ce33e8e6042366fdfaf995183878c9a5fa26e6111087ad839b315937ebd5537898a42734ffecaabd36a958b3573742266
SSDEEP 6144:rYcBmnO2jalRQrwlni1LX5ECPoQwXPNvG/UYuD3:rHBJ2jqarwlwX5ECQQwXV6UYur
TLSH
T1672423D80255A55013E29D976C0FE943EDD3211A3037ABC79C4C5A5F844A9B7379FE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 85KB
SHA256 356791dc8df2bd016597e389c698885b7a3db7a7f3c03a6a47234183ecfc273d
MD5 4d3bc4f5900ccc2aeb4278f0a387a8ed
SHA1 70f4a3cd7b6dfa1014edcabb0a13b38fc6e7ea70
SHA512 52327874f1c9f43e760ade294173a2d8ea5d3faddb2812c8cf69307142c03f0f2e091283ff2b4e6acecbe1e7bed6576535b6b5935a902a10125b1a41f6a40c5b
SSDEEP 1536:EMUbzKhL8rOCCgRMP2Yki3EX7iDpNG/d9waJG0lSgZBrx81omtJrnP/1G:SbzKhLEOClRbJX7O2d9rA0RBrx8/tZPY
TLSH
T17783023CDA3AA361D9CC44605DF3BA36BF2E3D51D214A8EE8436385C513914CD2BA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 90KB
SHA256 6f7842d32b4ef7fd2890930630b2d896c17c3d84cbedfa37f63884dce18baf1f
MD5 e213a2b37dec848dc67acb8c3bcac13b
SHA1 06ebd6e94b4aa0a9c0730173581785c51cffd938
SHA512 5011fb63ca4f430e4b7d6f6794a2be45cc5089ec203bbba03eb74fc40d05db081cd40407ecf89b9cef401f33234eee3d49e74a8f1cbbc09da5a3272ef23499cd
SSDEEP 1536:oHCDDC9s882owhNH3VOJWUl4d/cHu4mUl1MnfSqQJL1xF8YijHBWZ:oHCC362xFEWtI1SfSqe3+j8
TLSH
T18C9312E3984523845E90291B7B50A74999712B0656B3A34BCEB7392FCDF5CE0D222F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 105KB
SHA256 48e812d854b3aa7776d401fc6f34fae29b1088e46dbf1dcd78ec13db64d68e9b
MD5 29f9e1c18192a1121fa5fad9615c6d79
SHA1 5248fa7f630b57fa5871becb45dad7b2f58ae8fb
SHA512 84cff919bf262713c97856c5257c4cd228f1a7ccf2ca0f54201860d1295f3ddf0a404d438e4320d192ae692af2541e396682dd23d2c9d4fcb02abd1e17c573e6
SSDEEP 3072:jm0RR8FYstRkmRYjNUUetU+0Q+FgPv47QlQdtxy6ZU:VRR8Fz+UUSmQ+F6wBdDZU
TLSH
T187B31362E7A7B7CCC14D94F6DE8D6952D05C6DD70691EED72182B132CF9630303868EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 47KB
SHA256 ad9b8a2b724b35673d49057d9d2c8b142e51c372b46551c6b24a3b60780e0f90
MD5 506e13c9777938d1ca46696f14f240c8
SHA1 b7de9642bb7d920961a2ed4b79520f6d8eea4d3a
SHA512 4816fd0e409b5c045984eccdef7ee5c7e9a0120b591a66b2f0136bc709e8991ee89afaf00d2ea2ed3f7c1eac89b51801fad020d888f25980d6dcefad7d0b74d8
SSDEEP 768:cPAo9p6Yz6d8q183Qfh/0VL/gOfXHMExTd/KhXkbY1S85btKZV0BNl:c5dz6z23C6VBXHx9Kx+sJbAZwv
TLSH
T1852301E553BA85E889F043F5699B37B0DF798CE886EF350C72A154A7578269128C2CC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 38KB
SHA256 9975fdb7f678ed86964edd7656cf357e3a77562f4de9489f5dcdb24a36ca1053
MD5 e5f803c2197cc53fc2005247404579ce
SHA1 7ffd0463471827ef94d5e917870bd9c7909bd372
SHA512 4e49fb285d9df0a420e0b67d4268061561cac2764078948697023119c61b5ac9adb3c8f4985b8a876b1bf052059b206e8509a4491b8bf5555c4b240c53df35b7
SSDEEP 768:7XAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+YL3DAc8ZmoYt+T:7wjkdV6H6AK+N+NBou65L3yZ5
TLSH
T18E03F262E5D572D1DE6C63F4FE8158E2D04FE63EC51E62D63326C6D038117B4CA0AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 37KB
SHA256 6e5cb713bd8e426c8c4bcbaeb68f921842c968eb78a569f8e13e301ce714c1a8
MD5 95d8e2c6f815501936ab45e4ce733f8f
SHA1 e1cfd1bdd30e7765d9781a72be2e9920ceb9405c
SHA512 03d82fa7d5294c93052bb2cf13d044ac66a729ca669da3c8fbbe9ae06aa54243f3ef588060793ea8d64b9a5ef39ac3117b2e30a4daa9ab566cd7cd636ff4116c
SSDEEP 768:naaeCsPsgjJIl2s83klYHNmySEC1FzR901HoptNK9uljFv+jCIevJgKu:n7msgGD83mYYRWIptNKsjFv+jCIevJzu
TLSH
T15D03F15E7254F018964B0532C41F8B8D5528FE84BBDE043E2C4972E6ED96DFD8A86C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 100KB
SHA256 a165e5ef1939c256b2ca8f2cdd5b3d2ffee5f25f9a4d81ad8529cd6ae219942b
MD5 b332202de15e3ef140ec56c4323123dc
SHA1 a540aa405d3368628179b903309168a3c767d187
SHA512 a4bfadb5a2e728c3ae08f2ac161d18aeb612a02bd1d682968af7204e8bc62a480fce7f61e00bd361eefaa7d149ce181f4a9ddb3e2e738b3db0a3c86fa2868187
SSDEEP 3072:PB2dojqhL7dTSCve1KV5o770t/NmY3HbF+UmjBi:cd4G4ce1uaS/ItPli
TLSH
T1FCA312448884CF1CEBE0D3809F1610A43D3E61B46ED36A9E16277ACFF0466D69BA43D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b13c6d1fdcfc5e9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b13c6d1fdcfc5e9_0
Size 283B
SHA256 c5923687e19dc1e6166960e0e83d7d3b051c0720d7131f52ffb05a8debe4d8b2
MD5 7566b1a701f06bc82baa87203e741c1d
SHA1 e1c3cfd03c35e5da1806043a92962c1b85ad1c83
SHA512 42fa4e517f7e8e394dfbaf3eec3853b66bedfc996ff969b43720f283180055c627e2fc6c5d954af1f2596789a448ff010324c37211507b0e782fc28e5930d30c
TLSH
T17FD02B9F641850ECEED94AF0C77B6365E713CB550C1C8197900795B53787970758A451
MD5 SHA1 SHA512 TLSH

Submit Download

24584c5912c48b9b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24584c5912c48b9b_0
Size 270B
SHA256 0b40a3fc196e0c2cf5fb4b9bc7d3774165ffc63cd66822e1cea17545db09d892
MD5 67f55acf71c6fe2ca34edfcaf942dbca
SHA1 8d4f6279071629c314d618ec18044e2ed531a277
SHA512 99e095d526157000cc9eb1bc65a07c0c440d9e59958ea3c734b0b7b4ce879849daffebbf0ba110050665ff525ab85a1e97c7ea56a2a2ed8db309be2c10c20812
TLSH
T1EFD0955F543CD4FCEE354FB4D5A56149826FDD7C449CC681410318B631570753955701
MD5 SHA1 SHA512 TLSH

Submit Download

4008556627003786_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4008556627003786_0
Size 299B
SHA256 7ee0d729219b8d807ec748e4818a44f1a4f063f2b4630d97842f8f0bec3f4738
MD5 41c318da63d01d00a405d9d7bc4e1db7
SHA1 32d79aca15eb390f7424ce1a317023c3f208f49e
SHA512 e41df13b8b2a53d283687f2a724a090d347bf6d3b87bc2c6175e68a5f8e4c0d15a73c156c5701faa847aa7f3136efc6fb08cd9806e47d61d8586be78f3656c4b
TLSH
T114E0EB33A80E0007CC384CF03BAA01885B804094581DE3830070A79A7C185223B081DB
MD5 SHA1 SHA512 TLSH

Submit Download

4d922bfeca7518f3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4d922bfeca7518f3_0
Size 534B
SHA256 2643e82320a0119a10e5e6148550ff2816aa6d757a985ab3516ecfe45cdd11a9
MD5 fe3c4392d01f7b927225b8bdedf382fa
SHA1 d5b7af8a2090f7078ba3e25b3d0f9cbdb22ccea3
SHA512 2e165610c01a23cb06fddd8fa04dbe5cf14e6d1aee15e1db20211680ee476f2c95d9cd187e97f046b75af245da9bcf01230e54f86609f1b55bfd4b2e9fcdd3d1
TLSH
T16EF0C0DBF508B40DE33D07F29EF6E2435543D1A7594CC2678615B192314BCA535289E6
MD5 SHA1 SHA512 TLSH

Submit Download

7b823e827d880928_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7b823e827d880928_0
Size 569KB
SHA256 3b0ed81c56c8c4b9636c678476f3dc4b1706032d0ead35934a09c00a0d222e38
MD5 b55e606569a7ad31e253f612ec82dfef
SHA1 e031e51153e3e611bebf6edd35ec93839a1f7a8f
SHA512 c742e135736af765cb20ece3777f55bc8c17c8e1795eb2805818f51226d4b04a7f990cf8748b6fce01d873db3c0dd286bca6185e0b16b62e57d385ec5b483e67
SSDEEP 6144:i+ubPQ4HgWbNlpAylWCWMJlTtnVeqQdQ7OvLom6EA5o20dfHLWCk5D:i3HgW5gyg6lJs0OSVLxD
TLSH
T1F2C4B5491790E995CF7A23F042A2CD53A73144486EC7E72371E8B7393C4A2E15F9A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce0df90b75c5c389_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce0df90b75c5c389_0
Size 1KB
SHA256 85e2f8623d209ac457435b3e03b7f8b4c95f91c67be64337b3dcaa3fe3e756a5
MD5 165f967889cf73b5690f3272af7d2059
SHA1 c678fae0bafd4fe4b5a4023f00a49fd3cb379a1b
SHA512 24ddff6adcfcb19a6fbb4af278d5d5769f9af17904f1f6d0eb1914ebcdc323b209676554659a332c497223f19404dc9674a67428ef7dcad12176c88bbb79bfc7
TLSH
T1A021B717BC941485C88788B277A3F9894B598951FB25F7C30120EB2E8D99456BE9811D
MD5 SHA1 SHA512 TLSH

Submit Download

defaa3302c98671a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\defaa3302c98671a_0
Size 284KB
SHA256 164d48008bc31ee4e78d0f6b5097786dcce38a1fd2467018c072ac8b4f479d5a
MD5 3750318ee01ec7776c7bcf17898f5d2c
SHA1 468b2efab0ba6d25421f0d535ad90ecaba4b8776
SHA512 6d38fcdc085ccb7075e8e14e9a7089090cd00a1bdac5ccae3b248ec973b34fd093625b39d1f71d95bbfa6c4abac95f0b21f1885111b39a9512795d591a0a09c3
SSDEEP 3072:lrCIob/2hahAOMZ2Q7qwgyjkkANkdEyjUq3I9Nz52v7yJCGpJtSfs:lrpC/CjgjkGyjUq3I/z5WfGpLSfs
TLSH
T17654C6651B90EE15CF7663F51262C953A73551483FD7D31372E8A33A2C0A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e54c6323c99c7b6a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e54c6323c99c7b6a_0
Size 195KB
SHA256 e2d24f8d3111feabaf823855f935e250353670274d60a432d066d8a6c4ed1db6
MD5 5f8f421d1aa6e95a811927bd68d2bddd
SHA1 314c353298c3e6edcf9ca1a92b52553c14093881
SHA512 9c263c971351920b328d2ea69fc7e9656938007d24dd997bc94bbc9d80fa02c4a85d2c154a2ad915125774c26b77ca479b48cb911ba7c47cf652225d63867890
SSDEEP 3072:75Eg2UVd+U7wBXIswPTq1Pn8+ZyQtOKTzrzvYsUcV:VE6iBXI3LMPntyKOoqc
TLSH
T1BD14C5465790A945CE3623F541A2C993A73184483FC7E72370E5B73A7C093E29F9A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4b8ec2ee0801563_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4b8ec2ee0801563_0
Size 3KB
SHA256 5843b7bc72b1da3ad65bee6924f5cb926ad85282172dae755658e490373b1d13
MD5 6f9ebccd97476141e2ddb89588ad7eb8
SHA1 8ac46a9e2e9aa5bb0694287ba05546a156ed6569
SHA512 55170ad58263b18e6d596fc7c6ce859c6e8e7c71022466d06d30456fb2007f3280d8749c67525f6be79bea81fdcec58a9b743301da081aebcc49a1d93fdaafce
TLSH
T138513BB6764F8C71C187BCFD8297D384D3053EA5235BC9879043ABAA90588E79288A16
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d1bcb866c0c0f50c73cae5b05274ea1dad732290489893f26530838786b24c68
MD5 fb1ed9373a95f3e1f6a662d5f3890161
SHA1 e0f5e09cad5a570005b78dffeddca904daaf61ce
SHA512 4b1af1c579065946a970dfcd21f0785af4ce5c5599e38e48c75cfe64a7c2c4082ade14e5234f7c50a0845c80544ddce4c9dd2d1371492c5520a2cdb9da29d269
SSDEEP 96:Fo5tpC/aysoBpGrv2e8KW5HbsWl7z6TVg0HGUXeiFh+2KBHzZp4PH8B:65nXoDu2ZKu4WlKTVg0HG2FsPTZp4PHe
TLSH
T125028621A7DFB6D8DF658B7352985C4725F18C24010FCF238A146CA2A89FFD46CD246B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7c65eacf7458875ff63689732219c8e952dfc799d90faceee1527c724346bed
MD5 02e31c94fd5a598edc065111cea8857c
SHA1 cfb4082fec8341deb49902d90cad71c25ff6f3cc
SHA512 c544865fe45756583c3c064ebf8ace5ee031c8f132f1fd8443d601487fcb2f109c29503be395adc325f46f5071d023c08b5a3c34be9b1e44553fbc955fed2faf
TLSH
T1BF611934376DE8EDD7291AB323E864483EF490761807CA00EB061DF6C8A6F049CE3863
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d836.TMP
Size 3KB
SHA256 0b3a042c6c05d44023f476c18aee839ee276a9b9cb94eecfb1e5287ee2019c61
MD5 bc680f396bf446d77d791bda50f69ae7
SHA1 8bbe20e8f9bf1596affc0ba4b2d1a4cd3068c249
SHA512 624aca33abd836e57636e39aa4c52b3507021df5e84c3cf512071b9a20383677b993d2752eac0e013474b5a6838d85a7bab07a7bb0c3cbc5d6339f30a9ffa430
TLSH
T1E5510734336EE9EDE7695AB363E054883EF8807A2447DA00E6080DF6D9E2F045DD3863
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6e30e8a96a1263402f316f15d0a13c9948c8ab0268e0c109ace161c41e1a1554
MD5 eb4bab7315086011fec3f27305cdeb00
SHA1 a71cd84124cd6211f397ca117abd7ff85dd7a972
SHA512 964f1f0df30b8f6f9a0e336745e8a38daa735076940f0f26c8de1cea89ed759b608fc2e088cedb51cd699e84404470d5d53db50d1c1dcd34fca59f3bba493920
SSDEEP 192:DmfKMJAtXiZ6lS7/Pz2pgQik0HEbvSvH5OkvVFeSzy2sbUMbB:DmfKMJAtXiZ6lS7/Pz2pg9k0HEbvSvHC
TLSH
T1B7E1BAF783E5862D9D115AF4AB056E2FCF590924532C396A89D0BF2BA7E3430E101B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b0ea1ed43acdfdaa61a8979fda56637f1ee227624a4e830c225d9cd211c2ace6
MD5 c53441cc4a289f984a60af26bce52553
SHA1 980006a32f3e97a9ac3593a4d12bf88f8d220fb2
SHA512 2385047cff03c214ccb5be5c68565a293b2e834caacd89b95a23037ce551134567be48b7a94ec98c343b8a154ebfb3fa0c01dd5f63e5045bcc00026e5b14077c
TLSH
T1A821CDF3C3E8567D890181F867182E1BCE2D0815832C3E5AC8D4AB5BA3E18B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2ae6e8f717dbbc2535c9693d064c6a7cf081004b15653b49f81cb36da4a8316f
MD5 d677d356c1557b9df4e9cd9e6b9e537f
SHA1 7accd71dc5a62e0e1ec9bb5d00de7c9d8b361f7e
SHA512 2989c9a80b7d44aebfc98fa9f9ac592d1b39945ed8229d4417fbed23566cd07189cdb960874fdd88c3939bfe0a60c45af08c437705564f973fad9b98e11eb89d
SSDEEP 192:DmfKMJAtoXiZ6lSyPzhHvSvHOVSbGkbve0Qihk5dNgyKsbFbrW:DmfKMJAtoXiZ6lSyPzhHvSvHOVSbGkb1
TLSH
T180E1DBF783E5822C9D1146F4AB056E2FCF590924532C3D6A89D0BF6BA7E2430E101B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 13b94a047f2b555442a279d732c464428f1d437a083215e15340d7cc8b39e7e6
MD5 5c8ba3e7ccc6b75ee309369a9fbf60dc
SHA1 4875817f79c56f87a0201983551d60fcf96d384e
SHA512 b2e31f3db47bda2b045192f3f39c033eca7632b3bb34994e2a87d51daa261b82916593cddf30237fb88563860819a141f2c366bdf64413eb199501b3c3d156b8
SSDEEP 192:sxR6RVCv/fUsoFkKCA94/yzoA8pMsSOFEHg6+WNsE1zrYpYBu9d6SaG6nJIgVLJ:sxR6Kv/fUsouZ8IFq5tQpySw1P
TLSH
T1B142C8176928693B4CDBE219FB15BF63D2FA6063A1D01E54A6FC9A1C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8207adaf6e87940f80d700ab6f4ee861ad0cdbf47ae822dc9daf619f1637c98c
MD5 8e3609d3ec4357c2f3af944424eeef39
SHA1 f4e261395d487f4ee287d1014b09263ee3733128
SHA512 a4da5a35b1380a1612f0f5f3e773b553d9919f59f4228ac24a52a4c781e9c5ca52715ede0ae2a055895b15f1d6eb110fca5591a1707f58af05a77e0ffac80603
SSDEEP 192:sxRlRVCv/fUsIF/KCA94/tzoA8pukd4SwFEHg6+WNsqlLT4D3EJrgpYBcw9n6Sa7:sxRlKv/fUsIlZ8N6q57Y4epzSw1Z
TLSH
T1E252F716A9385E7B4CCBE218B615BF27E2F6606390D01E54A7FDDA1C00E76DE620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 085ed4c6e4f0687279ae531f85e95622b50fc2c430ea5f0819e47e4f06206daa
MD5 b585b1ebe3e8685a93281cb19f4cb663
SHA1 82e32cca477d44b2efba965123141d6f79772091
SHA512 6dd1224ac1f04f59c6211893cdf4e107b814270002c48d0e1a70e7e724edd297f74ddacee493e6bfb79e232bfb3cf96df3cc862536f10060b415f4c131089938
SSDEEP 192:sxRlRVCv/fUsIF/KCA94/lzoA8pMmleFEHg6+WNs/0jO99m1JSJZYBcw9A6SaG6/:sxRlKv/fUsIlZ8fyq53kGOZ4Sw1Z
TLSH
T19552F91669385E7B4CDBE218FB15BF23E2F6206390D01E54A7FD9A1C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9ef614c92eea6e9fae4a981282fb5d4c90365fd6f050716402f9d596b8649326
MD5 34d8791dc33616b0be51832f4cc9265e
SHA1 f08c9924975c146eb61fead363830847ca2a98d5
SHA512 30cc92c497c6b866c06664acf9108fa48b62382d0c10dbdf6f3dd7ef8a8b65d3573bef0e5a8fb72c5cf512c247d0c16a4852562747284c8186dfc0a87f1fa6ff
SSDEEP 192:sxRlRVCv/fUsIFkKCA94//zoA8pMhlFFEHg6+WNs7oCDUTJ5efYBcw9I6SaG6nJP:sxRlKv/fUsIuZ8hwq5KP42f8Sw1P
TLSH
T12852F91699386D7B4CCBE218F615BF53E2FA6063A1D01E54E7FC9A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 76817d60fb49d22d47ed7217d6ec32cf7b794da2b9dd04a74170575847eb4b49
MD5 d6a1d52c80e123b6c01cc8268df9f0ea
SHA1 04ddddedf1341d742c1b304da3d1a088aedc5a9b
SHA512 af2ded497bf111b3fd06b35ca8e719aa2fbc5ee460af4e3a2c419732d0e3704ca5d0fc5452c6bb997cd52c91b72cdec7f3b5080cadd5a689f5d7a03b4f5041d1
SSDEEP 192:sxRlRVCv/fUsIF/KCA94/6zoA8pMCleFEHg6+WNs/0jm1J5efYBcw9s6SaG6nJIg:sxRlKv/fUsIlZ8Qiq53c2foSw1Z
TLSH
T18252E916A9386D7B4CCBE218FB15BF23E2F6606391D01E54A7FD9A1C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 04a9d58210a4222cb83d5070ce0dfd52fd6b7a7e6e83c941f3a0f8787b09d04f
MD5 8eb44a67f1979561da9178eebb4a88ce
SHA1 c0cfff37cbac1fcf6de99f3734a49d3cd81c11d9
SHA512 df306e00717eb6bba85c6b6312068be334ad79b25d309b1b472c6771e1808b1d45b5678cccf97b15a71731e5c19a2f5015acef26ffc117b47e89df2d04ae0d5a
SSDEEP 192:sxRlRVCv/fUsIF/KCA94/gzoA8puHd4SrFEHg6+WNsqlLkIrB3EJrgpYBcw9g6Si:sxRlKv/fUsIlZ8sgq57LruepgSw1Z
TLSH
T1ED52F856A9385E7B4CCBE218F615BF23E2F6606391D01E54A7FCDA1C00E76DE620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4129072611655f56b127af53ca0b6e2dafc0702a0754f0e395af3bb4e431fc8b
MD5 bca27a9dee0785894999ea86d8ed4d90
SHA1 d5f28652dde36087a7beed4fb0985c7aaa063a94
SHA512 6b5ce60a9f8967699aa593aae63c16f78dc01987a60ea995854f1a1c2a645b09cd8fb2bffeb984555c35bc1e452782778b784bf3baaf6053e60d5bcd7aeacab1
SSDEEP 768:azfWML7pLuL7J0Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJc16JropLia3xT:azfWMdE7J0Wg/Xf7fu1ja+y6ipLV
TLSH
T164C2EA7B640CCE7F4F800ADDAD197E9B6D6802CB9698CD9047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\d2288416-c842-4480-9c8b-09bdfa8f47bb\index-dir\the-real-index
Size 72B
SHA256 d18a97e81b6e381f1d604fa2bd5789299900bff785bcfe00b2c63ff2607de927
MD5 bb500dcaba1739be63d47797d12b5ed7
SHA1 24f40dc4effe8b95e0f68ad83ba528950f5cb8cc
SHA512 7a67d24c108afdb03d1f5fc3595bcc42a655c04ac65270526caef78e98dca0b2418a2c9a50b2c8eb88bf73765ee3c3d42c40ccd3753592562bb3ade7da1fb629
TLSH
T16BA00228934C6509D06DC7711559025162549D5101473F2148D91055DD626C4C1054A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3b26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\d2288416-c842-4480-9c8b-09bdfa8f47bb\index-dir\the-real-index~RFe5a3b26.TMP
Size 48B
SHA256 27e1cd2a590ebe9692c27fe4e16d2ce6e77cada39ca2dd2c16bb7bb2cac8eb63
MD5 efab6ab556a87badae8ec48e97f97a2c
SHA1 5d198f46121df1ac77e33f79730b2baafc06232a
SHA512 c75b2bb8214187d79fab474e8305826fe2f079d4b16947bcc2513292ffb51a7a4c7291b37ec95ee63a49aaa3b48762e540df5c4d39945358162ab1cf899f9a9a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 647d7f6793a3e04b7d70987791c82558ba50655375b305fdcaf0cf4c17fdcb10
MD5 13b82627f96a8d12432b7b8e69ce739f
SHA1 311961b985fe229337b4e68f6a79639aa4c9bd8e
SHA512 c04dd92104baadd91f94dedcf4513952febafffee9317866d44760681062b1f1b72c8c3640f381a21c8bd97a786490a99f6d5facb904a4a6e8a104b021b6450d
TLSH
T1D9C08C6B05A6C400AE71AFC034B973145F639888FCA2AACAA44222CC4A208730861FB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a3b45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe5a3b45.TMP
Size 165B
SHA256 c5f134f58f9ddfcce7d26c294267537ad8898f670cd596e61ff46b119a76c0ab
MD5 6f76086b5988b1be05c923162c180cef
SHA1 902aa35781e762072115e672662a1702e0f95382
SHA512 9e9f2d378fcf05c120f767017efb92d4a06d9c7e06fdf2a6d838d424921439ed56457b6227afcd77b37850efac4ca612e099f94ab0ab04f492833eb5c914f1bb
TLSH
T197C08C6B0566C810AA716FC074B867044F639C80FC82A6CAA88332CC95308734854FB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 c37daf02b3b08133d4a5c03593e744a2eb156d1ee329234857bc9737b5541302
MD5 41815f9eaa7c122dcec20787a322573c
SHA1 1c7931529887c731ae58fc52024c03e4e7896870
SHA512 3e638c52ad52df236f150611b85f8fbf621d163ff282863ecca4e8a25931dc9daae7cd1225efc2e5f63723c85025006279e6271d30beb833995aee204fca417c
TLSH
T107D0C002CC4C8348DC108B3620E311EB5334A8E8960E93ED412D304D3FF30920F97605
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3ab8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3ab8.TMP
Size 48B
SHA256 bdbe4c9194367c4f510fad952101b67e5b2dbfa868457ccc9daa6b2e4511ec39
MD5 b1b94193492fbec036031c8fbc2c8708
SHA1 8706e50bc07bd38a523f3c9b2378693ebdda8fe8
SHA512 7ec0fe50e21e872f670e61a4e35a0569ae27f6f3fe5422462e139c9293f71e18cac548da1ccc1e857915d7ee997977f54463518543364c57686de01bfef4b325
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1fbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1fbe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7f31a0c12e56a9434ae05be80412b8c00251905fde11ab14bf5a026772761668
MD5 7edf84b3815eb272b582f73e1a24c97b
SHA1 1c6efd5c92ca1679173a46b6b83eac9be2ef4e65
SHA512 cda70456091dff7e38e00ec26393e099621fa06dbf84b00ba1274e13c0a33fcc725097c3cc98b9d61444a46978de65290ae98198941bcdfee95d0e1834431f99
SSDEEP 384:njZcI638NFnJWaUXEWZlf8hyEG1bF22py2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:763Rdi0DrEnjN3Gac1FwojKgqmUst
TLSH
T1D3F2B03068659EB38CEEE386B5837743AEE15663D5D00FA4D5DDAA0D05836AC270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1e5d928bff7f0aa12cdd4f5a55892e1b2788e2a2974cbb777c767104b6bb4c1c
MD5 4c777e2e69ff8b414506ce4cc805dfa8
SHA1 577ce7dc1e18a26ed0dd2e249a137c563cfe26e8
SHA512 3693e5da93e03407968761c2ff54883198472b314c9bc64efff12bffcfedc4776bc22a62ea85e2c669795559884a3883e1d6c6b0d526f87a575c421c73fca5bc
SSDEEP 384:njZcIl38NFCJWaJ6pMWZlf8hyEG1bF22ey2rEoajo4cdR8eHhVODjYPNDUMwKeRK:7l3aDi0SrEnjN3Gac1FwojKgqmUst
TLSH
T155F2C03068759EB38CFEE285B5837B42AEE15663D5D00FA4D5DDAA0D05836AC230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3393acbaab77dcd46bb20762b0aaeab97b6ddefa733c5ef7f7fb34ffdd819e87
MD5 3e749c05655009c4fc610029d5a0a967
SHA1 0f9ca6cfdd437072262b60a883137a7bbd601093
SHA512 f94d48958523789fd89181c08b362f4fa6b6bd630ca30cc7805bb0589715487044d383e49b7ed0c54cf1b7a4180cbca6f1c60a3aa828feca8181c7c8738cacd2
SSDEEP 384:njZcIw38NFCJWa2QuWZlf8hyEG1bF22Ky2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:7w3n/i0urEnjN3Gac1FwojKgqmUst
TLSH
T10FF2B03068759EB38CEEE285B5837B43AFE15663D5D00FA4D5DDAA0D05836AC270F427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4110f27e13a5b14d4e9dc944d1ed5fb18b4e78c47c4ee4ab08706b597cc520c9
MD5 6298e739e9fdfa989b9a037be1490d09
SHA1 4df4ad82de2f9cb4bae8ec0884acb8e5713a7139
SHA512 593cda8e89033b0577d67d181072e913af113f50cd7db27a10f8ac67b7c5547a3d52f6772a7d62388f935423b07e77c084e075bb88806cd95d8f2cd4f11234a0
SSDEEP 384:ncZcII38NF0JWa66CWZlf8hyEG1bF22+y2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:KI3Jbi0yrEnjN3Gac1FwojKgqmUst
TLSH
T164F2C03068659EB38CEEE385B5837743AEF15663D5D00FA4D5DDAA0D05836AC230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a93f917afe0a646806a43f3f06b9f5ede098757ca3dbdec24aca4d7dcf29f0b6
MD5 bf3e777d992bfd7a8d161c34c203dc38
SHA1 8a3ee8348acb792220bbb3994a376cbe5410e28e
SHA512 b4b3a0f943e5c7887d69a9abc606690c3ce2249d78e3f7977d5906f0d815db53073c04e88a4950ac30e23ab6148f5246371b7355c3e3f5e22cbead6e443e7c73
SSDEEP 384:ncZcIr38NF0JWag9KWZlf8hyEG1bF22+y2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:Kr3sDi0yrEnjN3Gac1FwojKgqmUst
TLSH
T18EF2C07068659EB38CEEE385B5837B43AEE15663D5D00FA4D5DDAA0D05836AC230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 67682e2e0c0199347bd01efe7d2501e57141a1cf7751dcc8ad0d2b5ae24084c9
MD5 abb862f0c4400cfa1cf107ffa249b6cf
SHA1 ff4691532e2260a1bf94dcfa4e35ff7298c0de5b
SHA512 a22990ec70ca73c2a1232739872fb39f43c5abb6a832f2abd3f1db155337da6b38a2e661bd7e41ae867186f0fb1f7bd23d7313868628620cbfcd44f1731fe813
SSDEEP 768:rrv+4UNbdS33mi0yrEnjN3Gac1ZMeVH1SCz:rbsbg3EyQnjMa/EH1V
TLSH
T1BB03CF3669A88E738CEBA38571877A037FF4525386D40BE4C9CD6B0D06975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 84b3bb03f62c334b4a360ee1989c834c480d59afcb68a90be289efd277091d86
MD5 e0bfefa9cd949f6470843aa0c99871c9
SHA1 91142a1b3419f0da57ec67442a7e25f6723fabf8
SHA512 cadde62dc36845fd14e12d44da334527be3350784457fef1c96cb342980d14f2c89f569dfa3b33837445810a54f7d609eb45499415faaa7676d7c0eea0e9b9f4
SSDEEP 384:z6srv+89zHqlDNP9oidx38NFfJWaDNP8WZlf8hyEG1bF22ey2rEoajo4cdR8eHhd:Jrv+4UNbdx3q1i0SrEnjN3Gac1FwAH
TLSH
T14103CF31B9789D738CEBD285B1437A43BFE416A389C40BA4D9C96A0C05976ED270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7e814c5237fed1218f9b124e62129614ca29cf5fcebb8b75aa38ea7f8ec1a2ef
MD5 4580625fb30b304e68380259fd953f8f
SHA1 79e3772212ba18e934e88908a692f4bef19dd382
SHA512 6f42f4ce76ccb7781c2f8bb0bcd0eac70e9dbdfa9f7b6320679ed3ac95d2004ea64da528e61333e7223ab259055c345444eed0b31de8e4f6aaf93ae3e64247aa
SSDEEP 768:xFQw3Qwgngs2rEnjN3Gac1FwojKgqmUst:Aw3K2QnjMabfgRU6
TLSH
T1C2039D35D864DEBB9CFBA7C6B7467B429EE112A3C5C849E4DAC9AD0C00835DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa6ea14ede08eff050b98c7522f6c873ba5a3d18ad866515fefa0a0f79ed8b1e
MD5 54c896f2a949d87f196bb431e20a5d27
SHA1 83a58ef4477d38befa49768b80a9d424c302c653
SHA512 b4d4e9043d4b00ed650efe4357d476cb865c4d8e9ad71463449439fcb36de575fcf3ec919c8e975121f3874cce746c4ff7d65d7799f3544240daa5bb1d042ffe
SSDEEP 384:ncZcIn38NF0JWa6RsWZlf8hyEG1bF22+y2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:Kn3yFi0yrEnjN3Gac1FwojKgqmUst
TLSH
T1E0F2C03068659EB38CEEE385B5837743AEF15663D5D00FA4D5DDAA0D058369C230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 41bc9605d396d1000432e772e6b1d3c3b7c5441138116a53fdccbd1aeaa05d45
MD5 78356e2d4f41aec0ef4c28ab96cb8592
SHA1 c9d5ebfc2d42281e55a3a4f334834a8b16e89959
SHA512 939cd8ed80f7032506100f9a65ec92cfca1c44f359c96772ae2a2f651c92173dfc427df6e2c1f333396a718bba9ec3c7d50a0d76591149f92ef1c47279feb518
SSDEEP 384:n6srv+89zHqlDNP9oids38NFCJWaaweWZlf8hyEG1bF22ey2rEoajo4cdR8eHhVn:Frv+4UNbds3lPi0SrEnjN3Gac1FwAH
TLSH
T18603BF31B9789DB38CFBD285B1437A437FE416A389C40BA4D9C96A0C05876ED270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f780dd5f76eeeaac2e22c49cce01fd7a3a310377b5627ecf18690ec4d01e4a11
MD5 d4bf5026793f26f4ccdd97d4c188a9d9
SHA1 8c88acc41fb9791748a7f78b019615f5c055a34a
SHA512 99c0633411f912c6d03a19fbb46bca3bd2ef747b8bea7c45cd6fc1fdeb405a6b354d49faf3e6dec830958f4cc6943d0670a95f55aaa7ef35806e263c34c43385
SSDEEP 384:ncZcIw38NF0JWaouIWZlf8hyEG1bF22+y2rEoajo4cdR8eHhVODjYPNDUMwKeRsz:Kw33Ji0yrEnjN3Gac1FwojKgqmUst
TLSH
T167F2C07068659EB38CEEE386B5837743AEE15663D5D00FA4D5DDAA0D05836AC230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 1a042043a5b52bd720c3cb61e31082f2af849185981504ddb1f46e4ab27a135b
MD5 a08b05cccb16f41e80d421ea0d8bb8c6
SHA1 108bd79acc2156325510387ed1642e29de468b74
SHA512 39228cb22a1ee2a15282b45601dd2758f9e4ce42cc2b2b3120870df941881d6f1c9ebcf2b1e52376a8692b8c2a273d43a507543d0dc8060f581e3c17e632d78a
SSDEEP 768:lrv+4UNbdS34Ji0+rEnjN3Gac1FweVH1SC8:lbsbg38+QnjMabEH12
TLSH
T1A503BF3169789E739CEBE385B1877A537EE4126385D40BA4C9C96B0D06876EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 241df7418f47b5c5def0662e5b0d96f969bc4f1658921a45e4d00dfbb957b6c5
MD5 f07695cbe55c0308759f53bf7ccb7413
SHA1 214f5de84881e0ca3cff8ea1eb9621a22f57f800
SHA512 3bd78746aeefc02fa80dfc0c76cda4267f45ea0db9c9674955789b2ad3faeb5716b6d83d0bea19265e399ca9ccd4c6c642059531a3a731dc67409ab63e41f970
TLSH
T123E00113EB0106E6D02C17305087531823A3C17413D212074C4101B06C002510D32C92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b3a94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b3a94.TMP
Size 392B
SHA256 90a50d6862709aa237b83731ed865bdd6b4129c3760b3455ad8d7c57d0ccc02d
MD5 13e3e7b8224826f7ce7195aedee37fd6
SHA1 c3a7f2e4d1c11d7c8dd31cd110647b2570c82ba1
SHA512 26b875393dd571ce7e9b40928405e41febc6de5027d11cc56ebf7bed7a5590f65633907c5a2c2a07a0ffb963d360732f00e6c4bc6f89f1e2f1e4b51caf6b6e96
TLSH
T1CAE00213A30106EAD02C1330508653282363C274139213074C4141B06D002110D21891
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e430bfa1-cbfa-4c0d-a8d7-749919c08b59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e430bfa1-cbfa-4c0d-a8d7-749919c08b59.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

048af929-d790-4fed-b00b-d367ae0fb72d.tmp

Path C:\Users\Admin\AppData\Local\Temp\048af929-d790-4fed-b00b-d367ae0fb72d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\base_library.zip
Size 711KB
SHA256 61ef67a3043285aacb2a9903bfc04e8fa9e64c955b985be127b97f5de825b11c
MD5 90e4ba93e9a6303d4656675612df4e65
SHA1 fe256529591576ce2fa7aa89c550dfa9ec722014
SHA512 e7e10feeba3e23c6ba410737162a2e2119ef25fcd5a842c4cd5408348109920627cc0f0b9aea1e5de728f73a05ae214366d05c2ce3038a00eb69157330d88338
SSDEEP 12288:InfyEvE2osQNRs54PK4I1AV0cyhGoQDSaaxJCV0k11dh1:ufyEc2osQNRs54PK4I1AV0cvoQDSasJE
TLSH
T1B8F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17962\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2904_1563162498\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z2dby81n.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogadfj2q\z2dby81n.exe
Size 5.4MB
SHA256 b32c6d3d9333192ae25ec555ee75144f8bf124d87cbb23c2e9040ed1a63ac567
MD5 846e060d5a41c23cac2d24c441afbd87
SHA1 a1751f9c68b0f77c346b7ec12d661f02889145bb
SHA512 b038ad4c6442d14735dd694001053137ac45677a3f032d3d8fbe6807562c76eca62466186f32646c7064020546316359f51ebfce40eb4ce8373520d0e26d5696
SSDEEP 98304:gvLgtINFnICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkH8MaM66Pd:jINdICteErownP0oTcMsABql4A6F
TLSH
T152463304B3A809E2E6B3D13985665221D572B4254BB0D1CF03AC9B662F777E0AF3FB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads