153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695

Analysis

max time kernel
9s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
Size 5.4MB
Sample260817-e5dcmstare
SHA256 153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695
MD5 6a82d2d716d28e311fa90216fbc78dfc
SHA1 6d25f76325c3c307f68f6d3fed92e2d062ed85e0
SHA512 f9f9f2b4134440522c422cada3d0f32b925c86b6b17f21e4e77116b69a6155c29bd3d866d3a49cefc1c0dca465884cc237c4402ee81075e9b124439321cd7b8e
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMU:9XhICteErownP0oTcMsABqlDQkB
TLSH
T1F7463308B3A80DE1FAB3D13981665221D473B5254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\si1mbb.exe	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\si1mbb.exe	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18fatr.exe	v4w69f0r.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18fatr.exe	v4w69f0r.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bap6c5.exe	az1qvwnr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bap6c5.exe	az1qvwnr.exe

Executes dropped EXE 4 IoCs

pid	Process
3020	v4w69f0r.exe
3792	v4w69f0r.exe
4856	az1qvwnr.exe
5792	az1qvwnr.exe

Loads dropped DLL 36 IoCs

pid	Process
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
3792	v4w69f0r.exe
5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
5792	az1qvwnr.exe
3792	v4w69f0r.exe
5792	az1qvwnr.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\94cmw6bw\\v4w69f0r.exe"	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\gjqknsvh\\az1qvwnr.exe"	v4w69f0r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\940vmkyo\\cpwwnrmc.exe"	az1qvwnr.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1057	ifconfig.me
1066	ifconfig.me
2236	ifconfig.me
2591	ifconfig.me
2689	ifconfig.me
2848	ifconfig.me
179	ifconfig.me
289	ifconfig.me
641	ifconfig.me
667	ifconfig.me
3405	ifconfig.me
3477	ifconfig.me
3814	ifconfig.me
75	ifconfig.me
139	ifconfig.me
199	ifconfig.me
515	ifconfig.me
528	ifconfig.me
1300	ifconfig.me
1450	ifconfig.me
1748	ifconfig.me
258	ifconfig.me
415	ifconfig.me
435	ifconfig.me
769	ifconfig.me
1007	ifconfig.me
1326	ifconfig.me
2232	ifconfig.me
2926	ifconfig.me
85	ifconfig.me
128	ifconfig.me
183	ifconfig.me
229	ifconfig.me
552	ifconfig.me
730	ifconfig.me
2065	ifconfig.me
3092	ifconfig.me
138	ifconfig.me
281	ifconfig.me
465	ifconfig.me
752	ifconfig.me
1173	ifconfig.me
1437	ifconfig.me
2001	ifconfig.me
3155	ifconfig.me
259	ifconfig.me
390	ifconfig.me
890	ifconfig.me
1934	ifconfig.me
1983	ifconfig.me
3609	ifconfig.me
387	ifconfig.me
429	ifconfig.me
604	ifconfig.me
825	ifconfig.me
864	ifconfig.me
1338	ifconfig.me
1548	ifconfig.me
1652	ifconfig.me
525	ifconfig.me
576	ifconfig.me
1840	ifconfig.me
2358	ifconfig.me
3139	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3464	cmd.exe
4464	cmd.exe
6100	cmd.exe
440	cmd.exe
9108	cmd.exe
5852	cmd.exe
2868	cmd.exe
8268	cmd.exe
4868	cmd.exe
3152	cmd.exe
4972	cmd.exe
7896	cmd.exe
9880	cmd.exe
4028	cmd.exe
9248	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5344	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 5696	6044	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	84
PID 5696 wrote to memory of 4868	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	85
PID 4868 wrote to memory of 3816	4868	cmd.exe	87
PID 5696 wrote to memory of 5344	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	89
PID 5696 wrote to memory of 5764	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	90
PID 5344 wrote to memory of 6060	5344	msedge.exe	91
PID 5696 wrote to memory of 3828	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	93
PID 5696 wrote to memory of 5596	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	94
PID 3020 wrote to memory of 3792	3020	v4w69f0r.exe	95
PID 5344 wrote to memory of 2396	5344	msedge.exe	97
PID 5344 wrote to memory of 1564	5344	msedge.exe	96
PID 5344 wrote to memory of 2396	5344	msedge.exe	97
PID 5344 wrote to memory of 2396	5344	msedge.exe	97
PID 5344 wrote to memory of 1376	5344	msedge.exe	98
PID 5344 wrote to memory of 1376	5344	msedge.exe	98
PID 3792 wrote to memory of 3464	3792	v4w69f0r.exe	99
PID 5344 wrote to memory of 5516	5344	msedge.exe	101
PID 5344 wrote to memory of 5716	5344	msedge.exe	102
PID 5344 wrote to memory of 5516	5344	msedge.exe	101
PID 5344 wrote to memory of 5516	5344	msedge.exe	101
PID 5344 wrote to memory of 5716	5344	msedge.exe	102
PID 5344 wrote to memory of 5716	5344	msedge.exe	102
PID 5344 wrote to memory of 5964	5344	msedge.exe	104
PID 5344 wrote to memory of 5964	5344	msedge.exe	104
PID 5344 wrote to memory of 5964	5344	msedge.exe	104
PID 5344 wrote to memory of 5584	5344	msedge.exe	105
PID 5344 wrote to memory of 5584	5344	msedge.exe	105
PID 5344 wrote to memory of 5584	5344	msedge.exe	105
PID 5344 wrote to memory of 4180	5344	msedge.exe	106
PID 5344 wrote to memory of 4180	5344	msedge.exe	106
PID 5344 wrote to memory of 4180	5344	msedge.exe	106
PID 5696 wrote to memory of 4872	5696	153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe	107
PID 5344 wrote to memory of 540	5344	msedge.exe	109
PID 5344 wrote to memory of 540	5344	msedge.exe	109
PID 5344 wrote to memory of 540	5344	msedge.exe	109
PID 3464 wrote to memory of 2972	3464	cmd.exe	110
PID 5344 wrote to memory of 4636	5344	msedge.exe	112
PID 5344 wrote to memory of 4636	5344	msedge.exe	112
PID 5344 wrote to memory of 4636	5344	msedge.exe	112
PID 5344 wrote to memory of 4516	5344	msedge.exe	113
PID 5344 wrote to memory of 4516	5344	msedge.exe	113
PID 5344 wrote to memory of 4516	5344	msedge.exe	113
PID 5344 wrote to memory of 4608	5344	msedge.exe	115
PID 5344 wrote to memory of 4608	5344	msedge.exe	115
PID 5344 wrote to memory of 4608	5344	msedge.exe	115
PID 3792 wrote to memory of 6108	3792	v4w69f0r.exe	117
PID 4856 wrote to memory of 5792	4856	az1qvwnr.exe	118
PID 5792 wrote to memory of 5852	5792	az1qvwnr.exe	119
PID 3792 wrote to memory of 5232	3792	v4w69f0r.exe	145
PID 5852 wrote to memory of 6124	5852	cmd.exe	163
PID 3792 wrote to memory of 1400	3792	v4w69f0r.exe	123
PID 3792 wrote to memory of 3412	3792	v4w69f0r.exe	241
PID 3792 wrote to memory of 5816	3792	v4w69f0r.exe	125
PID 5792 wrote to memory of 4748	5792	az1qvwnr.exe	126
PID 5792 wrote to memory of 4508	5792	az1qvwnr.exe	127
PID 5792 wrote to memory of 5036	5792	az1qvwnr.exe	128
PID 5792 wrote to memory of 5904	5792	az1qvwnr.exe	129
PID 5792 wrote to memory of 864	5792	az1qvwnr.exe	150

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
8488	attrib.exe
10088	attrib.exe
3816	attrib.exe
6124	attrib.exe
5248	attrib.exe
3364	attrib.exe
1328	attrib.exe
1972	attrib.exe
1184	attrib.exe
8352	attrib.exe
2972	attrib.exe
3536	attrib.exe
1428	attrib.exe
8144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
"C:\Users\Admin\AppData\Local\Temp\153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\Temp\153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
  "C:\Users\Admin\AppData\Local\Temp\153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe"
      4⤵
      Views/modifies file attributes
      PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff97b2fc188,0x7ff97b2fc194,0x7ff97b2fc1a0
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,3199337206293942316,11536394163023500980,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
      4⤵
      System Time Discovery
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6715722761200145239,10261886044173944488,262144 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,8899551701606645868,10858540918076338714,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,9614221871732407404,16132831281167962106,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,17471710454971254304,3796957803668893273,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16741911144975205370,1862649114968983452,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4412,i,9513552794104680499,13957454493769801910,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4580,i,2501617972189185911,11701484180232858820,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5468,i,5511179917281859060,3964478946424155865,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,4168083197819347178,2901064890920225484,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5824,i,6814478956341855651,9897486929254045408,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5388,i,15780588716448834886,3047878689540780414,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5368,i,10589533950272312032,2750703542002560856,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4416,i,14715073425215229796,11386335300629322692,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3380,i,1972573991273096847,1208298872571952724,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6176,i,6358283338817871720,9423146072000842426,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6088,i,6656742633035496108,18399817351076821565,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6188,i,8624968041246228171,1209518835955748353,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6252,i,925925265178116666,12947067389417942478,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6212,i,17787626291039565163,16666040758980336372,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6280,i,202015711659698506,7993940965895645272,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6312,i,12783818588007548886,14889064149130493486,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6348,i,16502646792856733240,11601439232700640276,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6372,i,5255172799840975488,11490833397044679720,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6380,i,17567332286610002023,15542745805372845440,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8560 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6440,i,18368654354339821511,15823503878180412221,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6460,i,16691616437193036532,6370689391317408856,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6648,i,3492988455858840338,3844105636316029180,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:1
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6688,i,5472948576739538018,12706497764482276266,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6684,i,12952038185163477066,6442949791548629572,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6736,i,12123397401636860237,5236376295838214303,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6760,i,8293327946513312887,13283910404256431088,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:1
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6768,i,11044111830524870053,13913970402303413441,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6800,i,9258522068537908862,9800312336303194017,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6816,i,16611888816100371281,14745606084223928608,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6908,i,15965894416873605878,5375587684980592978,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:1
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4520,i,13271819537945568353,3199694264000143821,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7060,i,654127593165876354,15842501992807920174,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7044,i,3727989329160681966,2960481088607115224,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4536,i,576159961244471584,18331976193922205986,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4444,i,11598962945192645775,2591275170965309690,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5236,i,7658442868149574150,8895750717295989430,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7108,i,8689988388074212787,4789838056866906270,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7140,i,9388399565186053718,10792328986439890880,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:1
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7176,i,4583610748789725084,10197768454062940599,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7148,i,5151499022137083583,12362634249639730029,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7244,i,11065865606904408281,5281421163638211831,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7220,i,17088337946834279789,14204472583446191101,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:1
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7200,i,3170038738857358893,15436485767061210680,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4624,i,345655018813160550,1392050930933927754,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7276,i,10739846815330206041,2122378829893506834,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7320,i,2969102189589489961,13642350671206334475,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7328,i,9638566009599890212,10956591185761248304,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4688,i,12639149548467968913,4781480232370449598,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4616,i,13578286363091318731,2740693423977280075,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4656,i,9516827203516552689,16267034434633255195,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9600 /prefetch:1
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4704,i,6282294698016344669,5580358969349496162,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7372,i,9252413723902974105,15789019716960267426,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7400,i,3336925215986364600,9686015436102863734,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9720 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7452,i,15331231605420331880,14023651281696741197,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9692 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7424,i,10217995416784574344,1645788701901158322,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7472,i,16592121059859948164,5417527918218610817,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7508,i,7647131959304931556,11528469538210989441,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7836,i,16470958783049917208,4843590313665331244,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8044,i,17112334998301508422,10001739819438561345,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8004,i,2904239995228975637,15261443337340481631,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7808,i,18099992172945973525,2922020432396846853,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8008,i,924735923142459843,2336064316971525938,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7776,i,5639214403468379881,10087358474095653398,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
      4⤵
      PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7980,i,13716452547280904026,13678514947710739616,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10156 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=7952,i,17377966563715910003,15884003933314274609,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10160 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=7792,i,8737813084916812209,16527017287907786900,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=7900,i,11796138455048887941,10298636888408107337,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10228 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8092,i,13471968560446625259,1645962576625400102,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10244 /prefetch:1
      4⤵
      PID:6188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8100,i,2676918794071040926,11977578919797531287,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8144,i,4640896131477403563,11905894267527358747,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8172,i,13956373084858188764,12298006546549024626,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:1
      4⤵
      PID:6212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8208,i,13466643485145372144,5571945518553195224,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10332 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8240,i,16001888540240016950,3059566332826426658,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8260,i,756184517470076447,8014877259920038821,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10404 /prefetch:1
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=4116,i,4052439431209835746,12676351867087717188,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=17512 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=17556,i,10349568239328307488,16456196793050080979,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=17532 /prefetch:1
      4⤵
      PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=15408,i,12521209481880802315,17811569841248611965,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
      4⤵
      PID:7592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=6684,i,7360167792484941000,12507813319875237403,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10932,i,1054356484570512735,16436366172022397501,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=17556 /prefetch:8
      4⤵
      PID:7732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=7200,i,14280367745668993748,957462015739879480,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=17820 /prefetch:1
      4⤵
      PID:7984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=17988,i,6897703901571320382,7840283778553992137,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=17956 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=18132,i,10828383868104546725,11950720596819070836,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18128 /prefetch:1
      4⤵
      PID:7600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=18284,i,11346811699792442599,448517129310776459,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18308 /prefetch:1
      4⤵
      PID:7932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=18476,i,11866806650963653986,11350188869269166838,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18464 /prefetch:1
      4⤵
      PID:8208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=18624,i,10370991325820866875,13124556266098668989,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18636 /prefetch:1
      4⤵
      PID:8216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=18296,i,18065199480162156084,12469819441137525119,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18804 /prefetch:1
      4⤵
      PID:8408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=18828,i,9645686318157759929,3411450468413319579,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=18116 /prefetch:1
      4⤵
      PID:8556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=18924,i,9226428265598071024,524615413194225018,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19012 /prefetch:1
      4⤵
      PID:9152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=19000,i,13976459693192209901,16098470853378400693,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19232 /prefetch:1
      4⤵
      PID:8708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=19368,i,15708681127335926516,8683567820404986503,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19408 /prefetch:1
      4⤵
      PID:8936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=19544,i,3162175086686355117,11514418663761708170,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19524 /prefetch:1
      4⤵
      PID:9148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=19676,i,8937056203163004680,15569990846570510572,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:1
      4⤵
      PID:8388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10644,i,14598703224536290318,3804042451898274857,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=10732 /prefetch:1
      4⤵
      PID:8376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=19816,i,5529200799913857097,9855144780996531466,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19812 /prefetch:1
      4⤵
      PID:8824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=19920,i,6691647696562322898,1019216090060404297,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19940 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=19912,i,931815991285495901,8147459468340448836,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20004 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=20028,i,15927098235238581021,11658214124639985615,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=19552 /prefetch:1
      4⤵
      PID:9264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=19996,i,10306552184969691027,1542094888410418250,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20148 /prefetch:1
      4⤵
      PID:9440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=4340,i,11233283511808611727,15332653253388074477,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20312 /prefetch:1
      4⤵
      PID:9572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=20348,i,7405199483661434847,17228087095103291907,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20352 /prefetch:1
      4⤵
      PID:9584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=20624,i,7893855946952328078,1321301690163474163,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20276 /prefetch:1
      4⤵
      PID:9688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20776,i,11956363193346133390,5919551003107193100,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20792 /prefetch:8
      4⤵
      PID:9768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20156,i,16357831879632417966,16490599666911087789,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20816 /prefetch:8
      4⤵
      PID:9776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20172,i,12258362662441065621,10628759870231804483,524288 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20800 /prefetch:8
      4⤵
      PID:9784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=20916,i,4537802760290528689,17427488169105654304,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20940 /prefetch:1
      4⤵
      PID:9944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=19996,i,266619185492282585,14095252344501411304,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=20028 /prefetch:1
      4⤵
      PID:10140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=21248,i,923885868166369077,16718216220866996173,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21264 /prefetch:1
      4⤵
      PID:9464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=21392,i,508808513896479365,2722922630420756778,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21396 /prefetch:1
      4⤵
      PID:9516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=21520,i,16651508218191359967,1884336503836784351,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21528 /prefetch:1
      4⤵
      PID:9940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=21724,i,12493400101036766619,3792466293688032134,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21692 /prefetch:1
      4⤵
      PID:10412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=21860,i,1880704643083504490,4088114790860381580,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21844 /prefetch:1
      4⤵
      PID:10476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=6440,i,3258398963277296395,15062003280757420864,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:10572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=8728,i,16281377326322144970,9900498698639991785,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21660 /prefetch:1
      4⤵
      PID:10788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=21500,i,12247510818086183853,4499927653502284816,2097152 --field-trial-handle=2472,i,5558643712688782563,5270102815725228180,262144 --variations-seed-version --mojo-platform-channel-handle=21668 /prefetch:1
      4⤵
      PID:10944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4872

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe"
      4⤵
      Views/modifies file attributes
      PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3064

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gjqknsvh\az1qvwnr.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe"
      4⤵
      Views/modifies file attributes
      PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:864

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe
1⤵
PID:4896
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\940vmkyo\cpwwnrmc.exe
  2⤵
  PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3152
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe"
      4⤵
      Views/modifies file attributes
      PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4120

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe
1⤵
PID:5232
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nt04niee\i5br7f4d.exe
  2⤵
  PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe"
      4⤵
      Views/modifies file attributes
      PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe
1⤵
PID:4444
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a4wjf8vm\9l6pc0s7.exe
  2⤵
  PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe"
      4⤵
      Views/modifies file attributes
      PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2828

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe
1⤵
PID:5020
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3couxpru\5nn79361.exe
  2⤵
  PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4028
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe"
      4⤵
      Views/modifies file attributes
      PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4952

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe
1⤵
PID:2400
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4bqdmoe\sohv3kd8.exe
  2⤵
  PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe"
      4⤵
      Views/modifies file attributes
      PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe
1⤵
PID:2128
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fm4xpjfy\irjypopu.exe
  2⤵
  PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4972
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe"
      4⤵
      Views/modifies file attributes
      PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe
1⤵
PID:4132
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjk5kzq\z8zhxw3l.exe
  2⤵
  PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:440
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe"
      4⤵
      Views/modifies file attributes
      PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7560

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe
1⤵
PID:7708
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0yo7app\0j1a9fd8.exe
  2⤵
  PID:7792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe"
      4⤵
      Views/modifies file attributes
      PID:8144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8348

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe
1⤵
PID:7940
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snk20485\wjvnu515.exe
  2⤵
  PID:8168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8268
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe"
      4⤵
      Views/modifies file attributes
      PID:8488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9168

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe
1⤵
PID:8916
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sxx3mgrs\quevzc5t.exe
  2⤵
  PID:9008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe"
      4⤵
      Views/modifies file attributes
      PID:8352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9876

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe
1⤵
PID:8680
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wphyn5j9\ehsx1i8h.exe
  2⤵
  PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9248
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe"
      4⤵
      Views/modifies file attributes
      PID:10088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10744

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe
1⤵
PID:10920
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6po6zt6f\6lko49fp.exe
  2⤵
  PID:11208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjm278cq\ixwgz67c.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9880

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 280KB
SHA256 64c1adf6c61703eb1e84c401780360ca353f2ea7f57262330dd9622f1d1bd6b6
MD5 acbdb68936b1e8ec9384b0125c76f808
SHA1 80e7f3a77fb7f26c092b0f5d972f76bf50f2ff4d
SHA512 6ebb834f713d705a7d2abda964b4d54c6ce9cc43b845bf78ec814852efb9ac7a5e2e56535d9ce875442afe9aa48d5232d43f323fb2e86bb980da01c5716d4264
SSDEEP 6144:oZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMoyRFu51YJk1I:y4MSb7e+BnnPVEOiDy0yjHsRk51r1I
TLSH
T11A54236620977F6AE4785EBE5CDF47A59136A324468D8FC0A42F0534467DB68E3C3CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 280KB
SHA256 c01b1d80e64d36c37014cbedc15ccdcf20e826e07cfdaa2094c6d4e470d2c3b4
MD5 e41b573b17e43967fe3e55c14d5dfe85
SHA1 459afe1e3faf34a5a4698bfb602961f1f296ead7
SHA512 f769ac941ae6ba94b361a03c8c3796f3b811d5a0e4c2aacfc23ebc1ee767daf6d5fadbae4c4d27928d59f5daaa5daee91358b0caf9469e1438ee2786e8a46741
SSDEEP 6144:amiJ2UKW82ExgTbtMXV5WlYdI/CsUcBrRmlwrqfQ+XealtgaO:aALWqxGyV5WlOI2cXmlwG4oeagR
TLSH
T12D5423720D90C077A60628E96F8426B0F119E6C17C52D8DAF1EBD4D035ABCD7E678B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 86KB
SHA256 661b410e7f58ec4f0654ddab9575fdd2f96b0ae70b8f49bba477d4e1a7d3beed
MD5 8c6bc70c3fc04b09a3cfd9009960ba9a
SHA1 3e4fed7f51fb0affc4484cdce1fd8317ac23d349
SHA512 d3dbd1d7fcdf73351fa34d5d315b1896f3151d0977d33d42ecd6f77fc1e7f232e546d82c61c68ad3c43bfdd6fe045b536993239f11bceaa38e6fc3c3797bfaf3
SSDEEP 1536:/WKxFg7/5QIHoKQVfaUX4EnrSCn7uX9eaADgv9FT/QX+lJdU5PsQv3iWMYGvCeuf:/XomVfaUXrdG9CcVFTQOc53uJO5EZn+
TLSH
T19C93125326AF74F92CB2719BFAC54E2F345478122BFA425285BD0C9E078537F9931B88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 43KB
SHA256 23527dd91c3842a9922b483c5d8c066e81ef9daddebf843beeb9060eef46b206
MD5 9919aa488e5957c9a473565c4de111ed
SHA1 8c72a709adf61bb299edd9fb5176e99fe032d079
SHA512 f5d48682bfc604e8e8742864c0890b0f6d277a495e69cb64a915fd1525461fca2e20fa350a7a80cfbaea134c9292010120d401a06a3ced96564dfd3aea5ad736
SSDEEP 768:Lhy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30//oLDWb2KnBrM5:LhyqeUG44t6gecNW+o30/Ea2
TLSH
T1E713F297A7114E2B3F3DA3CD581DE045AE48BAD0EA014CC18E7D69DAF1F60D3C54956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 67KB
SHA256 5c58ee349ace19f6b3f49567f7524c1a0c5636a7ec0ac4a913200df16521033d
MD5 9da2ff5fcf5bee2492ba0d315d11dcfe
SHA1 f8c425d5a3f1d2717cfe27d725cd9b74e2e9005b
SHA512 c2efebc2415a451b30115851b618fca25928429033c7f5a2032ab9c850e9b9c5966c32a434de0641ee3e5728e594cc1a40de0415ebd4c7534bc6aec4b78056ff
SSDEEP 1536:s011/K1vgl6QjIr22LdxebEenSKuxX+zCEDw:Vjgo4Q222LdqEenSKRxc
TLSH
T1FF6302900CB4888F701B7382825A527BEB526B77943FC1F587DE5E6AF8D192C34B6C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 105KB
SHA256 0e8a789210d2e15d3b7922249070a4abf04b8f2c3ca20d559fadebdcdbc3065e
MD5 ac6000daf3f6aba8aaaea3b491af716f
SHA1 b63f44adb4a8289b95fe78082a49a30c47f8a712
SHA512 7f8fa01e51ae39c23bf486b8fee719d877861393e92e4e19d9d0919103b983c9aae197e48a8f43068507ac48d9223a7ff605581f151a3d2c82edc036a945d269
SSDEEP 3072:HGBqPBjrKRj+XbQhubPMs95fIZbLXGZUuaf4ooanvTN/D:HGWgOMhubPMsXKbL2r8B
TLSH
T122B30242C9799A46D6B75AE25E8824134CC91B700CC7E55F2CCC4CA7ED9D323E084BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 21KB
SHA256 d87ee0accef9bf0955a0e85e7e458b19c2bcab2b0ad53f350d3d2b3b6f740f99
MD5 dade4f80440fada5643fbb9b1d5336cf
SHA1 fd6dc9e3ff445614f6627cfbf5418677e8d866f7
SHA512 9fe25a4981983059989e094370016a6b87700eab8feaeb0a6453a8f12bb5a32fa5b00809db98008bc2a7365db6287c786d19ad533c7ad7dc9fe9ab0eb8501b4a
SSDEEP 384:9iRzNDSyRnxox0WG8AC/qxc4ktq4JydBD0HKkW4hFbNW57tG0YO0IGRdtP99WzG8:9SRZnxU095xcZ4nWHKklVY5ZGbO9gTA
TLSH
T1C0A2E1A2F94FF5817E4A90322483C8F44CE5658A9F85ACDD8695CC81E11FA927BCD7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 92KB
SHA256 48116b1c9b20ee76a47b734cdb502dff2818a7856bf844e0f98d3563f84365fe
MD5 f9e9736a256d7707108b94b549680958
SHA1 f11119f200b93c33ef9308ba9bd110bde4f95acc
SHA512 9a5e6870040a029ca99456200cafca47e4bad732883ae10034399f7c5b6543047b46f5766e017a3fd79d75971e8fa0d459f60c6f601eb754dce1e9e2e557a5b0
SSDEEP 1536:qrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdykD:m+dCdU1UKok0HaFA9wRw0YuoqsmGeqO+
TLSH
T1649312EEEBADD166155EC72842D8848F847E02F0C109EBD60F89D6E3813783A5D398D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04d5d1afb58b5862_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\04d5d1afb58b5862_0
Size 602B
SHA256 109662a36fd723b2a35de0ab0dbf768e06664631461b895299393b7292addc88
MD5 4b2373a0f28c39eca177a53ab46e7d59
SHA1 17f4ee5237aa1ca7309a980e89c6d32c4802b622
SHA512 4fe40b9d50bda55e890c1ac4f8bb356dbbf98249f4ef25a962957133f385563710f537ba199220a23cebb883b1671b2b5190e6125d72cc3c5f96e1e68b0811b4
TLSH
T165F0E16B6009F805F62F8FB4C7E2D2258B5285758F9C4AB8A01540D33347835B65D1E6
MD5 SHA1 SHA512 TLSH

Submit Download

051b4259c75dc615_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\051b4259c75dc615_0
Size 11KB
SHA256 58569c0e7e787bbaf08736ed2bbeff42f4a60a31f09c5c0087851b4a30da8c3a
MD5 2d77783483c55d036ad400c8c5210a8a
SHA1 53b1565a3d0285613ce0eac7a9fc7c51d53985e8
SHA512 11f8d46a0bf175e483da69dbde643e9844689b2af003a782716244ea01f8cbeef6e6ccf0cbe2ba812cbd5db0b9b79b94a994764b0d327754d0227154fc9fdd18
SSDEEP 192:6haBpwXI6Kjh259b8MOVRgRt56ahDl0Fy+x8LxjmlO4+IRwkY6D2VBHQ:64gKjo59o1VRo56ahx0FPwjX4+oY6D2V
TLSH
T1B542D50663109A88CE7B3BF4545F4607A33694182EC7FB1380A5F6A17C4D2F64D5B99B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155c9e653a65a409_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\155c9e653a65a409_0
Size 196B
SHA256 c446fce46ffd712596f49770b07e4542a80e284eeab1cdb1902c0c5c9cb43b4a
MD5 7c10e7a4a5ef06dc8c3a6154eaa2b82e
SHA1 8bd8ef846e3d3a8c5574cc529e691219f839025a
SHA512 503ed602435fccd79691bb512ce3369520ef64e5ead2f880e0623e0fca46b87fbd48f63c1c85a13cacc17a0153cb34636b2e9b249f04f5055de694d3fa6a1899
TLSH
T1D8D080ABB31C0905C52D85F4C95F716987F3B154295ED326C0C550F3EF14AB0D106555
MD5 SHA1 SHA512 TLSH

Submit Download

20bf2672fb3ddb1f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20bf2672fb3ddb1f_0
Size 59KB
SHA256 9ec90374adc2db5a9967680ca513cfd9c5a04b7894d7b2fd098be6fcdd5bebeb
MD5 9112ffb6a9bca467a59ea143554c3410
SHA1 57fe9146eeade969f27ace4c2ce9703a59582bf8
SHA512 ddeef9c1ab8d9eacc11f0b6d30df1a69861fc1b67cd1bbf2758bc040e8bf2d573fc96a3ff8b9a9dc3bcb104ddc02a51a08f343f14e37622958576780f9f64b5f
SSDEEP 768:zJ7s3y2fPhA7CaJPQYaTxed7tbBJ9qUwoImdM7r131IGQEV7lfT/2ZVZPNuJIfFB:z9sJPmpn9Tf/zWrkkI
TLSH
T12A53721127909E59CE3A13F011668657B33196843FC7E33375E5A73A7D982F26F0A88B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23c6f1d2f2a9785e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\23c6f1d2f2a9785e_0
Size 283B
SHA256 eca96212d542c63748c312bd47ed5def8caf33d3697ee63420b6ef403e7a6b05
MD5 ed61c62cb891ceb93b8ed0a732c26b8b
SHA1 97308ded88ed0d3fd5f5ca2aa9c7b076e6b81af7
SHA512 37853d7b2535afa3bed11842c6a3ed4a8fecebaef0da10883a3769e0052136c378cdf8399a7c34ed17edb08443b55dbf0ed4a849c00ebe3267b8203baf3c59e2
TLSH
T1BAD0EB073A9D9078EE7C99F0C722E2A28313C034094F829240009022738C534D98C010
MD5 SHA1 SHA512 TLSH

Submit Download

2976abc555e3bf52_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2976abc555e3bf52_0
Size 270B
SHA256 c004bf476ae925df0f2e29e716d3f21cf393f81b765dd9e5a50f0ce4b2fe2591
MD5 6db6b6363e8136554618b7c77bc641af
SHA1 3f5159366fcbeb0414d298911bdc5ad25057aa6d
SHA512 c79a74d60cca109ac584d93d8ccf8419504ba9bdeb3ff360293729e5acbdb71a7396aac5511f86824d3ac0648788fcd6e950f5a55def760642ece7163ad1a3b5
TLSH
T145D0951F305CAD11DD1DDDF4C56DF644F35740540C7E84E050014077F6464A1DA8D577
MD5 SHA1 SHA512 TLSH

Submit Download

4e2c62298355aac4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e2c62298355aac4_0
Size 283B
SHA256 7ca4e72154ad6dacb719bc90416accb7b1085130189d11d7f5916045098286f8
MD5 792206811cbe1c8bb75dc310ee51a3ab
SHA1 3f95c2435c6552f9229100e319a915b1c49c2c37
SHA512 5eef4d41d2629f3619cf6dafc7b2206dd9aab3053c1c78a7c84831f6238c85abfe29e0f13e67b67b92d0ecf104fe17d119eb0243659d6c3e404a4510a1432d9c
TLSH
T1B0D02BDB160C0559F9AEABF4C267A283CB32C04CC8BE85A18206B4B56A156B2E85C120
MD5 SHA1 SHA512 TLSH

Submit Download

5122ae39d44fe2df_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5122ae39d44fe2df_0
Size 270B
SHA256 cd876101f166a6bfdaed6f3d80a501ff5c33edd76fd266c533d2694fa3b1ad3e
MD5 0ba49c89b8c5057b2a07df42b980cb93
SHA1 4b89aca8f3dd8962f959c71b9263fe8131d05f7d
SHA512 45bb081f9465b0f93d919bbf9f59b1324663d77f6691da5880b21b01cd77953d82a602e3d2b1a1c6fdfb0d6453b4a279c5f631f3b49b62b26266ce2e79e21087
TLSH
T1E6D02B5BEB08B630CF5CCDF0C697E10583D19068856A55C3D00A21E67101C7A56A5106
MD5 SHA1 SHA512 TLSH

Submit Download

5cad8ad239dbea0c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5cad8ad239dbea0c_0
Size 58KB
SHA256 a884828ecf4ec6be7591048b1aa5164f78d0b784d415bc4fd3ff46a35507bb9c
MD5 0f2e69ad70cf8d3b6f2ea82ab58ac09a
SHA1 411e11942cd728a96680ee1083ed5b3bd9a4929a
SHA512 1f782e8f05c46de7b8d9eda66308f35ee042671c593e3661c626967c0278313397615e8beffce0809ae4ef69bcf65d6756ae0953847bc01103c6577e9f3d5d70
SSDEEP 768:jG572VoRXiifUkxTUtMlaUYgeeGWh2m5YGINfzWCGQ2nxSCGdjpE+nJv4yn+jwyb:je6kXxFJH6QZwzxJgycYoq
TLSH
T10D4372BD3B647D21C97A6BF141638D17663288047ED3E35B73B09236684D1C92FB688E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d63f53db9cce5cf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d63f53db9cce5cf_0
Size 80KB
SHA256 848446cc17513f019bd09d1e96de254788094a42fcc3bcb77bf14fd1a9f027c0
MD5 e3399d92bbb954042ea483e843c888a6
SHA1 ffc8fa567796f6fbf57df447ab5523cd9f53fed6
SHA512 ee6b361e805d6905b51b0ec1ecd1e95596101151e438d02eb4a56769a6f9fc686f7f6487a94182daaac9086a2adefb1719911dba678705b59de13ad630659eb6
SSDEEP 1536:ev6zo3+ZhhOJ4TmqsXKrhgStvFS+OXycPfiR:kwoOZhhG4T/oKrryywE
TLSH
T1EC832A5C1B90DA46CE6B63F50563DA53A33080095EC7E71B20F4A3B53D8A2F15E9F86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e61da01f6d487a1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5e61da01f6d487a1_0
Size 283B
SHA256 eff19bc3b3b1b1e56e4b5c551bf224c450ccb1196c394458b9e96c0659c55aa7
MD5 42dd2b852bd465f2e1baa40e3811d535
SHA1 905810a43072487ffa7305c2ce565bd46047786e
SHA512 5ba38f215fcb1b865f6c52260e97bfbec9d27ed9dcec5fc29fe39377f22fea862a4814a4ea9de77bd9e2e900c809dedb7e0d8498cef2e18c224894a3c3d90435
TLSH
T169D02B170518142CEC7CFDB9C901320D83E2D4A95DFDCD428008B5F231620746188425
MD5 SHA1 SHA512 TLSH

Submit Download

6cd40617bf35a97b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6cd40617bf35a97b_0
Size 585KB
SHA256 63e2510e22927c678acf41392b742f520398227f4ac715334344e99049223e0d
MD5 c4bb0d36e9fce91e2c06fa430ea952e7
SHA1 a032de44855f347677e235878b452a64b4dbb33e
SHA512 b5fe8776fe62d3a8f159aaaaf47fadc504d7e0be3187aa6c6f93aea6bf99b2cc438a8990afdaf85eecb898cc9c5955943eb3f450004a11330a96ad18ae686d79
SSDEEP 6144:ajk78/7lxkMETYU7v401jnEz3B/g14j+Dgt4kLGD:ajv7rSTYU7Qgn23TegaD
TLSH
T1D9D4B4491790E995CF7623F446A2C953A73144886EC7E72371E8F7393C4A2E15F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f04893b4e75bf53_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6f04893b4e75bf53_0
Size 239B
SHA256 6986c8fe9d14dabe3e9a3a61f744e24dd33ef6308650c544ae94db68a7aca5ac
MD5 71db3090555ac29b55f7ff1e05c18a9b
SHA1 25ecd6687f204f3c215e69964ec95fc0a3d477c7
SHA512 71c66ed0d3af9ad50285fcda7bba171342036e8e2361590ac3abada18f23393af08db61b3a6b22c08553f4e56ea2ae5f66d4fdde999d936f261b3be122f5d931
TLSH
T17DD0A7D717385A81E39AD4F1C367739A93574690A798D280C4055153E3356B07161C04
MD5 SHA1 SHA512 TLSH

Submit Download

79d8b83d138a96fb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\79d8b83d138a96fb_0
Size 112KB
SHA256 d7ae5b6241f9b5680598c46b08e8b82aa648abcec9d349f77b1d5f7b37c98f55
MD5 69ec83a307581922deca9d62886a0444
SHA1 1704e95a5784b995920fed6ae07f77a4ff8c54c5
SHA512 88e7f4304171a3eccfc0a9725358f5d74d407f25da7934b6ce2d9cfc8d273f741cc47fc90d01294b26980ea537ed3b5834dbad557b4cf740448c825c49f0a6f4
SSDEEP 1536:7FfDy3Vj8o1zUunW/Manuw7RZ2Q6/7upKAkidOSutaKBxpkygq:9cVj8oBUr/ManuURZ2Qi5Tiw5tFz
TLSH
T11CB33B4047508ABBDD2F57FA40638916A72041046EC7F71B6271B3627C8A2F16DEFDBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8264b1f0cc6651bd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8264b1f0cc6651bd_0
Size 24KB
SHA256 56808f4eb0122e455f57aa4b1b1131a81a8c64cf1f6291c8ea669bfefbcbce5f
MD5 8af821245dbed0091455085598d894f9
SHA1 afb3044ab21046ce684c15a32d56736d6d71cc26
SHA512 d6be6d997a82df72cf9949034bdd3038e7ee0c23e4e2abe28c461d191ac441f2eb71310ec3899e1256af5074f034cb19fa19fbab2a084521750cd6b04987bd25
SSDEEP 384:riq1JUyQb5UpBiO6AQNFL+EG9WRh5IQSIp04i4I7QM+4CuXZyvV80FXoT7EEK+d:RtARaSFyEK1Mp7VPuAT4l
TLSH
T149B2190117549A89CE6A23F994778E47BB3240056EC6EB1710D2E734BC4C1F27DAFDAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84dd450cd76d33be_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84dd450cd76d33be_0
Size 319KB
SHA256 c881befd5489cafd79d4ba5a781c8e5ee7f34c3b64b785cda00571566a951c86
MD5 09fa07a8b02a574a90f4ea10c68e46b2
SHA1 833878f74763dce0ea65530f338e89a42385ce21
SHA512 53dc111dbb6b648133df76866f369f59beac5f9503d2214d0cf337fd0193d06773e4ed394c8fd6c5d4d1f8ceb52b421b6bdf80270c227a6e25b1fa1060cd2a6b
SSDEEP 6144:Ib0gV7IzIGqChQ55zFOjJHr5bQfyo9KKbGIy6VVEYI:40+aIGqCh1eKKbGIy6VVO
TLSH
T10E648EC54B58F9E3CE2766BD70B10E1A53B540086DD9970A817262623CC86E12FFF9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b75677d1f057849_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b75677d1f057849_0
Size 283B
SHA256 a2b1da5fc5ee01a7bd0fd1a5778d3ee25accb8c6d75ee7aabd4d1b08ca765f96
MD5 1c73d3690456073de89a9583ceea778a
SHA1 20924f8f613b4df9c90fb013ddde4569e296c233
SHA512 9d1cb115474aeaeb5cffac71385c263cd94cd4f8948893b3d76bbefc9c1e5a7f33f21e336c4f092de95a984486ae1f8c27bfecfb1ca8e8b294ad8d98052ad646
TLSH
T17DD02BA7214545B4DE16EBF0DB676346D722849D45DA95A2C01398B22285539A509702
MD5 SHA1 SHA512 TLSH

Submit Download

a6025cc85440098d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6025cc85440098d_0
Size 602B
SHA256 4e58d2bd34db3abdeb1e5cef71693b50cf515c2dd8562556a30945ad3d2d6110
MD5 b2d6abb88ba4b02408b8311f5db96915
SHA1 b75ee322f0d017607c8aba10ee3242566c93e800
SHA512 517c4985438a6fde59116fc1a4c36a94e9ecebd047e4897c8448faf38e76c6cc17135b6b461a6b55cc084c00eb36eda472111aa8e1f79aa75ed7839077f67b2b
TLSH
T17EF0E156E011993BEEA5AF75898BD5050E67A1484D3BB99D300484CB61254B0F92D986
MD5 SHA1 SHA512 TLSH

Submit Download

c475d47576fea13b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c475d47576fea13b_0
Size 174KB
SHA256 b81162214a6fbeda8c3c563dbee5827347f0b0f0c080aa553d0cda6bba5b031a
MD5 5bc01a6f334402d6d5ae3498ceba3626
SHA1 873b2c57e697fa9c5d82e805470909f786d4c52b
SHA512 f413dd1006ee114c3175a7a8ecf33d20bc80f46670d425529c4d4b3ca4e57521eb60d98e5519d1bb55ae170cf5f836d866e7ff959ec59a4ad480d61c1942afc3
SSDEEP 3072:riI8jI0wqn+f6eGmDnPrBO18cAKi3YO/pJ2ImJSO:riI3kO6o7VO18ciIuv1lO
TLSH
T10704085917A0EA85CF6223F801539A53B73590496EC7F72320E4E7352C8A3F15E6F98B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d580846bf0707013_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d580846bf0707013_0
Size 404B
SHA256 1fc16f1aaae3394bee4cca4798a559966544df818897d3216b2c808e945a360d
MD5 c18b1cba4021320ebcd3bef1d36e5e26
SHA1 86e691ca59de3fcf266a8095db1d096875dd1038
SHA512 858060881cd0809104b698e1f97f9cbf5c6e63944b906f53fe1ae294fa422115476315802cfd87c98ab5df9ccc6380087027ae93a2b77f88c2819727854d48ed
TLSH
T176E0F1C706968438DD667CB1CE6B26260BAA00048D1D0491D31724B52F62D34F88E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

dcb6b5c7308ec639_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dcb6b5c7308ec639_0
Size 583KB
SHA256 f6fc4453928c08efd2b7653827ac60d0e893293be30b826da186fbc382e0975e
MD5 1a5515d5f639ea40c5467ead0aa54379
SHA1 0f76ab4453ef3e894bb11e2b8d8be01da2ce9f8c
SHA512 b5081f03103813804c6c7e41ac4797cf36c3ca422bdce534d1082a252f092f7849d1841c8f0444ee2c86129d541af5e726bb4159a0dcefcfdeec243141e0436d
SSDEEP 12288:zmbflx+UNZyPSKFWnNoE5NMTy1x/8xglf:Ej7ZyKxJeO1xT
TLSH
T186D4E7044790EA59CB7623F501A38913A73581583EC7E727A1E5B7363C893E25E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e931ace23a5cbe7f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e931ace23a5cbe7f_0
Size 211KB
SHA256 b18ea85d0da67de2d47e020fe63517771a41a059f244245afc1dc346cd2461e6
MD5 717d9a4330edb987cb64cad3fb2bfd0e
SHA1 81546ed5c22242f3ff52751235a0d62550fee2f7
SHA512 1a3e4b645162a75ace304d90b733c0d470f08ac92fd6c9fb148202ba883bee3f4b8ae0e6b754c82d4a35ff7057592b6fc77b7790fed0390eb0ead453a5cf937d
SSDEEP 3072:v6aawtzIvzvOhXN1i7Yt+PArAyPsH8uJ5lR:7awGT88MaMDuvlR
TLSH
T1E82429851750EE56CE7A23F811734967A73440442EC7E72B21E4B73A2C893E11EEAC9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f73c3ae273e692e5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f73c3ae273e692e5_0
Size 283B
SHA256 e9acfa4aa56a0ac84fc7bbdd62eb6f309409ea924546c88d1b91a2b0578f5e01
MD5 558ef893ab5fee67fcce129fd23a5da7
SHA1 52be3485391d8ba8398438a120c7b71bb85e0acf
SHA512 e415a82d1d326b6acd462b25823b0b3d46485644dfd73bba9a835fb668c07fc938fec0f7c8ae27daec43a5cbb2fff433ed1e780f9196984ef3129d91dbb30f4b
TLSH
T14CD02B2F25487466EDD54AB4C75A6141B663A1560C9D90718402117C2B99770785E601
MD5 SHA1 SHA512 TLSH

Submit Download

f99bf78caacfa8ca_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f99bf78caacfa8ca_0
Size 286KB
SHA256 700d8f104e16ecedfc98ff2d84f47738c68cbb959bb49f36b7afc910cbd7abac
MD5 01f9e4b3bcbafa0f5b0c08d09298139b
SHA1 ad80af03f7ef2150a409b1d42d695c81df91f7a8
SHA512 17d64766563bde98926fa575927ca9ef64c1ea1c70a0bbb65fc0697f17a375c7e8f0c0695ae44a33aad8131e44f8838bb11f0610f278df320f753f35b710c6e1
SSDEEP 6144:ANomPGvGjytkNZ7iy4RxlMN+DSoLqw+hRr6Yigf2p:ebPytkN5p4slyUh1f
TLSH
T16354C5552B90DE26CF7663F54262C953A73691043FC7A31331F4A33A3C5A2E25F5A88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dfd903ac8d8d4c087d7e3a05a9f66c26e63dbc29a315298fb0cbf5cd2132f745
MD5 6644f9dc83f5b3987967f48d0e99f87f
SHA1 d062b4c6ecff0d8a85d2733403a51070e4090b87
SHA512 d1ff447d5dea49c2f58dc5ece74662357b248c19fd2686cfd7cfffa3a86b55a06c4c9e77e521eb04d3c801f85809d7217445c09aec86662d397051eb13d7cbb8
SSDEEP 384:sxZRI7t/fVsriWazIKYn77birqBq/ckV7:sJqt/fqrazO7b2cM
TLSH
T12E72FA06A6345AB78DDBD219FA45BF53D3F5056396904E84A9FCCE1C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 be55bc7723a0c55e2cffb75403f89b2fb16f67552f55d32d89a60d502b057971
MD5 16905bb3c7a15ad476119e1b33e6a471
SHA1 67fef8bfe62f1450e0e34cab03b95163a90edd54
SHA512 f8451ca3d5a59420525d9413fddb9adefc176467b4b236697097191288082f8cfcdf6d9115fa35360bc2d813887ea4ede3a45a798c32e10257b9de12f5e93c3d
SSDEEP 384:sxZRI7t/fVssZiWazIKYRafCX7bb2Cc/8kj7:sJqt/ffZrazdq7bw8Q
TLSH
T1FF720B06A63459B78DEBD219FA45BB53D3F5056396904E84AAFCCF1C04E76EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 263a5ddd44befd8c0e218c6588e107bba07f5632228c907460ff52391b7981df
MD5 d5ef2cc9fbb30e21d9e12ee10495badd
SHA1 60d725bbfefbd1626b2ffe4a1c44775c1d2b9687
SHA512 8f89a9660401f71fcb917fd9f8a7273a1622489e4115df3a2c1806457ddf700b301f2d95fb118329b4799de7cd91af4ad0dbcb4531123981c17a69900f385900
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpysy10LlJ:eY8Od/HEnFhWvFvmXu1ja5t10Lm2NuXi
TLSH
T135F2FA3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1b9eb9d1c8c62f0b928075b593c66481ae11426466262ccfb905c82d7256e771
MD5 dc3efe0f67cd0233b99a0bc2e10a5dea
SHA1 237747a7c250eaccdacbd46188b99e49549e370d
SHA512 f8cd4bd98c0973f10eb02d78dedc066099291cdf15e79f952901a95786506848868cee9701239efc16f38f51680e8055ae3ae27735704675f4ba6966d44c896e
SSDEEP 384:npJiF9CcmyWCs3sNF8TUNTUlIm2QckCr9JzGT9pvBftGp+Mgj4Q4LJopSe4KV8pb:pgFccps3YwgbkUgPjGPVQ2/I8p0PU
TLSH
T1C1C25C35EC64CABBECE74F89B74A7A03EEE0126785D859E4DAD81D0D00971DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 294b35b426ccff028067db498b0804e785aaca6dee9db48e1f69debe2006e3dc
MD5 6646c2fc055423748addb858375a4c91
SHA1 62460fe5e00f702eb81f2f499a6790d9602fe025
SHA512 102289d3a3844fbf7bfea0e5bfcb8a074e94d76eaa9b5e49ee6a9d320536a65e2daf0692e340bf3404c0142fc426b8c54e20e7f673a9eeb120500436860ee3e2
SSDEEP 384:nriF9CcmyWC63sN58TUNTUlI48QckCrauNTQpvBftGp+Mgj4Q4L4opSk33ty/7I2:GFccp63IwghkQyjGPVQx/k3q
TLSH
T165B24936E864DAB7ECEB5F89E74A3A13EEE0126385D889D4DAD91D0C00D71CD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b9eaaf244bdab78ca7093e07d9b715ea1ac971a8c7b0d1a35cae0cc8da10d4d0
MD5 3b1ca96423e77cfe68ae70f68139a742
SHA1 91e52a99c17b0ca1cbe0c99847fd489e05a0c3b3
SHA512 ad5bcf3262613ff5e163de02cc16c636811321fbc4edd3a28e7e0e7968322e954fac580fedebbe4280f56823d82e06b18fa2bfdb43ab290f55b6fae4143434e4
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9liKpvBftGp+Mgj4Kvphe4KV8p0PHTt+:pAFccps3iwgbkUkkjGPVKfI8p0PU
TLSH
T143B26D36EC64CABBECE74F89B74A7A03DEE0126785D859E4DADC1D0D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0cb4e5963b17b9c973556a50c427b827070e2f834b7e2a5b627b09521eb3ebb7
MD5 175b93cae86b0470891abfd30ee76fb1
SHA1 0d8092526110b332d09aafac0e00205b6ef75dce
SHA512 1b2ab23799b7ba378fc211c85908c8882c12be5cf4334eeede562a39289c955fc05c737d27dabff1bb85c658e1a870edfb90c635311a5894cdda63c6cc7c50de
SSDEEP 384:npJiF9CcmyWCs3sN58TUNTUlI42QckCra9yTB2pvBftGp+Mgj4Q4LJopSe4KV8pb:pgFccps3IwgtkK1ojGPVQ2/I8p0PU
TLSH
T189C25C35EC64DABBECE74F89B74A7A03EEE0127385D899E4DAD81D0D00971DD530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8b7f98d-3a3b-43f7-90a2-d4d2a74b414e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8b7f98d-3a3b-43f7-90a2-d4d2a74b414e.tmp
Size 24KB
SHA256 91c583e21b85232434c3b0b0b3ad3d89fbcb62bc01ff1cd630d70d880d2f7525
MD5 20752f27c97d60fbf3fccb464ef0dd98
SHA1 45972ca659f3597c99b5a8fbb9517c573bea0b55
SHA512 f102dd098c75e7bfef3d32c0f8f850df04931810b495200fe499b1067104c1f40ea879043c7b85b0e4ffc8c2781374f0f1ba9531d41aa048a3d374534f0a57b2
SSDEEP 384:nriF0CcmyWC5sN58TUNTUlI48QckCrasEZspvBftGp+Mgj4Q4LkopSk33ty/7IgH:GF/cp5IwghkPcjGPVQZ/k3q
TLSH
T11BB24936EC64DAB7E8E74F89F74A3A13EEE0116395D889D4DAD91D0C01972CD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60442\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v4w69f0r.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\94cmw6bw\v4w69f0r.exe
Size 5.4MB
SHA256 153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695
MD5 6a82d2d716d28e311fa90216fbc78dfc
SHA1 6d25f76325c3c307f68f6d3fed92e2d062ed85e0
SHA512 f9f9f2b4134440522c422cada3d0f32b925c86b6b17f21e4e77116b69a6155c29bd3d866d3a49cefc1c0dca465884cc237c4402ee81075e9b124439321cd7b8e
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMU:9XhICteErownP0oTcMsABqlDQkB
TLSH
T1F7463308B3A80DE1FAB3D13981665221D473B5254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4356-1526-0x00007FF9616C0000-0x00007FF961B34000-memory.dmp

Download

memory/5696-1447-0x00007FF98DFC0000-0x00007FF98DFD6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads