44a59c2179e40552bf3f5d4d135b9e913a74a947e0d2bc4eee411f547e469836

Analysis

max time kernel
8s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260804-qpr2ms1gme
SHA256 44a59c2179e40552bf3f5d4d135b9e913a74a947e0d2bc4eee411f547e469836
MD5 f8c3d44fae7e6ccfdaded562b7ce5a40
SHA1 4d4271e1b93f6adc97d816944ce9d017287db503
SHA512 ab536505364e87427d4ed22276f89e4442b33415e0df505cf91c6df5bee5bf1f81e077592724a46da9e6a92afde8004a1a4cfc41ad3812923fff7942d98073ad
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRh:OrICteErownP0oTcMsABqlaOzv
TLSH
T1F8463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wbe2ao.exe	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wbe2ao.exe	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38tql2.exe	h9icln93.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38tql2.exe	h9icln93.exe

Executes dropped EXE 2 IoCs

pid	Process
5968	h9icln93.exe
4640	h9icln93.exe

Loads dropped DLL 23 IoCs

pid	Process
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe
4640	h9icln93.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\3bskgh9d\\6vt8mlqy.exe"	h9icln93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\nmttdkm4\\h9icln93.exe"	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8892	ifconfig.me
9542	ifconfig.me
11733	ifconfig.me
5602	ifconfig.me
5852	ifconfig.me
1480	ifconfig.me
1791	ifconfig.me
321	ifconfig.me
465	ifconfig.me
5226	ifconfig.me
5355	ifconfig.me
7258	ifconfig.me
255	ifconfig.me
344	ifconfig.me
4862	ifconfig.me
9361	ifconfig.me
626	ifconfig.me
1662	ifconfig.me
204	ifconfig.me
825	ifconfig.me
3298	ifconfig.me
3796	ifconfig.me
4372	ifconfig.me
4899	ifconfig.me
5178	ifconfig.me
5865	ifconfig.me
476	ifconfig.me
1971	ifconfig.me
2509	ifconfig.me
2546	ifconfig.me
2604	ifconfig.me
3067	ifconfig.me
3460	ifconfig.me
4496	ifconfig.me
152	ifconfig.me
3348	ifconfig.me
5870	ifconfig.me
5962	ifconfig.me
8391	ifconfig.me
7647	ifconfig.me
8554	ifconfig.me
8567	ifconfig.me
252	ifconfig.me
407	ifconfig.me
412	ifconfig.me
2476	ifconfig.me
2899	ifconfig.me
3224	ifconfig.me
3880	ifconfig.me
5294	ifconfig.me
732	ifconfig.me
11523	ifconfig.me
567	ifconfig.me
1679	ifconfig.me
2006	ifconfig.me
2964	ifconfig.me
3519	ifconfig.me
4889	ifconfig.me
7221	ifconfig.me
413	ifconfig.me
3279	ifconfig.me
7887	ifconfig.me
8168	ifconfig.me
8250	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4684	cmd.exe
6724	cmd.exe
7504	cmd.exe
2380	cmd.exe
6844	cmd.exe
6324	cmd.exe
7440	cmd.exe
2328	cmd.exe
6072	cmd.exe
1632	cmd.exe
5900	cmd.exe
6896	cmd.exe
7532	cmd.exe
4376	cmd.exe
7672	cmd.exe
7184	cmd.exe
1968	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6012	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 1768	6016	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 1768 wrote to memory of 2328	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 2328 wrote to memory of 5116	2328	cmd.exe	92
PID 1768 wrote to memory of 6012	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 1768 wrote to memory of 1212	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 6012 wrote to memory of 4136	6012	msedge.exe	95
PID 1768 wrote to memory of 5160	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 6012 wrote to memory of 2764	6012	msedge.exe	98
PID 6012 wrote to memory of 3948	6012	msedge.exe	99
PID 6012 wrote to memory of 5044	6012	msedge.exe	100
PID 6012 wrote to memory of 3948	6012	msedge.exe	99
PID 6012 wrote to memory of 3948	6012	msedge.exe	99
PID 6012 wrote to memory of 5044	6012	msedge.exe	100
PID 6012 wrote to memory of 1280	6012	msedge.exe	102
PID 6012 wrote to memory of 1280	6012	msedge.exe	102
PID 6012 wrote to memory of 1280	6012	msedge.exe	102
PID 6012 wrote to memory of 1712	6012	msedge.exe	103
PID 6012 wrote to memory of 1712	6012	msedge.exe	103
PID 6012 wrote to memory of 1712	6012	msedge.exe	103
PID 6012 wrote to memory of 4296	6012	msedge.exe	104
PID 6012 wrote to memory of 884	6012	msedge.exe	105
PID 6012 wrote to memory of 2016	6012	msedge.exe	106
PID 6012 wrote to memory of 884	6012	msedge.exe	105
PID 6012 wrote to memory of 884	6012	msedge.exe	105
PID 6012 wrote to memory of 4296	6012	msedge.exe	104
PID 6012 wrote to memory of 4296	6012	msedge.exe	104
PID 6012 wrote to memory of 2016	6012	msedge.exe	106
PID 6012 wrote to memory of 2016	6012	msedge.exe	106
PID 6012 wrote to memory of 2664	6012	msedge.exe	107
PID 6012 wrote to memory of 2664	6012	msedge.exe	107
PID 6012 wrote to memory of 2664	6012	msedge.exe	107
PID 1768 wrote to memory of 1644	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 6012 wrote to memory of 2932	6012	msedge.exe	183
PID 6012 wrote to memory of 2932	6012	msedge.exe	183
PID 6012 wrote to memory of 2932	6012	msedge.exe	183
PID 1768 wrote to memory of 3136	1768	2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 6012 wrote to memory of 1376	6012	msedge.exe	111
PID 6012 wrote to memory of 1376	6012	msedge.exe	111
PID 6012 wrote to memory of 1376	6012	msedge.exe	111
PID 6012 wrote to memory of 4732	6012	msedge.exe	112
PID 6012 wrote to memory of 4732	6012	msedge.exe	112
PID 6012 wrote to memory of 2516	6012	msedge.exe	113
PID 6012 wrote to memory of 2516	6012	msedge.exe	113
PID 6012 wrote to memory of 2516	6012	msedge.exe	113
PID 6012 wrote to memory of 2320	6012	msedge.exe	115
PID 6012 wrote to memory of 2320	6012	msedge.exe	115
PID 6012 wrote to memory of 2320	6012	msedge.exe	115
PID 5968 wrote to memory of 4640	5968	h9icln93.exe	117
PID 6012 wrote to memory of 3448	6012	msedge.exe	118
PID 6012 wrote to memory of 1492	6012	msedge.exe	119
PID 6012 wrote to memory of 3448	6012	msedge.exe	118
PID 6012 wrote to memory of 1492	6012	msedge.exe	119
PID 6012 wrote to memory of 3264	6012	msedge.exe	120
PID 6012 wrote to memory of 3264	6012	msedge.exe	120
PID 4640 wrote to memory of 4684	4640	h9icln93.exe	121
PID 4684 wrote to memory of 5900	4684	cmd.exe	167

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5900	attrib.exe
6184	attrib.exe
6776	attrib.exe
6492	attrib.exe
7604	attrib.exe
6196	attrib.exe
12296	attrib.exe
7900	attrib.exe
5116	attrib.exe
1132	attrib.exe
928	attrib.exe
7728	attrib.exe
6848	attrib.exe
7636	attrib.exe
7520	attrib.exe
8248	attrib.exe
7244	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_f8c3d44fae7e6ccfdaded562b7ce5a40_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe"
      4⤵
      Views/modifies file attributes
      PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c8,0x314,0x7ff8b90dc188,0x7ff8b90dc194,0x7ff8b90dc1a0
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,8319350261646948220,1356325447284043189,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,1029850629987563296,6570666238911077224,262144 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14000501782247712641,4818806839762527944,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,11209236878183932264,18014795311660290887,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,445467722686354197,16372084888775649248,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,11218462894830816136,11854847956290546856,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,15257035651772059158,8413739544143428159,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4392,i,5555787328226020265,1820059062523799266,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4820,i,1956742584929327176,16174536645638358860,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,8083240317899708545,7890896206250764068,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5716,i,12393940583743325110,5915253688063137672,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,1938703046511014879,16203730085942768564,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6072,i,8508286485893343120,9649146536598591430,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6244,i,16814467276224135781,8822253742606929746,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13135005741287461961,13140973351546081559,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,10107391108407225428,9467522334137062609,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,14286632307174758957,17445355924133329036,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:12
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6028,i,8612495520666766015,10544079084358028319,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4712,i,5454241641369172277,6725211812790842302,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5964,i,17847163102063919069,11145950117126748698,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5900,i,6445822587806767400,17494492985010510136,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7688,i,16970877901960599315,11045861863900697408,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7952,i,15501708398383779490,3299355182982775183,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8264,i,9691495449812327772,10804287324497247870,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8880,i,7234057600978977910,12166967706744080607,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:14
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8880,i,7234057600978977910,12166967706744080607,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8484,i,1652528640299799291,7403711173245798000,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
      4⤵
      PID:6604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8564,i,15339537186324474606,12790730457356009938,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8608,i,5058767700433901332,9491281083304878946,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8668,i,15924237948993319314,14268640220575760067,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7604,i,6010533414621531698,4674290535341853764,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8644,i,4460458011059733309,4705148655823294654,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:1
      4⤵
      PID:6948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8812,i,9575856729473964160,7341682171502680349,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8556,i,9578418977257909447,1154351631778396548,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:1
      4⤵
      PID:6740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9008,i,14089808265242029904,6071169775753996549,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8692,i,3453413977462919531,9666164240508099601,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:1
      4⤵
      PID:6996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9064,i,2889923881766339668,7651714212559495106,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9188,i,8866265141877245252,3835128129077397161,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9772 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9036,i,15371416394166589973,15486035075482051603,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:1
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9124,i,3120028892319516779,9185832595854831671,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9980 /prefetch:1
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7436,i,7625872452814113378,8567247740767460647,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9164,i,18084831365645083612,1235181210797854188,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8720,i,12752574140296413492,14968196923827978525,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10032 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8500,i,9589281653475272293,5313712900061572800,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8748,i,14381244271852982709,8388981253637915292,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:1
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9552,i,3094778873688992641,2926330309400472447,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:14
      4⤵
      PID:7072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8760,i,12819736372940498198,523150364220696302,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10036 /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7924,i,10122238725466415334,17637422816209885182,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10072 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9408,i,7550358091229689455,7895098170218081825,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4780,i,17935527410879652659,3157077788359555416,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11856 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4316,i,3562596195431927592,11902696081691539152,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=4760,i,16740842535074280450,18055551155519477534,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11984 /prefetch:1
      4⤵
      PID:9212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=4748,i,1523036328581684245,16866620447728904308,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11852 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4768,i,17933981322604440861,2260686376403162014,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11860 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9444,i,7486537331489963707,13904294350347925911,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11908 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9512,i,2759575989553054903,16781538360252456671,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5548,i,12358216094029244576,10144231436633562201,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9480,i,10292908342092182301,1852802760470247532,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12004 /prefetch:1
      4⤵
      PID:8280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9572,i,7857133763393257331,11731205996310790116,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12112 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9488,i,8118258107207945912,12714220555746016049,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9608,i,6350316955436462361,4771269117229321160,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9612,i,16502450586810756702,16388633770853770223,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:8432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9688,i,17366048220236601971,17387179024729880596,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12016 /prefetch:1
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9384,i,9956285393422992524,14540834687865545410,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11992 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9696,i,8300758065168717519,15045856377793613198,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12108 /prefetch:1
      4⤵
      PID:8408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=5524,i,17747845370428341138,9201504088453506080,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=11952 /prefetch:1
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9728,i,13799788049775434185,12210259854528102700,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12036 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9760,i,7935742290852949023,2770004060567839480,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12196 /prefetch:1
      4⤵
      PID:8220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9792,i,10858779065274222094,4190551416616389963,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12208 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9736,i,2952520618800914635,2265824702760446281,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12200 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10648,i,15273356686777427607,8498407537978724999,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14416 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10496,i,1823448025510202369,10913616548143623085,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14508 /prefetch:1
      4⤵
      PID:8576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10624,i,14107787225807534968,7089910599704221313,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14528 /prefetch:1
      4⤵
      PID:8064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10688,i,4279770606732022717,16656279402422627027,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14540 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10744,i,4761785393612535358,1708211905121498984,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14580 /prefetch:1
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10720,i,7308677020397875828,7558406151840557127,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14600 /prefetch:1
      4⤵
      PID:8588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10740,i,759198322642125091,3067790366315898542,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14680 /prefetch:1
      4⤵
      PID:8596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8796,i,486795798192186146,15816708191876283416,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14660 /prefetch:1
      4⤵
      PID:8568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8960,i,10853923018317607884,10897053352744546448,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14640 /prefetch:1
      4⤵
      PID:8604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10808,i,15678151835463831019,9625603381785784771,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14700 /prefetch:1
      4⤵
      PID:8680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10568,i,14510700881049769728,8458660253095781506,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14324 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10684,i,2442354913208226561,2438607400007583558,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14560 /prefetch:1
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10804,i,15714111198131387304,8059140565652665429,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14620 /prefetch:1
      4⤵
      PID:8580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11124,i,11539492307186388896,7470869879943534979,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15132 /prefetch:14
      4⤵
      PID:8120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10900,i,14582516634183967384,133333795268220020,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14720 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10972,i,15092344427034507341,13495868170374254505,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15012 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10996,i,2923818356054031873,2751569605784475458,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15032 /prefetch:1
      4⤵
      PID:8960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=11032,i,11067018134459764858,8645793517708343570,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15036 /prefetch:1
      4⤵
      PID:8940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11048,i,17973315038901987357,5845122358738570282,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15048 /prefetch:1
      4⤵
      PID:8948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11080,i,10977511398898183398,4533696283707316491,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15072 /prefetch:1
      4⤵
      PID:8964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=11084,i,17822147039732896961,17307423586463058001,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15052 /prefetch:1
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10944,i,9552539273409039178,1678311304153582219,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14740 /prefetch:1
      4⤵
      PID:8784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10880,i,13584500579983267373,16067846916909316928,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14760 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=1384,i,14528911735705722299,15743115816946308513,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15112 /prefetch:1
      4⤵
      PID:9048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=1280,i,13801323713258305171,2189963898949290663,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15176 /prefetch:1
      4⤵
      PID:7808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11112,i,8205354799564619587,18434531906337885508,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15416 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11100,i,15377547290629358111,13199298691307720829,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15452 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11096,i,2803284174965106188,2912845007447825026,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15468 /prefetch:1
      4⤵
      PID:9060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11420,i,15897805335653975558,141400946280079276,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15664 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11440,i,8561461012270646319,7361781435866707893,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15684 /prefetch:1
      4⤵
      PID:9224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11328,i,3064845760143188117,16934580504183249853,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15604 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11408,i,15784571574212305372,998287547667194949,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15644 /prefetch:1
      4⤵
      PID:9124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11380,i,5267487309347907393,5187047974925380547,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15624 /prefetch:1
      4⤵
      PID:8716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11504,i,8290602068076026773,9183302708545554977,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15704 /prefetch:1
      4⤵
      PID:9232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11512,i,18401955828686431095,4953395311237372550,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15724 /prefetch:1
      4⤵
      PID:9240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11404,i,9021594743266644861,15582144672470093945,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15804 /prefetch:1
      4⤵
      PID:9296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11304,i,11181773308038327395,16726735267727514357,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15584 /prefetch:1
      4⤵
      PID:9272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11156,i,472890693552914080,10001430000982387064,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15520 /prefetch:1
      4⤵
      PID:9288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=11580,i,10879248011516977929,1388119024297834430,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15784 /prefetch:1
      4⤵
      PID:9304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11208,i,13307495644876273613,17576491263160407304,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15524 /prefetch:1
      4⤵
      PID:9248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11236,i,13578027867173328424,11679095922078633674,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15544 /prefetch:1
      4⤵
      PID:9256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11128,i,11847284509003357595,1602382811072395048,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15532 /prefetch:1
      4⤵
      PID:9280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11296,i,14906726368048226873,13710282459252539616,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15564 /prefetch:1
      4⤵
      PID:9264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11496,i,10897865422942568894,12964203554528007277,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15764 /prefetch:1
      4⤵
      PID:9320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11608,i,16760315274393878739,8046683064354117987,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15824 /prefetch:1
      4⤵
      PID:9328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=11484,i,6152161192266156370,2522222667013525259,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15744 /prefetch:1
      4⤵
      PID:9312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=11640,i,329765656693291591,2051117672222171260,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15844 /prefetch:1
      4⤵
      PID:9336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=11764,i,7105335174448524707,4897409299261115757,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15944 /prefetch:1
      4⤵
      PID:9344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11980,i,5140190402273523699,17496118267444783318,524288 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15964 /prefetch:14
      4⤵
      PID:9352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=11740,i,7691781761521892791,2904015623763449406,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15884 /prefetch:1
      4⤵
      PID:9368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11676,i,10152214643774368382,291464013536498884,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15864 /prefetch:1
      4⤵
      PID:9376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=11704,i,10506685861232402082,12849902077117860057,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15904 /prefetch:1
      4⤵
      PID:9384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=1456,i,8973635299320288576,9637530411517238850,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=15924 /prefetch:1
      4⤵
      PID:9360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=23492,i,17186793676483036888,9590601130199971777,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
      4⤵
      PID:12644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=9200,i,16649895192073786374,10467235898157480836,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=18612 /prefetch:1
      4⤵
      PID:12652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=9560,i,3149258362532919141,3382139173445561143,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=16024 /prefetch:1
      4⤵
      PID:12660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=25756,i,16240647708569291551,17523754125970393194,262144 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=25728 /prefetch:10
      4⤵
      PID:12668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=23280,i,15134011142028425525,7109460262132592005,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=20244 /prefetch:1
      4⤵
      PID:12676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=23152,i,2127735668008071555,14901821800798323305,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=12092 /prefetch:1
      4⤵
      PID:12692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=23428,i,10422647433339882030,12724745639869504269,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=14988 /prefetch:1
      4⤵
      PID:12700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=3332,i,3056517520328249542,226544381485284727,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
      4⤵
      PID:12708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=10912,i,13563960599051599990,5985159892675298016,2097152 --field-trial-handle=2236,i,12892566070818141000,4883245952625677756,262144 --variations-seed-version --mojo-platform-channel-handle=18712 /prefetch:1
      4⤵
      PID:12684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe"
      4⤵
      Views/modifies file attributes
      PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:804

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe
1⤵
PID:1776
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bskgh9d\6vt8mlqy.exe
  2⤵
  PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe"
      4⤵
      Views/modifies file attributes
      PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3952

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe
1⤵
PID:3012
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3gjo884o\3igen9kv.exe
  2⤵
  PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe"
      4⤵
      Views/modifies file attributes
      PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6900

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe
1⤵
PID:6964
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8ypvsbh\kcs9jxka.exe
  2⤵
  PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe"
      4⤵
      Views/modifies file attributes
      PID:6184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe
1⤵
PID:6660
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4g2gdahd\38dxo19x.exe
  2⤵
  PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe"
      4⤵
      Views/modifies file attributes
      PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe
1⤵
PID:6448
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h8q7h4he\8xltbr5m.exe
  2⤵
  PID:6568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe"
      4⤵
      Views/modifies file attributes
      PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6228

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe
1⤵
PID:6496
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x6qgxbim\gujsolug.exe
  2⤵
  PID:6748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe"
      4⤵
      Views/modifies file attributes
      PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7100

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe
1⤵
PID:7012
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w90wrmmo\idseupfm.exe
  2⤵
  PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe"
      4⤵
      Views/modifies file attributes
      PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7480

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe
1⤵
PID:7572
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ygrnfh\5s63rtfm.exe
  2⤵
  PID:7644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7672
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe"
      4⤵
      Views/modifies file attributes
      PID:7728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe
1⤵
PID:8112
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hklk76yw\5ynk1g3p.exe
  2⤵
  PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7184
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe"
      4⤵
      Views/modifies file attributes
      PID:7244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7516

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe
1⤵
PID:7804
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2k5q1l0a\rgs557dg.exe
  2⤵
  PID:7828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe"
      4⤵
      Views/modifies file attributes
      PID:7900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7180

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe
1⤵
PID:7460
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ri5oc0e7\x8rwxw0e.exe
  2⤵
  PID:7544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe"
      4⤵
      Views/modifies file attributes
      PID:7636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8180

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe
1⤵
PID:7252
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\emrz2zsp\usov2jdp.exe
  2⤵
  PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7440
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe"
      4⤵
      Views/modifies file attributes
      PID:7520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe
1⤵
PID:2040
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xqlljobl\x84s4hs6.exe
  2⤵
  PID:7384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7532
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe"
      4⤵
      Views/modifies file attributes
      PID:7604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe
1⤵
PID:7480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23mx1m3u\ndw48npi.exe
  2⤵
  PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe"
      4⤵
      Views/modifies file attributes
      PID:8248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe
1⤵
PID:11876
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0nneq9n7\ws1lgor7.exe
  2⤵
  PID:12236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sr1tu85s\600usena.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2380
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sr1tu85s\600usena.exe"
      4⤵
      Views/modifies file attributes
      PID:12296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:13128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 281KB
SHA256 cb269e30405c572eb6b76fbb1d2047b97ac4dfc4da0799fc8967d9087e8f9a8e
MD5 f6904b380188ca8078f603c58e272d6d
SHA1 324786a60acae1b784c5fa9c1c0201d87da68bdb
SHA512 57fe98e54fec69745dd6f12f0cea06cc2d9503c24331acb717c0987b65cf40c5babad6df733547eb1a1834de2d2f63e84d98566fca8f01f444077caa3a19c6b4
SSDEEP 6144:RG9drdcaZUKyLIXg+TdYgdaOUxkiglJihfXCJPUjNyw4ifzmFdxQjDZZ:RseaZUQX1ZBdms8fXWQwwdoaPb
TLSH
T15E54230AF3D82950455D7D822FC9706563E6B715AF3303A7CED5FABE1BCE1201ACA648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 74KB
SHA256 d63c747272725b59b0c90ebd0576149fa7810e98ca4d197f30174143be5d22f7
MD5 793cd134a25459406443a33614d11956
SHA1 5e82eb468ece4317dcb7d36c2e88f9a04e13bd5e
SHA512 079dc319a796c1e988fcd9dc0e56a6b4c0ab696d1b2241eb893a5386459971313ab8c60094fe56e9243c362aa7f68eb4b9911529311246ab0f50395a4e45e345
SSDEEP 1536:o+Rwd2OmpJgS1Ew1eEggug5Hwwf6XHuzgtw34A+7RfJ6LlQrzofGx1uP:TRwd+Tje8TQwf6XOzgtwoJF8xQQf4s
TLSH
T19C7312FC4F2FB3B04A238A913E13A46D1ED081469B44636D547C049DBB6ED985D4CE6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 274KB
SHA256 ae7fc4ea675cf317f93207f69ac2b93070cb935453a7855a158d2a462c71eec0
MD5 ec0f91bc88d0196195e5d5eda0c34fca
SHA1 837201a2a152f2ae51ff8db84a983747aef80794
SHA512 3c9f2235d857138d2c402eb9de65965d7714890c47e33aa9827731c5ead7fdf1fb20da30bd12cc49145c5398d6fe394e03f490a64ef322f34c32ecac9032171e
SSDEEP 6144:pzOdFje0AzOVEhE8ogsParNFTLyYxm/Xixa7u8N0T:pSe02lPsP4jVxmfRXeT
TLSH
T13154223DF838D3F4AA53DAF929F3952B2030D5AE990E600AAD7CA87407D56552B2C730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 85KB
SHA256 356791dc8df2bd016597e389c698885b7a3db7a7f3c03a6a47234183ecfc273d
MD5 4d3bc4f5900ccc2aeb4278f0a387a8ed
SHA1 70f4a3cd7b6dfa1014edcabb0a13b38fc6e7ea70
SHA512 52327874f1c9f43e760ade294173a2d8ea5d3faddb2812c8cf69307142c03f0f2e091283ff2b4e6acecbe1e7bed6576535b6b5935a902a10125b1a41f6a40c5b
SSDEEP 1536:EMUbzKhL8rOCCgRMP2Yki3EX7iDpNG/d9waJG0lSgZBrx81omtJrnP/1G:SbzKhLEOClRbJX7O2d9rA0RBrx8/tZPY
TLSH
T17783023CDA3AA361D9CC44605DF3BA36BF2E3D51D214A8EE8436385C513914CD2BA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 219KB
SHA256 da0086e36d11e350d17af1800dd62aedaaed14111dbcdd5a47acd04806e4acf3
MD5 fadddaa6962cad99c5d0dcc6c0a95391
SHA1 a5cbceae83b1c5e74aecdeb1c3bcd2d074785a56
SHA512 798c7543e23cfb34b697d294e2ebae0ce33e8e6042366fdfaf995183878c9a5fa26e6111087ad839b315937ebd5537898a42734ffecaabd36a958b3573742266
SSDEEP 6144:rYcBmnO2jalRQrwlni1LX5ECPoQwXPNvG/UYuD3:rHBJ2jqarwlwX5ECQQwXV6UYur
TLSH
T1672423D80255A55013E29D976C0FE943EDD3211A3037ABC79C4C5A5F844A9B7379FE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 105KB
SHA256 48e812d854b3aa7776d401fc6f34fae29b1088e46dbf1dcd78ec13db64d68e9b
MD5 29f9e1c18192a1121fa5fad9615c6d79
SHA1 5248fa7f630b57fa5871becb45dad7b2f58ae8fb
SHA512 84cff919bf262713c97856c5257c4cd228f1a7ccf2ca0f54201860d1295f3ddf0a404d438e4320d192ae692af2541e396682dd23d2c9d4fcb02abd1e17c573e6
SSDEEP 3072:jm0RR8FYstRkmRYjNUUetU+0Q+FgPv47QlQdtxy6ZU:VRR8Fz+UUSmQ+F6wBdDZU
TLSH
T187B31362E7A7B7CCC14D94F6DE8D6952D05C6DD70691EED72182B132CF9630303868EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 90KB
SHA256 6f7842d32b4ef7fd2890930630b2d896c17c3d84cbedfa37f63884dce18baf1f
MD5 e213a2b37dec848dc67acb8c3bcac13b
SHA1 06ebd6e94b4aa0a9c0730173581785c51cffd938
SHA512 5011fb63ca4f430e4b7d6f6794a2be45cc5089ec203bbba03eb74fc40d05db081cd40407ecf89b9cef401f33234eee3d49e74a8f1cbbc09da5a3272ef23499cd
SSDEEP 1536:oHCDDC9s882owhNH3VOJWUl4d/cHu4mUl1MnfSqQJL1xF8YijHBWZ:oHCC362xFEWtI1SfSqe3+j8
TLSH
T18C9312E3984523845E90291B7B50A74999712B0656B3A34BCEB7392FCDF5CE0D222F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 47KB
SHA256 ad9b8a2b724b35673d49057d9d2c8b142e51c372b46551c6b24a3b60780e0f90
MD5 506e13c9777938d1ca46696f14f240c8
SHA1 b7de9642bb7d920961a2ed4b79520f6d8eea4d3a
SHA512 4816fd0e409b5c045984eccdef7ee5c7e9a0120b591a66b2f0136bc709e8991ee89afaf00d2ea2ed3f7c1eac89b51801fad020d888f25980d6dcefad7d0b74d8
SSDEEP 768:cPAo9p6Yz6d8q183Qfh/0VL/gOfXHMExTd/KhXkbY1S85btKZV0BNl:c5dz6z23C6VBXHx9Kx+sJbAZwv
TLSH
T1852301E553BA85E889F043F5699B37B0DF798CE886EF350C72A154A7578269128C2CC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 38KB
SHA256 9975fdb7f678ed86964edd7656cf357e3a77562f4de9489f5dcdb24a36ca1053
MD5 e5f803c2197cc53fc2005247404579ce
SHA1 7ffd0463471827ef94d5e917870bd9c7909bd372
SHA512 4e49fb285d9df0a420e0b67d4268061561cac2764078948697023119c61b5ac9adb3c8f4985b8a876b1bf052059b206e8509a4491b8bf5555c4b240c53df35b7
SSDEEP 768:7XAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+YL3DAc8ZmoYt+T:7wjkdV6H6AK+N+NBou65L3yZ5
TLSH
T18E03F262E5D572D1DE6C63F4FE8158E2D04FE63EC51E62D63326C6D038117B4CA0AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 21KB
SHA256 a8d4cef7e4495cefca79668bdf0169ec8b19abb437b2bb76e68ace84b0a1c10b
MD5 c5c01009251e0503fabdcdcc9664df93
SHA1 6547b070cb480be57ed8c6c59a303b990b4102bb
SHA512 efd799307bd7f4a990892dc30a3a3ccf42ad6d20e48138290f759a926e5c91f29a252a9b3841e323e82c9984c0b2f5df4abd542ae58c377fbcf6036346e4e755
SSDEEP 384:HIbUbl0dWc7hcmlhsOnlWIPrZ2+LWFvXLwNdTqx06vgFmUaWDzXFejtOb:HIb9Z7pz7lzPrZ2hwNULvglDZe5Ob
TLSH
T133A2E1E3C9294B59FB8FA938B16E19CE6E665348E053C23C80872E81761DFF15D0B46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 92KB
SHA256 48116b1c9b20ee76a47b734cdb502dff2818a7856bf844e0f98d3563f84365fe
MD5 f9e9736a256d7707108b94b549680958
SHA1 f11119f200b93c33ef9308ba9bd110bde4f95acc
SHA512 9a5e6870040a029ca99456200cafca47e4bad732883ae10034399f7c5b6543047b46f5766e017a3fd79d75971e8fa0d459f60c6f601eb754dce1e9e2e557a5b0
SSDEEP 1536:qrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdykD:m+dCdU1UKok0HaFA9wRw0YuoqsmGeqO+
TLSH
T1649312EEEBADD166155EC72842D8848F847E02F0C109EBD60F89D6E3813783A5D398D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 76KB
SHA256 bbdb4de36778b9dfaf0d76f72ff5eee62586cd6f885d5f60b21436c64f9897d6
MD5 27133cd77bad23037dd37ea625f629be
SHA1 7d684f9aae9346022129138bad558be1ae13c93a
SHA512 3b42a4bc7f4bfc67133b6771b0bf30bbba215124e508b728ca9f42050887bdb7f98dd8c55c82193ff50ce5847a9e4ccecbbf3d77c50fef5aae177ae0f22a5e6a
SSDEEP 1536:zK5VCBgVlaRCfvydYadgqwEcJweg7MixcejkC+mQBYaNlrW:8hVO35dOEcJaMiFjkCEHrW
TLSH
T1B77301BB417F83CB014E9A5D1F46D099034539BAE6E961F120927AE437EC3B902635FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b13c6d1fdcfc5e9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b13c6d1fdcfc5e9_0
Size 283B
SHA256 9ef4ae49d89c95657e8d39d151e7c1aa290239de4867c83981ca7d62c0d32f7f
MD5 aaeba3b304ce4eaf96f410fc7410a047
SHA1 40a0ff50c0a92072579ba203b60bfdf280bf1a6e
SHA512 118c195198569b731d8a9d7623fa6edb14b9e75e2864bdcd33a5b306a5debcbf72c5b85fa10618d4ebc12ed770975116f2603cb5e05b61b5e7a40edb5d34cbf0
TLSH
T1D1D02B8E740C5128CD9D6BF0C3EA12A1EA13C39A4C2D856F4002A1797A571B176DA851
MD5 SHA1 SHA512 TLSH

Submit Download

1d0ee68948080b17_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1d0ee68948080b17_0
Size 283B
SHA256 db9c7344dbc28b0c9a624b1c1f57412ea16cbd7adef1ac3b713f1ccfd0c6ce33
MD5 287f57773a31650421631f00788a7dc9
SHA1 82916550cdc0f32abee46f71191410d2c1e3b00c
SHA512 f7bc175e85f363a195488b84e69d07f73bc9fef540fbf0f1655a7d86360926b0f6c53ce619230c55dc00b57056f640bb512d0230a15695755d66675708e16098
TLSH
T14FD02B6B2C2C9416EA664AB4C349D2428AA7E4589D6DDA92914251B636095315A88501
MD5 SHA1 SHA512 TLSH

Submit Download

24584c5912c48b9b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24584c5912c48b9b_0
Size 270B
SHA256 f2c88850eed54e13f293168315c8897b5d914b564271ef680ed0b2a1b64163b5
MD5 930d3ae8bc284797a71f0d852f7d1fd3
SHA1 a044d24dbab9f80a3e4abbb1281845ea1a22213e
SHA512 e84f131cf4742543ff89884eec8d878a1db4b0cad4aa8cfc6ce496e8a242caa1593a570c467d94ec84d0206c7098119d36986774abf3d9c118b36c6b31d4f3f6
TLSH
T1E0D02BEF048CA0DACE35CFF0C525A9058299846915188181A50554E2260D5B09591501
MD5 SHA1 SHA512 TLSH

Submit Download

812283f5f54b7243_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\812283f5f54b7243_0
Size 591KB
SHA256 6c7869c275c9ae586989750a3a82705f22f458704180528efa252503c0aaff76
MD5 e83080527eac72e2cd66c2b5192608f6
SHA1 e40d39f783629b4f2d15323e957ad8e509b5ec85
SHA512 b9501a0cfdab78924516bf76f938d4ef52b1bf85f01036987945a75c8ceef7308ac24df694790f63d83bdee4454761f0653f0ae2522728690c4162204203abc0
SSDEEP 6144:sno3aReNCeeWJhbCMmjHLFlsDbqjhTBQU7uDzjOugaBQYrCn2blfk:VaRIC105+jHRWYhTqzjfLCnglfk
TLSH
T1C9D4F8084790EA55CF7623F401A38957A73581482EC7E727A1E9B7363C493E16E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b5b3c453cf049b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\87b5b3c453cf049b_0
Size 284KB
SHA256 825621344c6014d564ef77a3f1b32cf26807c34631d9676c1fae72e6e75862e1
MD5 3dd603065e77d60115914228ca1b75b6
SHA1 01581581f80faf8554200dbe969adbc275f6175e
SHA512 d9161904afbdc9148fcb566ff2968834a8823a6e4d9de851db46a147bdf50ed851f9c9fd57ede7dbbb98c80bb07165d0db19cd8293088a6ffad225be6e064d65
SSDEEP 3072:lr+Iy46FKuXCMMZQOqwgyvkkAN4dEyjMq32Fxb52v7yJCGpJJOfs:lrNy4Fjcj4GyjMq32bb5WfGpHOfs
TLSH
T19A54C7651B90EE15CF7663F51262C953A73551483FD7D31372E8A33A2C0A2E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcbcf9c014f6b40d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fcbcf9c014f6b40d_0
Size 195KB
SHA256 e7b37c0c680e84b4957af6b7cfae1bb3b446886784f29553c3d4811ad083c7e5
MD5 a1fa432da55125543e4ce3f030215788
SHA1 c86bb3aa7ce89406fd5db4a10831cca2d34952c0
SHA512 1d7efe30d70645fd4064ca246f1e291bd06889495540954cbc14f8cf33702d7f3b692307dd7bdc966c08de8bb93b38f291b19a469494660dc6419e5529fac1d3
SSDEEP 3072:zvu2Lq76xivgFVNzx4WQdxIz8vtMmgOrzvYsUcV:TuW6vgDF61dm8FMX7c
TLSH
T1BA14C5465790AA55CE3623F541A6C993A73184483FC7E72370E4B73A3C093E19F9A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eda6274de542349ace62fa5c4635060bd9bc4ddd0bf9eddfe8a3e59cec0c80e3
MD5 f9665641410b9bccc13512d84a766fc1
SHA1 2a9a91835c553ed8fc2df52e96be3439abe05c05
SHA512 f242dfa2aa7e787ff56932f409e611153278fd84dcce9d84f88ff57e716311bd491f328f7ffd1ec7671c79556e4ace96aa131d8f31a83a8c5ccace177fb76fc1
TLSH
T12E8184A1176C28E3CBB6817374E9196A36FFC059025F1E21A0D46CB85D26F4F9CD282B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 04a57f0bd04b91a925ff5ffec3f7739984af538d25d0bc95223fb34da8923767
MD5 6a8623c0de5a8a748206b62f00e61bab
SHA1 f83acf7c76bf005d75341bf5e194f22093de5c74
SHA512 227685d84e5ba4e9b0f055aec41d22078497cd6085441504b7f022c33adc1c74fc2c4902ee1a642f81652c28ee231cbf93152c83c8deecd60bde0aba6b80d33a
TLSH
T10171B8A0276C28D3CBB64173B4E9191A36FFC059526F1E61A0C4AC384D27F4F9CD296B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a441f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a441f.TMP
Size 2KB
SHA256 1f3b208041ac9c597f7371be5ba1ae992be2737a65d52a4f1089e3867ca07612
MD5 a71bb8f9f1b7e426aa7d4576481efef0
SHA1 8ef515ef0ad9cbdba619372f42900b0943ee07fc
SHA512 3b1a1c556f43a471a1a30b59c959c95ead70ccef413cf2d17eaf9b7ccfeeb49e22e62c2c4d3e4a6d2ff0067b780694fd8e7cc9fea7879037bc780910d90f36d7
TLSH
T1075161612B2D29E3D7B640B3B0E5195A36FFC44942AF1E20A0D45C745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 596a8344de59a2b1318a6420873949180771d1610f1e83c289ea5af29f4ea134
MD5 4bbd35b9f27f343cb7ef2008537489d5
SHA1 a82e1257dc3ff335174237d5249b3136781cec28
SHA512 fd594ec0b24dfe649cfffa726eabb82c5f7b9a555d5d60e2ef9171bfe38f5b86055bb503fbddd92482306677ed0c38bc40f3e8e015612efb12ad34287db69f3a
SSDEEP 96:D6eOc+5WrljZiPUzI6N9BQizBVq5thwBTbLy+k5x:D6NL5WrljZiPUs6N7Qi105thkTbO+Kx
TLSH
T19AB1DCF7C3E4966DDC2196F0AB142E2BCE2D0915832C3C5A88D5AF5BA7E2470E101A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b0586a7d8bd6244b5d377aa4c3f980188b175abd360623a8a6a3af79a19b1371
MD5 6e0472369d0c02c1801745a3d6dcd5d0
SHA1 eee775b4519e72ae18011881487c9a8064026ba5
SHA512 820e3276fe0ade60272ccf4d358b128a27980ec63782a2faf92aaea5171675bb5ab3013ba4582ac242237561658e96fc522d52a7c460c4bded00e5b214c86217
SSDEEP 96:D6eOc+5WrljZiPUzIt5WN9BQipXhwBhVcbORB:D6NL5WrljZiPUszWN7QipXhkhmbORB
TLSH
T177B1CDF7C7E4966DDC2156F0AB152E2BCE1D0915832C3C5AC8D5AF5BA7E2470E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 146a69cc1c30df2f09a49a20481d4150ac565a73b0fda03c213557f983e9177f
MD5 de52919a444577638507ae0559c6b8d2
SHA1 3916cdda8e97e6b6c16d51db8d036c193bfa56a4
SHA512 e03573c55c7a79d537ec368b3b79439c0f9510d6ecb365cf11dd6fe18864ac39ec55070adebbbd3ca5458b68cde12c6bbe27f842d1003a1e8f0f10e5bbed2c85
SSDEEP 192:sxRKRGCE/fesvA+wGNzoA8purWCFBHg6+WNs++l49zcYJZZ/YBoSqCYWGSIgD2OJ:sxRKHE/fesvA+pAmf5USnV/nu/Z
TLSH
T13752E916A9389D3B4CD7D219FA65BF53E2FA1022A1D01F48A7FC9A1C00E76DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1e5395439db2610601d43670e35be37ba5b41e3b46e7af39c1466ef2e0ffd77c
MD5 12834df38904e9d76e12d8e2fff9138a
SHA1 80af13bdd674b697ba1efd275b9c4eeb5713da10
SHA512 5123a464f6065a01d8acba9fbc462a7c1821bce52c5565a9c2a783943a46e7d1696bd88cee576b2aa23d0541de64d2841a166419ac240fd644c0ef436ad37734
SSDEEP 192:sxRbRGCE/fesMWwGizoA8pMddFBHg6+WNs++9zRZYBoSgCYWGSIgVqJ:sxRbHE/fesMWpvKf5UrZns/M
TLSH
T18F42B81A6928A93B4CD7D319FA66BF53D2FA1032A1D01E58E7FC961C00E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 77746196cbf53f4cb0ace51ffe704323477b38e50b67b086eb3a81300c81d2d1
MD5 1c26e7c5b95c010b2c8505f92bcb3c7b
SHA1 306f513936adb1dbd40ed8a3abd2b75d07d1caed
SHA512 2abd632c96965e6e256e06293864d19e42c8cf50fff5fb7361d8cd6a0d9c6b2be2618f8d614a65c4b088c8db8c2feaa4e21e21d095f52af474ed9e791ab084e9
SSDEEP 192:sxRMRGCE/fesvWwG8zoA8pMRB+FBHg6+WNs++lwGrdzRZYBoS/8CYWGSIgDUOJ:sxRMHE/fesvWpt/f5USOLZnmL/D
TLSH
T10642D9166938693B4CD7D219FA55BF63D2FA1032A1D01E58E7FC9A1C00E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82c0a48f1d0c36efb6acd4ebd420220feb7218c31079c32fbce7c95fc27c674f
MD5 1783c94c98964e4e410261b3d5c4c6a8
SHA1 ec7ce0ea943ef39e027ff91f210207da88739d6b
SHA512 ae7bdcb28672ee905d47340a49b75341a5745fcafca5663e10a78003d79582f3c411ab4d8aa18c2f371d5582be8724e5a7cda2a573ab55ddc59e829de4611e2c
SSDEEP 192:sxRMRGCE/fesvA+wGYzoA8pMrB+FBHg6+WNs++lzfzzRxZZ/YBoSlCYWGSIgD2OJ:sxRMHE/fesvA+phlf5UFxd/nb/Z
TLSH
T1EE52D816A938AD3B4CD7D219FA56BF63E2F61032A1D01E58A7FC9A1C00E76DD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 564aa7bafd27139b9e93ad8d245c67c85a7a3ce9c8f3b045df283313909d607d
MD5 6f5949eecd66fcadd1abd770a5f846df
SHA1 79203764bc9db384fd0c026649b25a3f407cff99
SHA512 2bc9f5c84445a37be28332d8e5a43166d21986932d582859f8b5aec924684ef5bb03ebee36c48299eb2e4998b3db228437a9cd0fc4ea96aa9452cc84879791d2
SSDEEP 192:sxRMRGCE/fesvA+wGTzoA8pMlB+FBHg6+WNs++lzfzzRxZZ/YBoSlCYWGSIgD2OJ:sxRMHE/fesvA+pCPf5UFxd/nb/Z
TLSH
T1D952D816A938AD3B4CD7D219FA56BF63E2F61032A1D01E58A7FC9A1C00E76DD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7aaa703283daf99b46781ef403a5980eb086c7ee22bd343173bc0fbb8672425b
MD5 0e4759838d8416fcf49009b9ba3d8b32
SHA1 b2a459515f403bfb81e140e1b74967cf7d21b99f
SHA512 4ef7b60163bd0ff3d13a1ac669e7917eefa3274a0c058a0107433ff36c465e2171b30fe480bb188fe6876f8f0f7d7e5a9357c6045c99925c18673066728a6cdc
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVGVuwwro9Qe0UrE:j26HWUE7MRWgs2f02u1jap4wb3E
TLSH
T139C2DA6B740CCABE4F800ADDDD197E9B6D6802CB9698CD8047FE951C02C6BEE511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b71972f1-65db-45db-a947-62f5cdbef351.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b71972f1-65db-45db-a947-62f5cdbef351.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

919086ce-c68b-4c80-94f0-3aef12803f40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\919086ce-c68b-4c80-94f0-3aef12803f40.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c44da74e26afe0067538d9d82cde5e58746091ea97961b8d9e80d0826eeb2517
MD5 aa6c959d5168b4de518cec9bd4467cd9
SHA1 44235ea920caeba4035b60d4ade3cc29460fa3fc
SHA512 96ee5f152d39dc1f8a5d8db4c27f7897e0c2025435f284e8a8853ed98040083903797dc56834f0ad915e1f1c826b157343e659b12d363c92e0db0dfbfb4eb171
SSDEEP 768:2R3hP/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2R3Nj65SIqn/yfgRU+8Gm
TLSH
T175F2AD30E566DE738CE6A3C2B18667866EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6870537a1b2b3820d4231ac379572290d8f7345871b972a019680cb22fab9fce
MD5 6c470ad1cf39788c9a484b248b729c38
SHA1 bb5e0fa8d569b3c1f2d1ff04da92857e773c58e3
SHA512 060280d42b51a40e386f1b67f71eb9896a01afb6c6d78e50b9297e1ac3188859d515d19429eff34c7ec2e2848e504723e2a44ecb2df217d9e3514422878b5a80
SSDEEP 768:2W3sZ/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2W3mj65SIqn/yfgRU+8Gm
TLSH
T1A8F2AD30E566DE734CE6A382F18677866EF82067D9C44AA4EAEE6F0E055354D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e27a309e33e6436778227673565fe42abb8bc6ddcc083cfaa1ce7061ad7a7f1e
MD5 f06d62094661d51491afee266aa13372
SHA1 96210097f10b6e7b35a5f1a33a9ca2cbb008e208
SHA512 050e664b4f99eb83d0ce2fd974a453bc316bf2661e20e7e09cb9179a6d79d7184fae50fb503fc69480a5c716752f9375bd98ad56323918da6eeb865b730b660f
SSDEEP 768:HU30x/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:HU32j65SIqn/yfgRU+8Gm
TLSH
T1F2F29D30E566DE338CE6A382F18677866EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a7f645aece73314d6641c347e391925ff2a5ee0324a19581485c865470a28864
MD5 50df6ccfe3417e7c4d04daa962b628ca
SHA1 a0ada9463e4e0f62d3ff029af965649f4c480f9a
SHA512 c7f26675b89e6486af7f5e9b4141a59f7c27b2717083fbeb1e49ddb6cc97186c0e28c86c904ead29386f15f999ab95d8661b0a8717696494783261e0ccd6845b
SSDEEP 768:HU3KX/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:HU3yj65SIqn/yfgRU+8Gm
TLSH
T158F29D30E566DE334CE6A3C2F58677866EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6b9dc0ebfb3fc8dc49cbacedbaee83b740f149c4380ffe09702f823854aab67c
MD5 cd2d4d43022577a026ad4a648185bd13
SHA1 7457bfb5ff0207321c9143eb6483fe99113a1ab3
SHA512 410e64a5db9554df72e49cb04d5dced8520dafae947bdd8e63ecda5bcaa494c07f99837b0fc5685e4f4dc00c229a28099fcb9914247f8119890f9226977176a8
SSDEEP 768:Hk35z/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:Hk3Zj65SIqn/yfgRU+8Gm
TLSH
T1E9F2AD30E466DE338CE6A3C2F58677866EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5acc20623c32625d5a4e25b3be33c67334a80b3d637373466d65473d666eb359
MD5 6f7976e1c6d41aee2dc16ec423a79bee
SHA1 799eff29bd07327267480cdab7a2e01909ca0492
SHA512 2c2958c9f7649eb0792e71d8a20070a727f2e21647e18831401e0d49116883b2b24a011eb66017f613a08fd42fa66c00342ebb7bd9f08b692d62826f670714c8
SSDEEP 768:ck3B5/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:ck3Hj65SIqn/yfgRU+8Gm
TLSH
T11CF2AD30E566DE738CE6A382F18677866EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a118f32bd12df88d0aa8f505ea0fbdc0211f0eb81f4bffffe48835e570709123
MD5 e7293cb904686f1cab6810e899fb8c0f
SHA1 0c624165312e04352dcc9fe4e428cb0e5d6bf628
SHA512 d26ebad795d7c2ca81d7cb1d4cf86d0825b1c9137c887aee35777181c41fb135499e3ae599dc8bbac4ba7cbcbba9b2673e0bfc83825e152d1f649b3e136c675d
SSDEEP 768:LFHk3GwgbexsOWT1a5RONXyer1IRCzni9ayojKgqmU+hOGm:lk3Da6RSIqn/yfgRU+8Gm
TLSH
T10A038C35D895DE779CE6A7C2F6467787AEF42063C5C899E0EADD6E4D008318E130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9ab8663c35ae4adaf53e0d62fd3132f7d3d4c4a4595ef9f0a228e141c4643743
MD5 341999e796c4d2490f99c0fa3889cbd6
SHA1 b4ded2bf4136f48c84677439f278f6e282ec6bce
SHA512 57158f76ebb03c7e21d34e2b3e91851f5510930bbe10ca08efe8290318e75211f69a5da98bf6a2a3ac5889aae7b845026577e0eca7c4d54ddf75ec93ba9794d2
SSDEEP 768:hrv+4UNbdz31t/TBOWT1jONXyer1IRCzniBZeVH1SK7:hbsbV3njjSIqnGEH1l
TLSH
T1E003BF36E4A89E338CE2A3C6B04776477FF86057C6840790D9DE2F4E06AB59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9a250caadd6c38503d248d76d71829638e5be376f4a7ab71deedc38b16bb20bf
MD5 644cd4a2ef2dfc27e1ede1b4ebb009ab
SHA1 7f4eec965020bc4ef79a5c0495608a59005cb2a1
SHA512 bd1f80825f889cfa02bd91ebd1b81de304aca61eea942afffb44373f84931a77b6832f9c1af6601ba2e889d64960b4ca65ed42dce5d6d6bcef7841c4ce56c9af
SSDEEP 768:erv+4UNbdJ3LT/TBOWT1a5FONXyer1IRCzni9ay8:ebsbD3Pj6FSIqn/y8
TLSH
T12E03AE30E568DE734CE6A386B04777837FF8206789C50AA4E9DA2F4D059759E270F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 10ea3ae7ffa7a64088761c2e77d90e1f42898d06495440eea6ce5eff3b7bdb02
MD5 137272051acd81463b414b792cee37e3
SHA1 5b63a8409dd7a84b13ca71dd96b6b6295bf20aa1
SHA512 096844a9eb2cc2e3192040d2246bbc5c1c48ee1cad77a230b075f8f6df94abbaeed598a6ddbe7a63d2bdbab5ae835ac5b8a2b9822bf01f27a799506be4d40452
SSDEEP 768:2v37L/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2v3nj65SIqn/yfgRU+8Gm
TLSH
T1E6F2AD30E566DE334CE6A3C2B18677876EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d02f83e398c3373a999f8a41482f8a279be8e2d93de33e1e286030ac54f85efb
MD5 0e61e12e6fc44b1d62ae6fb41380dbfb
SHA1 f7ea5e1aac3f51686c75ac1135a0dedeba55dc5d
SHA512 70c1481b45e8e68cf4d75fa7c8d9f336aae87e68911a6578e5070fa44216f6049dd85f32302aa46e4a7aab3a5978f66bf821c61d0e92bf23b59dc08aab6ec423
SSDEEP 768:2i3Tp/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2i3Nj65SIqn/yfgRU+8Gm
TLSH
T164F2AD30E566DE334CE6A3C2F18667876EF82067D5C44AA4EAED6F0E055365D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c37d4582baa214f92a1adef4b5d15a02e7733e51e02055a13564134a520d8ee5
MD5 6ad77e7a19a60ae98648e71a6cad72b7
SHA1 3c5990f46866ec3943ad8cf524b73a134066c178
SHA512 8c7095173a5a431afef40c111159a0c393d08a895e57d881728610df7fbf77a6937e97793b6c158713d339de576c729810aeffe5210f1febb7fec90148b0ab85
SSDEEP 768:2W3j3/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2W3Lj65SIqn/yfgRU+8Gm
TLSH
T151F2AD30E566DE338CE6A3C2F18667876EF82067D5C44AA4EAED6F0E055364D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 589a4d7f16255d3560e362d334550d9ccb9e5a607fe18b163474d059af03fdbb
MD5 f3ef085215bd343c733d287e0aeb6315
SHA1 10ac878ee468be1b91c811737915f01323a34e37
SHA512 e4de05b2ce2115dba8ff4cbc705b04bae0529b75c010edbd12ab8c0803efea0491545ac1cbffdff915c217a34ac19d115743c66194ce52b1a38e811dbe3d86c5
SSDEEP 768:293iH/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:293ej65SIqn/yfgRU+8Gm
TLSH
T1F8F29D30E566DE734CE6A382F18A77876EF82067D5C44AA4EAED6F0E055354D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d0850ea209b763637b9d830d5a63cd346f10c0de690692d2ba44026729ca5345
MD5 ad0e06475c6d89178bc1037b1d034c66
SHA1 229108538ce78b4aa8e183b61519ebe941a7ccab
SHA512 e69b67b5029471fda82ccec7e0bb0acbab507a4002df0deb1124dcb8a8e1d3e5633c74aa2f9e194cf304849e0e70eb8acc2e32cc4a76222096416cdde62c3907
SSDEEP 768:2Y3Ol/TBOWT1a55ONXyer1IRCzni9ayojKgqmU+hOGm:2Y3Uj65SIqn/yfgRU+8Gm
TLSH
T1E9F2AD30E566DE734CE6A3C2B18667866EF82067D5C44AA4EAED6F0E055354D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6e86e3145488e991ad3eab0b0dadbbc6eb1201eb868329f2545dfc1a4f83bb39
MD5 c283f21acf18af65029fe5cd7b7c55f1
SHA1 cdf6aa0cba6dd4e81c0eb1f7fd0243ddf451e6a1
SHA512 fa5f1d1445d70ae01034c9c1d39da2efd78e16d6bf1a43e5198106798316296c32795e48fef7b53cbd62b4c23a5ff2045f578994d80a63b05adc5af9446f87d2
SSDEEP 768:Srv+4UNbdk3uN/TBOWT1a5FONXyer1IRCzni9ay8:SbsbC3sj6FSIqn/y8
TLSH
T1E703AE30E568DE734CE6A386F04776837FF8206789C50AA4E9DA2F4D059759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20adf4b49865b9ba035d852e6697a111611e648e50086811786154636d921184
MD5 4c0f7641fc344436e82fdc85b4310e80
SHA1 f1d9cace842a6a36b4632f3465bc0c9bd5a33288
SHA512 edbe8406da99d5e2f6b01649c3f7fb739797721d36115a21bdda0663ca86e05e56d39706b49ac5d88acc8cb414934cc4ccfae272f25d3459520dc58dc75c2386
SSDEEP 768:2M3cx/TBOWT1a5oONXyer1IRCzni9ayojKgqmU+hOGm:2M3uj6oSIqn/yfgRU+8Gm
TLSH
T155F2AD30E466DE734CE6A3C2F18667876EF82067D9C44AA4EAEE6F0E055354D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0c140786889ccd043d578231a2627cc74b022e1d82b0b2eb88555d5c67486524
MD5 d55d0417bbc3dca9d53bf4d03851dd01
SHA1 6c1a31947b99594d3e078b15dec74e25b57f1603
SHA512 555947dc240e294a07737d8af85e8e31b9c32bb80cb633857059b526a5c68a4e742190638bcba8fa70f28b566593c7cc27d561d37d45335a285509dbc544724b
SSDEEP 768:krv+4UNbdz37z/TBOWT1a58ONXyer1IRCzni9ayeVH1SKk:kbsbV3fj68SIqn/yEH1m
TLSH
T1B103AE31E568DE334CE6A385B08776877FF82067C5850AA0E9DA1F4E059758D230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c83b7afb-db41-44e9-91ce-48e8cb325a0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c83b7afb-db41-44e9-91ce-48e8cb325a0d.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h9icln93.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmttdkm4\h9icln93.exe
Size 5.4MB
SHA256 44a59c2179e40552bf3f5d4d135b9e913a74a947e0d2bc4eee411f547e469836
MD5 f8c3d44fae7e6ccfdaded562b7ce5a40
SHA1 4d4271e1b93f6adc97d816944ce9d017287db503
SHA512 ab536505364e87427d4ed22276f89e4442b33415e0df505cf91c6df5bee5bf1f81e077592724a46da9e6a92afde8004a1a4cfc41ad3812923fff7942d98073ad
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRh:OrICteErownP0oTcMsABqlaOzv
TLSH
T1F8463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads