9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b

Analysis

max time kernel
5s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
Size 5.4MB
Sample260818-bxzzwstdlb
SHA256 9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b
MD5 799c425ffebf3cc896d970212f3f6474
SHA1 00816660d58629498a33b182e63b25c4e25d52e9
SHA512 a8a52bebcaf3df6f9a75d758f047bcf6924d34dc28eae59b6cf20ef6c7c26182f35b69f8bd867c96dd78547aa24735491a2cdd18236b2b139e918b757ae3383a
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNs:GHICteErownP0oTcMsABql4Ute
TLSH
T149463348B3E809E1FAB3E03D81565221D572B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2pg1dz.exe	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2pg1dz.exe	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe

Executes dropped EXE 2 IoCs

pid	Process
2640	p6dj0j8j.exe
536	p6dj0j8j.exe

Loads dropped DLL 23 IoCs

pid	Process
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
536	p6dj0j8j.exe
4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\m4dw5otq\\p6dj0j8j.exe"	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
305	ifconfig.me
847	ifconfig.me
898	ifconfig.me
1288	ifconfig.me
2034	ifconfig.me
2202	ifconfig.me
2380	ifconfig.me
30	ifconfig.me
145	ifconfig.me
435	ifconfig.me
683	ifconfig.me
988	ifconfig.me
1431	ifconfig.me
1544	ifconfig.me
1610	ifconfig.me
341	ifconfig.me
608	ifconfig.me
1772	ifconfig.me
1837	ifconfig.me
64	ifconfig.me
209	ifconfig.me
1215	ifconfig.me
1239	ifconfig.me
1470	ifconfig.me
1707	ifconfig.me
1875	ifconfig.me
2324	ifconfig.me
20	ifconfig.me
181	ifconfig.me
460	ifconfig.me
479	ifconfig.me
552	ifconfig.me
741	ifconfig.me
754	ifconfig.me
1442	ifconfig.me
427	ifconfig.me
906	ifconfig.me
1005	ifconfig.me
1127	ifconfig.me
2213	ifconfig.me
232	ifconfig.me
391	ifconfig.me
405	ifconfig.me
406	ifconfig.me
623	ifconfig.me
669	ifconfig.me
1009	ifconfig.me
1578	ifconfig.me
96	ifconfig.me
523	ifconfig.me
838	ifconfig.me
905	ifconfig.me
972	ifconfig.me
1942	ifconfig.me
2296	ifconfig.me
2347	ifconfig.me
118	ifconfig.me
281	ifconfig.me
342	ifconfig.me
1401	ifconfig.me
2391	ifconfig.me
109	ifconfig.me
143	ifconfig.me
214	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5740	cmd.exe
2388	cmd.exe
5804	cmd.exe
6968	cmd.exe
6684	cmd.exe
6648	cmd.exe
8232	cmd.exe
1092	cmd.exe
6088	cmd.exe
5736	cmd.exe
5932	cmd.exe
6504	cmd.exe
1460	cmd.exe
6348	cmd.exe
6840	cmd.exe
7752	cmd.exe
2544	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1336	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4732	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4072	2336	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	85
PID 4072 wrote to memory of 1092	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	86
PID 1092 wrote to memory of 2544	1092	cmd.exe	125
PID 4072 wrote to memory of 4732	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	89
PID 4072 wrote to memory of 5104	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	118
PID 4732 wrote to memory of 2244	4732	msedge.exe	92
PID 4072 wrote to memory of 2232	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	117
PID 4072 wrote to memory of 4196	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	94
PID 4732 wrote to memory of 1336	4732	msedge.exe	96
PID 4732 wrote to memory of 3912	4732	msedge.exe	97
PID 4732 wrote to memory of 3912	4732	msedge.exe	97
PID 4732 wrote to memory of 3912	4732	msedge.exe	97
PID 4732 wrote to memory of 1512	4732	msedge.exe	98
PID 4732 wrote to memory of 1512	4732	msedge.exe	98
PID 2640 wrote to memory of 536	2640	p6dj0j8j.exe	99
PID 4732 wrote to memory of 2380	4732	msedge.exe	101
PID 4732 wrote to memory of 2380	4732	msedge.exe	101
PID 4732 wrote to memory of 2380	4732	msedge.exe	101
PID 4732 wrote to memory of 3048	4732	msedge.exe	102
PID 4732 wrote to memory of 3048	4732	msedge.exe	102
PID 4732 wrote to memory of 3048	4732	msedge.exe	102
PID 4732 wrote to memory of 4880	4732	msedge.exe	103
PID 4732 wrote to memory of 3128	4732	msedge.exe	104
PID 4732 wrote to memory of 4880	4732	msedge.exe	103
PID 4732 wrote to memory of 4880	4732	msedge.exe	103
PID 4732 wrote to memory of 3128	4732	msedge.exe	104
PID 4732 wrote to memory of 3128	4732	msedge.exe	104
PID 4732 wrote to memory of 844	4732	msedge.exe	105
PID 4732 wrote to memory of 844	4732	msedge.exe	105
PID 4732 wrote to memory of 844	4732	msedge.exe	105
PID 4732 wrote to memory of 3752	4732	msedge.exe	106
PID 4732 wrote to memory of 3752	4732	msedge.exe	106
PID 4732 wrote to memory of 3752	4732	msedge.exe	106
PID 4732 wrote to memory of 3372	4732	msedge.exe	107
PID 4732 wrote to memory of 3372	4732	msedge.exe	107
PID 4732 wrote to memory of 3372	4732	msedge.exe	107
PID 536 wrote to memory of 2388	536	p6dj0j8j.exe	108
PID 4072 wrote to memory of 4100	4072	9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe	110
PID 4732 wrote to memory of 1236	4732	msedge.exe	111
PID 4732 wrote to memory of 1236	4732	msedge.exe	111
PID 4732 wrote to memory of 1236	4732	msedge.exe	111

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1460	attrib.exe
5268	attrib.exe
5528	attrib.exe
4676	attrib.exe
6628	attrib.exe
5368	attrib.exe
2544	attrib.exe
3984	attrib.exe
5944	attrib.exe
7012	attrib.exe
6804	attrib.exe
7864	attrib.exe
5928	attrib.exe
6400	attrib.exe
6812	attrib.exe
6656	attrib.exe
8276	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
"C:\Users\Admin\AppData\Local\Temp\9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe"
      4⤵
      Views/modifies file attributes
      PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7fffe813c188,0x7fffe813c194,0x7fffe813c1a0
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,2709906399967442906,496537084787161910,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      System Time Discovery
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,15905499697944604552,3910154142240138944,262144 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14557590416733482970,8488648072998389220,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,308884899544437710,14059346460026038073,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,2829918872764050714,5435671318532786733,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,16662342060151421463,2257636298121116007,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,347817951897384327,4874015125564639661,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4636,i,12077031045823206173,3665341158392059017,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4904,i,13408628153874703539,3115770500456755531,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5068,i,17536470304115091682,5468020956784044274,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3688,i,14862998639349128826,9400053170673361708,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14266510051969817489,1168277634128787857,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5916,i,16294113938500278217,17241878754246283528,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6204,i,15378120772357052441,4043078216299611383,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=1688,i,5618694787538802867,10606944525499752831,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,7403906150207529300,14998684758237736440,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,10330048058150443755,9451384666415899992,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8684,i,4216613486657280049,11510136752629340848,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:8
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8684,i,4216613486657280049,11510136752629340848,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:8
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6192,i,9796303494347018202,12779914761076606018,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6968,i,5330792564508279241,6430654245471930688,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:7092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7024,i,16780887446031702686,2092488413903372301,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7036,i,9925555825747455950,7465316669515872374,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7028,i,18390990600814698691,13458866727830128325,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5756,i,17644465430860386845,7912284736690526516,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7104,i,11014001190895440041,12223604877581972339,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9584 /prefetch:1
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7132,i,18002927153161494440,8555556155743818780,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
      4⤵
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7240,i,2232489982076215275,3744221387939332412,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:1
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7268,i,7891238805382354522,5307847579082980642,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9692 /prefetch:1
      4⤵
      PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7432,i,1919779980796400693,8020742102183350051,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7480,i,16381931196155401381,13348307849013563717,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7436,i,3486230208237135210,7312279148510170244,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:1
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7524,i,8159444775489711408,9441445322635821096,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:1
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7556,i,16456619486519913579,12989695138872237903,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7580,i,6792517024878391575,9058612285149199663,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7776,i,1270264544181245515,14002882500766123089,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9948 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7612,i,14007217075978753661,786362454236776452,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9936 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7844,i,1454708272726227835,16768463998631599135,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10016 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7908,i,671878410960660498,15698678425916164284,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
      4⤵
      PID:6188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7948,i,13862518652551382461,389031967596597316,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8000,i,11453265704084093413,350921627422741730,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8032,i,2970126637869277336,16270813448073481465,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10136 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8068,i,13032554440510062844,3198111519815785288,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8108,i,13408136778987515550,11209135880281211713,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10228 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8148,i,5596733500371534264,17592010657246737982,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:1
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8176,i,14312369741863115811,305823140609158440,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8120,i,18110693939153802172,14430996740203590567,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10352 /prefetch:1
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8284,i,5612905595998477095,8842783990972224275,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8312,i,6528367431942907720,11892970972240225511,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8368,i,13944009972656746046,14021613476849989531,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:1
      4⤵
      PID:6212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8392,i,6079395917484323624,456152708739822177,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8464,i,11942275847080693405,6014154504734773831,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10532 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8492,i,12373593315169511813,12181285722197211600,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10536 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8496,i,111096062626118895,13872886781820618816,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10620 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8524,i,12546479144987546626,1482901347462392385,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10648 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8444,i,304050756834666834,11656389347349491973,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8552,i,11358670037816455658,11381268336390925907,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10728 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8576,i,7479742338982531654,9903111096229686916,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10680 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8800,i,9105985821323005891,12689557904578804783,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10800 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8836,i,1509396750660957767,15987673485428184890,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8844,i,3125611825493471480,10551162204862927304,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10816 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8868,i,17818140030892605565,8598568118186737967,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:1
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=5536,i,8011580530999718834,3329046185250825580,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:8428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8896,i,12472375675304725038,1285741866636860538,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
      4⤵
      PID:8436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5964,i,12971192271885893831,4694543648439044846,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:1
      4⤵
      PID:8444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=5952,i,9348537861131091255,4512055241859771559,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:8452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5972,i,316804986603795517,12925056691947147053,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:8460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8940,i,13868283418364330448,6521770488374278211,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:8468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9056,i,13743728135948298857,7507814164699597112,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=11980 /prefetch:1
      4⤵
      PID:8476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9076,i,6287002703381153634,17235571372992808202,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12016 /prefetch:1
      4⤵
      PID:8484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9108,i,5429596603719339078,15684005234453044261,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:1
      4⤵
      PID:8492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9200,i,7741370510010029911,12757033209559323903,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12088 /prefetch:1
      4⤵
      PID:8500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9232,i,15007194412451206536,14352376377078129318,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12124 /prefetch:1
      4⤵
      PID:8508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9236,i,11372087827151009227,12169709841549859809,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12160 /prefetch:1
      4⤵
      PID:8516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=5012,i,9481006335492700216,8007404143013979713,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12196 /prefetch:1
      4⤵
      PID:8524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4996,i,7168904079949606752,7667807436002239892,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12232 /prefetch:1
      4⤵
      PID:8532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4932,i,11063516458088064270,10298536311321866511,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12268 /prefetch:1
      4⤵
      PID:8540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4916,i,9550636369988564065,14097342503719318688,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12308 /prefetch:1
      4⤵
      PID:8548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9292,i,3812723780212421276,725311873043462071,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12344 /prefetch:1
      4⤵
      PID:8556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9312,i,10658967283265865831,17096886498517499686,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12380 /prefetch:1
      4⤵
      PID:8564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9340,i,13201612298739519528,9699063068205727178,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12416 /prefetch:1
      4⤵
      PID:8572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9364,i,535188122459939013,17189873847375222704,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12452 /prefetch:1
      4⤵
      PID:8580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=4632,i,14483819548754840047,11437705687732813437,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12488 /prefetch:1
      4⤵
      PID:8588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=4644,i,4697719257931217467,15005772559644810118,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12524 /prefetch:1
      4⤵
      PID:8596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=4756,i,3266442162875700886,9255418907332086504,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12560 /prefetch:1
      4⤵
      PID:8604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=4752,i,16219571002457956870,13951638137186963509,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12596 /prefetch:1
      4⤵
      PID:8612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=5564,i,18008527934558119884,9907297367626875103,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12632 /prefetch:1
      4⤵
      PID:8620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9420,i,3795516333044403232,17221119603998205339,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12668 /prefetch:1
      4⤵
      PID:8628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9444,i,5213711734103621338,11817836218031433745,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12704 /prefetch:1
      4⤵
      PID:8636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9472,i,14461880720430080470,407872673460488767,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12740 /prefetch:1
      4⤵
      PID:8644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9500,i,2043158057657588803,17842989720279011891,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=12776 /prefetch:1
      4⤵
      PID:8652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10936,i,3882136339207597748,3211988066966869068,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16276 /prefetch:1
      4⤵
      PID:8660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10980,i,12691610785650597303,1406717650070820995,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16300 /prefetch:1
      4⤵
      PID:8668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11004,i,6200465484122344059,9975099377248954046,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16336 /prefetch:1
      4⤵
      PID:8676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10988,i,10627758276699433896,6992357088391409583,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16372 /prefetch:1
      4⤵
      PID:8684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11052,i,11850534903611668508,7661234856723736059,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16412 /prefetch:1
      4⤵
      PID:8692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11072,i,12734971063582493968,14512953224812719582,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16448 /prefetch:1
      4⤵
      PID:8700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11100,i,5525628155162638609,3768115626938433035,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16484 /prefetch:1
      4⤵
      PID:8708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11112,i,15327674879991328636,14696721533663441604,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16520 /prefetch:1
      4⤵
      PID:8716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11160,i,10086002893465487565,13870313953790188079,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16556 /prefetch:1
      4⤵
      PID:8724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11180,i,15277324456999036351,17454109302491903344,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16592 /prefetch:1
      4⤵
      PID:8732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11196,i,4689197586666310547,664946258719683355,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16628 /prefetch:1
      4⤵
      PID:8740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11240,i,8200243837897651500,8800771907506955186,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16664 /prefetch:1
      4⤵
      PID:8748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11252,i,7598853549736294792,17124506629272596629,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16700 /prefetch:1
      4⤵
      PID:8756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11248,i,7362683843862736904,13226826316688234367,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16736 /prefetch:1
      4⤵
      PID:8764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11316,i,12039163078049004618,4475057898216059769,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16772 /prefetch:1
      4⤵
      PID:8772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11360,i,6617087740294759248,8993338307687095702,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16808 /prefetch:1
      4⤵
      PID:8780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11384,i,14641097925317180693,8326953070780619122,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16844 /prefetch:1
      4⤵
      PID:8788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=696,i,7494852549988230071,7974699205619038577,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16880 /prefetch:1
      4⤵
      PID:8796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11444,i,10741719411762685624,15005193628937276341,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16916 /prefetch:1
      4⤵
      PID:8804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11412,i,13902084788583620510,12173564315058309142,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16952 /prefetch:8
      4⤵
      PID:8812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11436,i,16922822889790423305,412301881525914217,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16944 /prefetch:8
      4⤵
      PID:8820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11440,i,15333325017398422746,16850241822385363089,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16972 /prefetch:8
      4⤵
      PID:8828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=11484,i,14423210060696041469,9909080413284814172,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16984 /prefetch:1
      4⤵
      PID:8836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11452,i,13032972065506023409,4263316636973364967,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=16996 /prefetch:1
      4⤵
      PID:8844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11516,i,12712371841417888419,10517102683456991350,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17012 /prefetch:1
      4⤵
      PID:8860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11576,i,1517962090257280900,14287789173082711207,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17044 /prefetch:1
      4⤵
      PID:8868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=11604,i,8440439696074335146,10594611902774557688,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17064 /prefetch:1
      4⤵
      PID:8876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=11668,i,3714227219296478643,14701970459891559714,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17104 /prefetch:1
      4⤵
      PID:8884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=11696,i,16726755323386276285,12550628888483759393,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17124 /prefetch:1
      4⤵
      PID:8892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=11644,i,17603405238462625203,5121591028829134482,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17084 /prefetch:1
      4⤵
      PID:8900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=11716,i,8419550186557150361,3163403156459863435,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17144 /prefetch:1
      4⤵
      PID:8908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=11744,i,818443032888699103,1030588266326646449,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17164 /prefetch:1
      4⤵
      PID:8916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=11768,i,1456182102760174613,3366641990290633404,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17184 /prefetch:1
      4⤵
      PID:8924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11796,i,3094951616475820737,576411728303048910,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17204 /prefetch:8
      4⤵
      PID:8932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11800,i,3844055989916866403,14053198699296892137,524288 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17016 /prefetch:8
      4⤵
      PID:8940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=11868,i,2865769417696933103,11915437482337335618,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17276 /prefetch:1
      4⤵
      PID:8948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=11876,i,9799508258105978557,10247560374830402922,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17280 /prefetch:1
      4⤵
      PID:8956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=11884,i,17918834287252458592,5239638532902894241,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17292 /prefetch:1
      4⤵
      PID:8964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=7388,i,13440264941632490201,2989326295796014551,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17304 /prefetch:1
      4⤵
      PID:8972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=7368,i,1309799894415821484,7106399117940105255,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17344 /prefetch:1
      4⤵
      PID:8980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=11880,i,10138378165207914743,3502931876046941898,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17324 /prefetch:1
      4⤵
      PID:8988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=7328,i,9544895515835322200,15392226758270634001,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17364 /prefetch:1
      4⤵
      PID:8996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=7308,i,7950297619874941911,12952443477066279434,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17384 /prefetch:1
      4⤵
      PID:9004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=7164,i,18327148697814470076,1824586303431512047,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17428 /prefetch:1
      4⤵
      PID:9012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=2228,i,13773897933836488778,1510880736546465434,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17404 /prefetch:1
      4⤵
      PID:9020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=7140,i,338016221879749777,9711608608791819515,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17468 /prefetch:1
      4⤵
      PID:9028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=7092,i,2796877476153973037,7216708184225563888,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17448 /prefetch:1
      4⤵
      PID:9036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --metrics-shmem-handle=9188,i,16396315181400305118,18003051984763387071,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17508 /prefetch:1
      4⤵
      PID:9044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=9156,i,2645127465882216676,5867846119748777005,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17488 /prefetch:1
      4⤵
      PID:9052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --metrics-shmem-handle=11952,i,15495524348149106979,4922498259630381381,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17528 /prefetch:1
      4⤵
      PID:9060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --metrics-shmem-handle=9168,i,1858779537488142859,3496132189881614424,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17548 /prefetch:1
      4⤵
      PID:9068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --metrics-shmem-handle=6012,i,14987885661848791875,6417662018880950611,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17568 /prefetch:1
      4⤵
      PID:9076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=11556,i,11768210805333285568,1089482910848266153,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=17024 /prefetch:1
      4⤵
      PID:8852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --metrics-shmem-handle=21100,i,5227867082637267415,5849331244423036692,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25288 /prefetch:1
      4⤵
      PID:8240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --metrics-shmem-handle=21968,i,15327273614353571466,12141040372319091427,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25180 /prefetch:1
      4⤵
      PID:8308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --always-read-main-dll --metrics-shmem-handle=21724,i,4195908028220145980,17563609490245456034,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25360 /prefetch:1
      4⤵
      PID:8356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --always-read-main-dll --metrics-shmem-handle=25196,i,12970672500085259267,15904032567212217029,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25384 /prefetch:1
      4⤵
      PID:8388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --always-read-main-dll --metrics-shmem-handle=25772,i,16364285491998611524,14050181101841153149,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25788 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --always-read-main-dll --metrics-shmem-handle=25912,i,16100339315351109660,17724715777720890818,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=25932 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --always-read-main-dll --metrics-shmem-handle=6892,i,11180815443493998874,14481143513390971508,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
      4⤵
      PID:11080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --always-read-main-dll --metrics-shmem-handle=26628,i,10224673471549088734,5086838444142345442,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=21412 /prefetch:1
      4⤵
      PID:11188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --always-read-main-dll --metrics-shmem-handle=21512,i,16071486223190045033,9813467549163325065,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
      4⤵
      PID:9200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=155 --always-read-main-dll --metrics-shmem-handle=27860,i,15750306652112853575,8265433808755788494,2097152 --field-trial-handle=2132,i,14036356960260834328,16654277444574933789,262144 --variations-seed-version --mojo-platform-channel-handle=27696 /prefetch:1
      4⤵
      PID:11288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4100

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2388
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe"
      4⤵
      Views/modifies file attributes
      PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5104

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe
1⤵
PID:1068
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8s257i2\b9t4n131.exe
  2⤵
  PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2544
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe"
      4⤵
      Views/modifies file attributes
      PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5344

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe
1⤵
PID:1628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gj22osz4\dmjqrk40.exe
  2⤵
  PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1460
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe"
      4⤵
      Views/modifies file attributes
      PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe
1⤵
PID:5476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6daqkuet\a8rm4odn.exe
  2⤵
  PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe"
      4⤵
      Views/modifies file attributes
      PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe
1⤵
PID:5348
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q1kqdt4v\y0yzpe0v.exe
  2⤵
  PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5804
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe"
      4⤵
      Views/modifies file attributes
      PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5624

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe
1⤵
PID:5436
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5retlhea\iwgmdh6m.exe
  2⤵
  PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe"
      4⤵
      Views/modifies file attributes
      PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5344

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe
1⤵
PID:5212
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9h3h1vvr\ivwtjhb2.exe
  2⤵
  PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5736
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe"
      4⤵
      Views/modifies file attributes
      PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5788

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe
1⤵
PID:2852
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ylw8av6\3iv9zyj3.exe
  2⤵
  PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe"
      4⤵
      Views/modifies file attributes
      PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6284

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe
1⤵
PID:2280
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5wq08jc1\qq6mppt2.exe
  2⤵
  PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe"
      4⤵
      Views/modifies file attributes
      PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe
1⤵
PID:6720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xb1rxij0\tphdb32l.exe
  2⤵
  PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe"
      4⤵
      Views/modifies file attributes
      PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe
1⤵
PID:6372
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mezr869r\h9ozxwql.exe
  2⤵
  PID:6536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe"
      4⤵
      Views/modifies file attributes
      PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6532

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe
1⤵
PID:2732
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aziu25nt\ky0vc4zl.exe
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe"
      4⤵
      Views/modifies file attributes
      PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6688

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe
1⤵
PID:6932
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6hm78uco\dwmc2xa7.exe
  2⤵
  PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe"
      4⤵
      Views/modifies file attributes
      PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7212

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe
1⤵
PID:6500
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88hryiz6\hqy7t628.exe
  2⤵
  PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6840
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe"
      4⤵
      Views/modifies file attributes
      PID:6628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe
1⤵
PID:7652
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cz2n9s56\7vogydgn.exe
  2⤵
  PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7752
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe"
      4⤵
      Views/modifies file attributes
      PID:7864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7560

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe
1⤵
PID:7384
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8nwxpv8\c5ii20jb.exe
  2⤵
  PID:8200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe"
      4⤵
      Views/modifies file attributes
      PID:8276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe
1⤵
PID:12244
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3ppd2m1\cyf8em0q.exe
  2⤵
  PID:10528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2e24e08605c7cfca52b6d268d14d7afc67a5d9586b645c6f44aa25690cc0e303
MD5 4f4cd3ded1d1752b942c3addbebf89ca
SHA1 5fc0017fc251880a23bbf0593cb282f9a57583a4
SHA512 97c207a1b02c7e1049bb472d38ca09950697a0b231fe72a08ac3be1dbffb50841a7a605c2c037794a7e6a9554e1f3c8a08fff73a8459871d52d522effc66ac0a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 280KB
SHA256 e8494c0c2d754ad1f9729dbb1b5c13855fb856251396d2cacd1d67d9e79dbaad
MD5 615e3f30768be282c75ff348f25548fe
SHA1 5a0f0554eb3e1403b1847f6f109511d969c680a0
SHA512 245140c4db365e7393df5602392b89b4795315dac53f3a567675ca4f3b0a22c474203adf62cd9241638c05267e4f96f726ed03d05fc6d3a4dc6177a523b1dec6
SSDEEP 6144:WZAlMSb7e+BnnR9VEOfFoD9loWXsJPu6afo2OOI3PKWnF:U4MSb7e+BnnPVEOiDQGQPuk2OOuyWF
TLSH
T1F95423A4B49DFA55F8749E7C45DCC9428239F2B0429EAF948D3A103C8119DA4B7FB872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fa867fcab0aa617cd9c7aeee6ab0e097cde0c74b501b07f85708cb97a3d85952
MD5 5541f220ceb8b06ee44140b70a1024e4
SHA1 651147eafde8dfd4dea54fc466fcd9b4529d2ec5
SHA512 2aff00517ac7dcea6c85d065326e7744fe57413d13753030db2191b03021b99490eeb22aed354d15327c4f3062008784e83561bc5cb86e5085cea25e1b0882ae
SSDEEP 192:sxZ4RByM/jK1Ml8Mj+/ffsHWS5EdpLgMQFI/W6+WNiIn9gvfYBTDaPVdIgyJ:sxZ4h7+/ffsH/yMEbtGfDO
TLSH
T16952F9126A3459778DEBD219F911BB63D6F50563D6900E94AAFCCE2C00F6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 229927f535b5d31acd8b6c12017de1ae92f3d8285c96864053eac667a1ee04f4
MD5 fd53427faa49eecc689f0559e1e8438e
SHA1 59174ae21755b1dad5c919bed0aa97eda0d7481f
SHA512 3c1f7e69ae08b1a764fd60b0a37a33e730428ad35fbee9b87bb954604719822e15ce2d7c76a3698aa617f573a9f885793348028ea35cf4d5eaccee14246cd3a9
SSDEEP 192:sxZ4RByM/jK1Ml8Mj+/ffsITSyEdpL1OQFI/W6+WNiInluldgvnmI7/YBTXlaPVE:sxZ4T7+/ffsImFFEbtWmm0/VO
TLSH
T1F862EA126A345A778DEBD209F951BB63D6F51562D2900E44AEFCCE2C00F6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 248f892b84df48832dfd67e5babc533a4f9626b189f334bde49ef661ab5ef61e
MD5 0bc70f172ee35a317edffdc9fe256b2b
SHA1 c2c09895f8c25fe60079a19c5310f342fa41b667
SHA512 c40fa4e9670c30a0b378aa814ddb48700238d015075c504a27c03c47dcb4f9d742bd7ed1f43f77e43c6b1fdc92af731343a0d1e38e0cc81c1bd818e9891d37d5
SSDEEP 768:hBs6pY1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmILlWwJNyrocs:hBs6pY1WvxzWju1japILIsNpcs
TLSH
T1A9E2FA3B680CCB7E4F841E5CEC2A6F976DD801CBAB98899447EA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ada1da70695cdc3255f277bd56fce5fd9c16300df688e94e11b87374f5513b95
MD5 7a313285f525a5a03268161788131b0f
SHA1 b5bc0a256fe6dec35c5be7798d8b946f80137ed4
SHA512 ead288c92f6efee56af8355b344dbc60f0ddb234c5ec098eeaea84f39ae5a70889769ab6f7679d7fcdc884e3e6a2153bf4cc5d04276c4da4cc3132682cc54c1a
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIypOIPKTC8pKIPK3qkfyp0IbK9Kcm:KUAAKteP6OYKTCEK4K3qmq0gK9KJ
TLSH
T113B1E05271BF06022D7E2A0EA2549727A7427163301DA42B37E950B51EABE384DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6644d0e40f635835e29eb18cc167441f977b422ac4a2c06582850c8b72a8ba62
MD5 dc8ecf125cdf06b37b7febe5d37d95f9
SHA1 94cc48bd1e338d53f2d261f361bfd80f2bbe4167
SHA512 9b073b24d88c66575735cf7c4560a5ce96b17b25c155d602cf6d9b299659784c88058d6c830cf19f2b8edd61a50f9a70664dee45bb12a8c53a05601a3ded5aa2
SSDEEP 192:qONi6O7+3hQmiUy0AGttb0gO2KDgGTqdU6:qONi61QGt95OVH+dU6
TLSH
T13B02E8357C282CB78EF2AD45FA8727279FA5113BE9962F40D9E81F0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2cba3c30879f02cad698e6c6eab640981d65a67e19f8637a5db7aebc9b9da026
MD5 48b0efbee745469161192b37afa4f751
SHA1 68c8a1c5cd7e7a78dff7b6904f251c57042ffbc3
SHA512 c7d9b5147fe9bd6a21683c916834b11bd270f87cfa84d9c16ca37f04455f54ba1a165cda632ec1bf5b6e413e72eb5f059eb0c59b74a84633cdf0ee26f3780c14
SSDEEP 192:zOsNG+QP7+3vZKQmiU1jKjd11atb0gO2KnyF0SJrycMqqxgNGm:zOsNG+rwMjdPa95OVnuzJrueAm
TLSH
T1E24219356838AC6399F7E146FA8B36679FB410B7CC851F40E9D99F0C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ec9752f7a21f0ae3a5eeb47b68f0fb2823b43c6c14eabbdb5e00d1ccb73ed699
MD5 79612f0e217ee20a318f759f9e948417
SHA1 75bdae9abb3a0ba05d9a6b109c21cbc6243379f4
SHA512 6301a0145d9a932fd5a17e69126a767f33410cfe3012201e3af349f0261a807a1ba6c392956c201d87d837a8e877f3dcec87fbc5063e5ca32ca6437d3b64965e
SSDEEP 192:zwsNGeQP7+3vZuQmiU1KKjdGyatb0gO2KnyF0SJrycMqqxgNnm:zwsNGer8Rjdha95OVnuzJrueVm
TLSH
T1A7423B356838AC6399F7F106F98B36678FB410B79C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3b7299820b6fd36f8bb6277cdbe6e9c24f529f8119f06eaa4d5c48390391e20d
MD5 f196209b5f6eea92e44f819260f4e5e4
SHA1 aa9e116ee1cbfdefd0780c469a4a25b80699028c
SHA512 f675c9e5b7b6cb322f635d06ef3d9a5557886b1fb74df803098497417bd5390575ba6905bd2fa83fd54338938ab02192c3dcb491f09e71baf4f1f1c648f99f3e
SSDEEP 192:zxsNGeQP7+3vZqQmiU1+Kjdi2atb0gO2KnyF0SJrycMqqxgNnm:zxsNGerAdjdxa95OVnuzJrueVm
TLSH
T16E422A356838AC6399F7F146F98B36678FB410B78C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 39fd3b6801465e36898cffc28620668df10a3def9a636c39409bd40a7703ad56
MD5 b32a0b2724f5aaf3726dad63aba431dc
SHA1 5ec0a4db6406f7e603c3c6c63a79a584d672857b
SHA512 e1e12903f410e95757c4c6c7a6ba2e791e9c68a64d8253c8a10cbf69ac6a8071c0e55bd4449837bc040a292882c3fbb0fb367fd3a8e5c2b4f848bad9e30e4c1e
SSDEEP 192:zSssNGeQP7+3vZt3QmiU1GKjdSmatb0gO2KnyF0SJrycMqqxgNnm:zbsNGerppjd5a95OVnuzJrueVm
TLSH
T1A4423B356838AC6359F7F146FA8B36679FB410B78C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4f3455acbb759dc9ed083c14a7df713c6cbe62fc86967cc6f4de8a25c838ba45
MD5 b94a8cba030ca63fb97f81019d9f2fa4
SHA1 81b501e62b092ef69bff39dc3f8c37a3c58556a5
SHA512 9f6e6248cf49fe3726d61797fcff52d4cf0ee51dcc31c7812585b171f6bb804de2020ba51da6f8eacf66b019303a401f6dacab9b2f64fd65578f13b86cc357e5
SSDEEP 192:zSssNGeQP7+3vZ3QmiU1TKjdhJatb0gO2KnyF0SJrycMqqxgNnm:zbsNGerDEjd3a95OVnuzJrueVm
TLSH
T19A422B356838AC6359F7F105F94B36679FB410B78C951F40D9D9AF0C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1292579ee3895d733bdeb2b9adcfc6ea54ffc75404f4d2a823e92b6059c082ca
MD5 a4c77f18435d250166a03d80407aa568
SHA1 1b8bacc187fdaaf8dec3140d3c360ff200ccd0fe
SHA512 ccf21c006d61f6ffc7beca439febcd2db6d07b4a11f322ea8635d5819102f28b95d806d902735fd702b5c33cf2a71a82191ff7e7b63298f96ff614f8463bb570
SSDEEP 192:zSKsNGeQP7+3vZUQmiU1fKjdVkatb0gO2KnyF0SJryLMqqxgNnm:z5sNGer+gjdea95OVnuzJrLeVm
TLSH
T127422A356838AC6399F7F145F98B36679FB410B78C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 97544ade44a10dcef504aff9e769d3b44d0fdf2c04074b6c96b1a117021d2bc6
MD5 b51e1f7eb0c410606ba007f2f7bdb605
SHA1 f5ebe7d1c7fa3bf6ad050381650c223662fe37c0
SHA512 f13516334ed11a20c710a034f5261ef2a825cfe436a1a82b25f144dbf459bf451e9c999809ababe1480b9da169a7e60849d067a21887c4376971acd0464e7b2c
SSDEEP 192:zSNXsNG4QP7+3vZ4QmiU1NKjdjuatb0gO2KnyF0SJryLMqqxgNnm:zSXsNG4r+2jdKa95OVnuzJrLeVm
TLSH
T120423A356838AC6359F7F106F94B36679FB410B78C951F94E9D9AF0C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2b0b316bd61abb99beae5e9171a6210f21940050784bed6a26e84ca87b674b7f
MD5 aa16a728b493ab8b08adc5c570826cf2
SHA1 356a23c337587a6b3c3f43dd01227b29cf0cf73b
SHA512 d6ed3c2b1d066c3b0498c48371cac47033c5b86cae64225dab901b650d1bbe03f12e18f2b65dda150346b726ffb80c3ceac26cd0d701d529e3b7024a399644e2
SSDEEP 192:uuS6sNG4QP7+3vZMQmiU1MKjdzstatb0gO2KnyF0SJryLMqqxgNnm:nxsNG4raXjdzMa95OVnuzJrLeVm
TLSH
T12F4219356838AC635AF7F146FA4736679FB410B78C851F84E9D9AF1C00CB29C270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 550e548bb1fb2e6f64b99b9ab4156d38c9a6395496b02a1bbb44273275238d12
MD5 ff3f827dd64f8dd908e0b50ee02b609b
SHA1 4ab224216d521b00b3638741aeb6418bda3d7fa4
SHA512 409f48ebaff46c88f49577f5619adb19b53373baaaf53d3f048c48c8633bb47a5263eff5d7ced43b4c1126660f5d868559244868a937228b2f40791cf1bb85f8
SSDEEP 192:uuSHsNG4QP7+3vZ0QmiU1CKjdmnatb0gO2KnyF0SJryLMqqxgNnm:nUsNG4rexjdka95OVnuzJrLeVm
TLSH
T15D4229356838AC635AF7F145FA4B36679FB410B78C851F84E9D9AF0C01CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee0acbeda57dd4f9c33043ae2c2102ec5e1537e65f429e1e6a0f81418f56e829
MD5 1d8848bfec4745b1a9bab6b39cb7afce
SHA1 fdf9c0ae604218f884e737e3fd0677e7a5c5e284
SHA512 4a602e70ce154cdc4cbc40fa65428cccf9623e0b3b286cd94110975aee335e49b09c90485429c05e1ce2649dcd79b2eefd109cc79aff94d6a50998a22456e3c0
SSDEEP 192:uuS/sNG4QP7+3vZqQmiU1ZKjdy7atb0gO2KnyF0SJryLMqqxgNnm:ngsNG4rACjdYa95OVnuzJrLeVm
TLSH
T1DF4219356838AC635AF7F146F94B36679FB410B78C951F84E9D9AF1C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3c2eca1ba6cf80908d8e8ddbca86a8ac26f6e30a22c92c8fdaa3a4ec21f95d9f
MD5 ec1ce2faf618c2cba7cca222bf45cab3
SHA1 3d9d76f6bef98a904ce7a044d5259fda842e7073
SHA512 cd43e161a32042b21e4474314eb231c2706d73601e160fb167d5d6c9678143e6936b049b53cf9059d61a5ff438c0c44adf0b60dbe0bce1eac1e1b53c43728e0b
SSDEEP 192:uuSJsNG4QP7+3vZZQmiU1cqKjdWXatb0gO2KnyF0SJryLMqqxgNnm:nesNG4rJWjdYa95OVnuzJrLeVm
TLSH
T11C422A356838AC639AF7F145F94B36639FB410B78C851F94E9D9AF1C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1abbde7682bdf1e61da153a9c9ff2e2d54d076bc85c932f558fd2db69e477822
MD5 af51427f0fbc756c17d29a17f5e79e74
SHA1 0a8db3b042097b550e94a3c6e0154a440f2f8b3e
SHA512 34562a2e12898cce1d8f8dd94f52d6eaada03149a2f10616c041fb8b8018b37ce5505da654954f243009397f109b2464b29508f867c1f49af778857fcfda90f0
SSDEEP 192:uuSPLsNG4QP7+3vZHQmiU1vKjd5gatb0gO2KnyF0SJryLMqqxgNnm:nIsNG4r/4jdia95OVnuzJrLeVm
TLSH
T1FD422A356838AC635AF7F145FA4B36679FB410B78C851F84E9D9AF0C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3993fed9cc5ae57cf89a72c8bf13d59c29528331d5bc04d529ddc4c563c46642
MD5 59629dc5d2a4756e055a71922f1aa70c
SHA1 985ba7823c493b2f0d7950168ac2198a73294ba3
SHA512 c8487f4b469f8a697c909f7188f3641477774bd96b7be48ac5e491a805e0b088b1908d07b17ecab4d2e294930bf599aff796a75341dc327a41035a52ece27b50
SSDEEP 192:uuSJsNG4QP7+3vZQdQmiU1ekKjdO/atb0gO2KnyF0SJryLMqqxgNnm:nesNG4r6bqjdYa95OVnuzJrLeVm
TLSH
T1504229356938AC635AF7F145F94B36679FB410B78C851F84E9D9AF1C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 231cac96a9433ae4c4bcd1336befe0b48dcf99fcab827e908203063abe6e026a
MD5 7ef0ab554e7c9f2c47c01501bef2f7f1
SHA1 d05c38a61857eaf7a286816bbcd936a6357f527e
SHA512 dfaea9b789ab5ea947d0511440aade0b7bbea6461bb7123c397075a47b6cb22a85521d7b13153ae8767e1ed09cb242d13765e379271b61f948d52c801152d832
SSDEEP 192:uuSWsNGNQP7+3vZ7QmiU1JKjdqjatb0gO2KnyF0SJryLMqqxgNnm:ndsNGNr/ejdwa95OVnuzJrLeVm
TLSH
T162422A356838AC6359F7F146F94736639FB410B78C851F94E9D9AF0C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b393267412f6cbcaa426065ef528b51dc75b9a433577591c18fb02fcbbb5ffac
MD5 361d35b140a9545a6b002777c1483f5c
SHA1 636ae097b4a1ac8a34bfa74f599e4a70f81e2efb
SHA512 a62b986489521ee40cd17d5e451fd97f1ef5b6c2894d739e5ff65b3112638c1203b28e05d9d1761af4b12f132e1d70450bc209c11d9baa090a761ae4e7fb166a
SSDEEP 192:uuBpsNGNQP7+3vZ7QmiU1EKjdZQatb0gO2KnyF0SJryLMqqxgNnm:n3sNGNr/zjdWa95OVnuzJrLeVm
TLSH
T1E4422A356838AC6359F7F105FA4736639FB410B78C851F94E9D9AF1C00CB69C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 971715b2b64865e8a73e68dca52a046cafd0aed575aaf3f256eaa5c7357562ab
MD5 7ed27f2ec3db54e9a60d923ca33227f5
SHA1 a3c9088f000edc992d849138ca0474b9a86c44d6
SHA512 b93c7d31c72e056455ff165a1b28f367e861ce957ecc45d37d0d7c7d51f38d4312134abf14b4cd1d56926fb8bbab57a2e072bdfee65660b0d1bfd1bb5b98f322
SSDEEP 192:uuBQsNGNQP7+3vZoQmiU13Kjdc5atb0gO2KnyF0SJryLMqqxgNnm:nGsNGNr2AjdYa95OVnuzJrLeVm
TLSH
T16C423A356838AC6359F7F146FA4B36639FB410B78C851F84E9D9AF1C00CB69C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e587ef53b057338d20cb438b0e25338c64ffa8a4300c70306c4f3c1dde29545d
MD5 8c816481c47a8d703e662319d16284d2
SHA1 83207a93857919750cdd18b289dd9bbff9007845
SHA512 e35392130a3c3a80baaae418ae8dba5e6c9b79b64303e457f8460bf673565ab3d236cd24b575be25ede0ccec6d6f805e68a64203eff52b5ccea453760162ecba
SSDEEP 384:n53yFaeO81sNGNr29jdaa95OVnuzJrLer2Yq9m6BMMj5kVR:53Izh1gjdjOJ2hLeaX9m6yMm
TLSH
T15A927C7478346CB7A9B7B101FA473267EFA4107B88D52F54E9E99F1E00CB19C274B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e7693143f3f7e4c9134900ef906ac6012ec655d09014cbb94b63efde6a66e17a
MD5 caab69b64d64ef8225c9b0417e720b3c
SHA1 721215a7715e6f201d161e1872e3a5d6c61e8626
SHA512 c655fb560d27cad8cff8a58cedd69d6e3ab84f388b0fd1850c20870d3b20e680928a3d166aa956742e56669da2f94bf05c24a4b4d25a947e6310bc70764e4f2f
SSDEEP 384:n53yFaeO8psNGNrgsjd4a95OVnuzJrLer2Yq9m6BMMj5kVR:53Izhp3jTjOJ2hLeaX9m6yMm
TLSH
T107927D7478346CB7A9B7B101FA473267EFA4107B88D52E54E9D99F1E00CB19C274B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 565b37ea3f8c64c7dd839322c7243140f530ed29dbaa1edb8a20ffe603650589
MD5 328e857919d31bdf18bc8a6ea5569d10
SHA1 22bbe6673eb8dcc6428e7cb3f8aba4e14d65440b
SHA512 6b63d7be91d15888c6268dddd818d71fd17b91a333b70a673a21ceed27eeada09fa117c4ebb256d1db495cf672e29194463d5ed5cc24ee48f2ab8f75c67d444f
SSDEEP 192:uuSAsNG4QP7+3vZbGQmiU1iKjdjuatb0gO2KnyF0SJryLMqqxgNnm:nHsNG4rBi1jd6a95OVnuzJrLeVm
TLSH
T1E54229356838AC635AF7F145FA4B36679FB410B78C851F94E9D9AF1C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 57af87160a5029654d0d9bddb1e658836a06b75812f6c2857ca7682f6bbf674e
MD5 c16411baf99d7eeeaebf3839c8a018a2
SHA1 454c457822b40d6aaf5b53edfd95468fd3c924a5
SHA512 e9da0d56d5016fd5e8edb76f2a0f9552573f892032fad29dbbfb155ba99ebc8c5ebea4255281bc8f19e1c4e10aa168ece6269b1fd45fa3ee023c55046a008ee7
SSDEEP 192:zwsNGHQP7+3vZYQmiU14Kjd5xatb0gO2KnyF0SJrycMqqxgNnm:zwsNGHrajjdfa95OVnuzJrueVm
TLSH
T181422B356838AC6399F7F105FA8B36679FB410B78C855F40E9D9AF0C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e8e2ec5af585efef4c7dad1c80ed4c8b845c301807e050e6e7263e2d7f1f1427
MD5 4d0c03532c20298c1547ca172d4add33
SHA1 ecebd07dee8d36023a97ed0bce8623dd18b5163a
SHA512 94045b828cc57bb4a6cf6f42e36d630145d100d0a3f79b456e1ab9867495034b02363002c31f71660492bcc05b21bf7f30f2efbf59b817da07b0fa5a8599ea89
SSDEEP 192:zRsNGeQP7+3vZqQmiU1MKjdYgatb0gO2KnyF0SJrycMqqxgNnm:zRsNGerAvjd1a95OVnuzJrueVm
TLSH
T139423B356838AC6399F7F146F98B36679FB410B79C851F40E9D9AF0C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 044ef3c51e250e429c8bc8751148b494d2efd1d1f271ed7711109e199223c848
MD5 b70cc116739e76807081f0f1aabf0e87
SHA1 34c5445852a65138432cceed4baf60a9c0271929
SHA512 ea08160a3bb587994b2d8bac54707803e2ce1cdfbf8817dc631465b187175bc0e25a87f68acfb79d9013df33c4154a9149da9bfe66d77a2d04bd3bdb8f8335c9
SSDEEP 192:uuSNXsNG4QP7+3vZ4QmiU14Kjd0hatb0gO2KnyF0SJryLMqqxgNnm:nSXsNG4r+rjdIa95OVnuzJrLeVm
TLSH
T190422A356838AC6359F7F106FA4736679FB410B78C951F94E9D9AF1C00CB29C270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2b84bdcf8c544af788cd370ca20718155a9c332409084b42181c430949c64d1a
MD5 b82820aa4dc5212cd5b85c8c65c37fe1
SHA1 002e1bb7aef07867bbfb9f0d4926f39797ff7c7a
SHA512 848adb1b1ff593627906c9dd671377acbd24f7ff9054a66517ac1e04b156bd3fe73fe39085edcd724909291d39b4b3549c8d4ea02e092b589c1a52e0ec3f1252
SSDEEP 192:uuSvsNG4QP7+3vZbGQmiU1xKjdCLatb0gO2KnyF0SJryLMqqxgNnm:nwsNG4rBi+jd0a95OVnuzJrLeVm
TLSH
T1AD4229356838AC635AF7F145FA4B36679FB410B78C851F94E9D9AF1C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5cdd2a4dbb7583016911c618fd5015594bb25c399f133281ea363d58b77cad5f
MD5 d3b9127980c892f405ac9306cfa1e57f
SHA1 6debc98016343dad5dffb9a71ade56c2215cf494
SHA512 f39e1fb25c035882c77f8b571fcf9f101b6a83a8cb7432177f2aa4ecf56940e0cafd4347d80b312173af6ed19c00c23557e0d81e3bf97b44b9ccf15ee60e18d7
SSDEEP 192:uuSPLsNG4QP7+3vZZQmiU1bKjdodatb0gO2KnyF0SJryLMqqxgNnm:nIsNG4rJojdca95OVnuzJrLeVm
TLSH
T1804229356838AC635AF7F145F94B36639FB410B78C851F84E9D9AF0C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 67b6f93e044e92d68e0e59c88ca789160efb1cee9c1c52fd39f832a0c990e1fa
MD5 472a8a67ea30028f1fa6e568e353b9c4
SHA1 e91b6175de0490fe60aeeb0c649764eb5cc10c24
SHA512 01d79326a2a80eba460e763934b12cc735b77184d2d8a13dff811413bba27f2bbda2c15255fe290b0f56e5ff47bfe2b28dddd3c7ed3a4dc0d5856bd7dea33c25
SSDEEP 192:uuSJsNG4QP7+3vZ/dQmiU1wKjdtsatb0gO2KnyF0SJryLMqqxgNnm:nesNG4rNb/jd+a95OVnuzJrLeVm
TLSH
T138422A356838AC6359F7F145FA4B36679FB410B78C951F84E9D9AF0C00CB29C270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 56917e057898958f217cb164c39d7818b98e976a87ca06e714b41f0ef7634fb7
MD5 16dc598402ed2d9f70e71ffc74d20e8d
SHA1 15fb210ea09e74bc7555edd9a7b81b98c6f01f9d
SHA512 0626bdd9882d7e00b2d0fd8dca233ddc3ab9a0fccf54c6dd604b811d44392fb30a8cba2c52ceeb3a0f4fd3ad74b1123a99e3fa79065998f5fa364a76305d80ad
SSDEEP 192:uuBQsNGNQP7+3vZUQmiU1KKjdLGatb0gO2KnyF0SJryLMqqxgNnm:nGsNGNr2Vjdqa95OVnuzJrLeVm
TLSH
T1FA423A356838AC6359F7F145FA4B36639FB410B78C851F94E9D9AF1C00CB69C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 380cc17f3c61aa341bd600d4371a0adf4d390a3a352ed3bb2e6255fd671fd839
MD5 72118fd5e9481750f5206e8de32bb6ec
SHA1 4cd1ef44623b836180d39cce031072d6f1514ae4
SHA512 96489fd28dfe68a0e67d97f96a011298066b2cac9bd650c88952fb20301230992c68b4480869b9457a040bd1d8ecee41dabd382bda4d840a2ccdae179c0d3f19
SSDEEP 192:zwsNGHQP7+3vZYQmiU14Kjdogatb0gO2KnyF0SJrycMqqxgNGm:zwsNGHra3jdPa95OVnuzJrueAm
TLSH
T18D422A356838AC6399F7F146FA4B36679FB410B78C851F40E9D99F0C00DB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e2d1e91da7128c8745d9b3587ba6d3cc47eb8fc2d4e1a160096695da2f3ddae5
MD5 3e672667efff03079c5c654fc3796360
SHA1 12fb394205116a661a58673a96587febd85a7d44
SHA512 75466ca8717a6fe3620c2306f29561939d4189913501315b289ae8138983e02341ea4fea021f70806734be6606ea45d14a04a68976c3ba08b25e794d8e4eda2b
SSDEEP 192:uuSvsNG4QP7+3vZwQmiU1sKjdRYatb0gO2KnyF0SJryLMqqxgNnm:nwsNG4r+TjdWa95OVnuzJrLeVm
TLSH
T1054229356838AC635AF7F145F98B36679FB410B78C851F84E9D9AF0C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ec2ece8c6a230430ea4a0fbb13c415a7c4dbceaa000e0c372f985caa325d0aed
MD5 0b6142f3aa70162fb8d6ddbae9b2ec81
SHA1 f8bc394bf50813b9670763f01d058974199035d3
SHA512 138c586f5291e323b8d15947e16261a15ab4f38ee76321f3fa5bd8a46fd8fd425be6cee51d0bf02d898ed1242ef9773d9aec090c2c87e8fae0a5ca32ec3b85ba
SSDEEP 192:zS7sNGeQP7+3vZmQmiU1wKjdUUatb0gO2KnyF0SJrycMqqxgNnm:zIsNGerMLjdNa95OVnuzJrueVm
TLSH
T12E422A356838AC6399F7F105FA8B36679FB410B79C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5d7ea4eda1c63d08a11b434c1dbc6462d7668dabe3e348b8611afbb1fd7bd07e
MD5 e912d0cbda90ec30bf76994e251db0b4
SHA1 8c5146feefb60c4ab6c51fcbb57c6bb3b2bd75a9
SHA512 a99a10a2883a9b955a2eeb3ec83bbdfeb4a7d1050b4d148b163190e4f7ed9e5454d454c26900a99f34d4e6c7f1b31c1b33d05be3350616300b07c0c481eda81f
SSDEEP 192:zSCsNGeQP7+3vZmQmiU1lKjdD/atb0gO2KnyF0SJrycMqqxgNnm:zxsNGerMWjdDa95OVnuzJrueVm
TLSH
T18E422A356838AC6399F7F106F98B36679FB410B79C851F40E9D9AF1C00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 253f000bcbbb826e23ade07c55bdb6197a1acbd92d2d4d02cfa0518d77ce9429
MD5 8b4da9aa45bc4318f2214034f1467535
SHA1 68835c554847749eac9bfebf69056709a85b2eed
SHA512 bfb6707a33ff1ec61605b2fdf5645a0d40feb0427d01b0af0aa6d6e2d2b7b5b432f87a00cf2ccbf75e27fe6edea30fba0be5e330c51c490cfc1b5f142952464c
SSDEEP 192:zSwsNGeQP7+3vZIQmiU13KjdqTatb0gO2KnyF0SJryLMqqxgNnm:z3sNGerO0jdoa95OVnuzJrLeVm
TLSH
T165422A356838AC6399F7F105F98B36679FB410B78C851F40E9D9AF0C01CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e87d13cd842b2c2a05433589ca8a51d6a7dee0a1849e1b6314ae1fe9414b07d2
MD5 5b567c9a89caa07db73d3d9f2298fa1b
SHA1 51bb5dce0012e25a746e3bbb4de61769dcec4196
SHA512 7cfd587134d0e92c5d42cc9e56fe53ae700e4f09b8671a0ac98c48d8811ce455cba29acff4b09b7e5d5cf566d08cada324f2ee64377fc4cc67142f03bc8a3730
SSDEEP 192:zSwsNGeQP7+3vZUQmiU1BKjdnKatb0gO2KnyF0SJryLMqqxgNnm:z3sNGer++jdKa95OVnuzJrLeVm
TLSH
T152422A356838AC6399F7F145F98B36679FB410B78C851F80E9D9AF0D00CB69C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9d45da406e0ac805c159a7ca5805040bc49dce5de7ad240c0ff6a9b582b366b3
MD5 9a20308d857128bded5d8fcf029da91b
SHA1 1eef1ad0b354dbd30f16169cbbd85db1dcd48d1a
SHA512 dc599c675b933bf0457989089c3a88b507eb2f2bf473dac066cff38227cfecd9b5089b2aa228f98a80c0fceb883ecbd9dbb1a265cbd800e36e0332f39111d147
SSDEEP 192:uuSKsNG4QP7+3vZ+FQmiU1RKjdX6atb0gO2KnyF0SJryLMqqxgNnm:nNsNG4rEjijdKa95OVnuzJrLeVm
TLSH
T1B74219356838AC635AF7E145FA4B36679FB410B78C851F84E9D9AF0C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8d40e44a55413bafd19106b8e4951b52db4c6f344d73845b0c542564cc6d431c
MD5 811ed189ae91f7bd18a9b9c3ee2af1f8
SHA1 f431f4e005566fae0143e2a98722674d3e7c8ab3
SHA512 09e83167bae388452caf4d7302327813338ece739dcac5f788bfc95765b23a82e8c867802f2b22af8f93fa50908e3e18a2417e8ce9cd73bce82bfa86bb7dc160
SSDEEP 192:uuSmsNG4QP7+3vZeQmiU12KjdX6atb0gO2KnyF0SJryLMqqxgNnm:ndsNG4rEpjdKa95OVnuzJrLeVm
TLSH
T155422A356838AC635AF7F145F94B36679FB410B78C951F84E9D9AF0C00CB29C270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 66c44cd696722b4d3ce877a7e4d8ba46a5bc5806727a70bcecb309706839132b
MD5 5189023b6bc5666beccf01d0b09744e3
SHA1 1e505579fb1bd762539904e4533ed22f9481679f
SHA512 41021ac00c7dc513747b5e32f1857f8f7d5f45f81c814da6cd16ef44136f9c52127a75e0c643815aed077dddc922f7aef9994d9f1aceedf645081d0e0e4b7f36
SSDEEP 192:uuSmsNG4QP7+3vZAQmiU1FKjdmnatb0gO2KnyF0SJryLMqqxgNnm:ndsNG4reyjd0a95OVnuzJrLeVm
TLSH
T13D4229356838AC635AF7F145F98B36679FB410B78C851F84E9D9AF0C01CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cdb517f4b94e56157ed52a5d756f9b23b8fe72ac77aa2e9da067f4af04bc7511
MD5 630484a39e234d201eb193ae8d0526b7
SHA1 dea664e1a8350aaa0a4e571d056beebb671430e6
SHA512 d5503c8e9a3a26313dec933aea71c6c34b21c7abc478bc8bf8e53ed682d9765c5eb0c7ab1605ee26009a09d966fda7195800940951ac2627796267727eaa0303
SSDEEP 192:uuSWsNG4QP7+3vZ/dQmiU1WKjd/yatb0gO2KnyF0SJryLMqqxgNnm:ndsNG4rNbhjdaa95OVnuzJrLeVm
TLSH
T191422A356838AC6359F7F145FA4B36639FB410B78C851F84E9D9AF1C00CB29C270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ff07da4a423871d7fbe6e49491241ab8635db6959873acba6c94a09e1030047e
MD5 63551fd15cb6f3c5600849104aabc7f1
SHA1 abff5bd920bcc9487204e92883219db42513f854
SHA512 85a84038a30ffc84b7f60e6b1e469f2034f760d98361216b179cd46f1ec47cff9ed7b44069e5c80a10925436def703d8a718edf0ad06109b96b244a9c8669db5
SSDEEP 192:zS7sNGeQP7+3vZt3QmiU10Kjd9tatb0gO2KnyF0SJrycMqqxgNnm:zIsNGerp7jdza95OVnuzJrueVm
TLSH
T18E423B356838AC6399F7F105FA8B36679FB410B78C851F40E9D9AF1C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9e70b5d209eb5a0ac69a58d5cc4ceec5f7bd14abb12bb11e35a52c1284e3f772
MD5 a0dbc3f14652850c12a88e537127aea3
SHA1 28131aa8b5072995640dc9b3082c67dd75063a9e
SHA512 043c27c56df0e68e9f7ea77a049a8ff1e45f4cf17f0415cc56a9cab89cb61cced86b4a7c346211cf04cb4e703e336393cc31d0b19dc452d8b6c591c4021a602c
SSDEEP 192:uuSHsNG4QP7+3vZMQmiU1vKjdFUatb0gO2KnyF0SJryLMqqxgNnm:nUsNG4rasjdqa95OVnuzJrLeVm
TLSH
T12B4229356838AC635AF7F145FA4B36679FB410B78C851F84E9D9AF0C01CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 92476ec390cfea97289ca02f4264c4a48cc56ced8ab10fb7f27597838a6e5ed6
MD5 43e20fc55f9a5b5efdd6114d4e9b77b5
SHA1 60e6f241be8d5f6ba226df34914d67c705919ea4
SHA512 7bc29a052722e190f9834decbc872444ee0086e35fa328715c15f878dc7df1f9d55db04c63818026e83062da245dd9e78b1bc9cc8ca64d4403417541aca4a5eb
SSDEEP 192:uuS4sNG4QP7+3vZeQmiU1DKjd4tatb0gO2KnyF0SJryLMqqxgNnm:nnsNG4rEEjd0a95OVnuzJrLeVm
TLSH
T124422A356838AC635AF7F146F94B36679FB510B78C851F84E9D9AF0C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c84a97a2685707a9c590bf531ce87f777f0a04dc772221c98946f3033308f192
MD5 97a9a05759858f2279d6eb7dcb147093
SHA1 4a20eaa74735ecf1472bcfb85f14f50d29362c5c
SHA512 c835528da939a741c0c012fc81465f3186170b628e2dd9f27cd649abfbf6f696fd325c4f6a0215a78e4996fec24da0b4c964230f97c2b1dd8a6d27c8458f84ff
SSDEEP 384:n53yFaeO8bsNGNr2IjdQa95OVnuzJrLer2Yq9m6BMMj5kVR:53Izhb1jTjOJ2hLeaX9m6yMm
TLSH
T14D928C7478346CB7A9B7B101FA473267EFA410BB88D52E44E9D99F0E00CB19C274B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 70756519178c202ad23068e8194c8561f3d06ba19a5f797a395f975bc14a5e85
MD5 bb8c6238325be70287498682a3c38c11
SHA1 c10d7bb34bb6f5f0566c387bc93194771e08b9f8
SHA512 4719b06838c34dc063ffd18c909decd77fc057ce289ce6e12af35241664866f8226b06b17eb2bd185d6834f2e447db693451f2a80f85fd48d825f28c477836f5
SSDEEP 192:zwsNGHQP7+3vZuQmiU13Kjdl1atb0gO2KnyF0SJrycMqqxgNnm:zwsNGHr8MjdTa95OVnuzJrueVm
TLSH
T1AD423B356838AC6399F7F105F98B36679FB410B78C851F40E9D9AF1C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 71d2464d175d512cf3cc84f261eca7eca03ecc419907e62a8d47476106285400
MD5 9f3325ee1bbe0644be0b92502967481a
SHA1 e959a869354c1a46f1f55ffaf42d995360fa2298
SHA512 5af0721844fdc28aea224989e491a9a9bcb8a589349f6ab0352c3469525d03a9759233e49c1479030339e14452b3d2ecd36ae005a6b1aaca50ee6d03604a8b60
SSDEEP 192:zAONG6O7+3vZZQmiU1vKjdBZatb0gO2KnyF0SJrJcMqqxgU9:zAONG69pojdfa95OVnuzJrPeU9
TLSH
T1CF22F7346828AC7359F3F145FA8736A39FA510B7DC862F44D9E95E1C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 32aa047cae2a1d28b9c3bdf7e87ec3bd0ea82c52dd4780610541b41892bce529
MD5 2eb545244d687d6f1ebafaaafee44f80
SHA1 3dbcd7143d33de6ea11a2de7cc27e2b817e0b3a0
SHA512 efe30ca78a003cb3d844b8dfb37029a6930585bca2a2eb428f77d17632832f2d63d65161db226ec42b6e6ea3f2d441a115730f9634cc3626d256e3a4a1021d15
SSDEEP 192:zAONG6O7+3vZZQmiU1JKjdT/atb0gO2KnyF0SJrJcMqqxgU9:zAONG69pOjdza95OVnuzJrPeU9
TLSH
T13D22F7346828AC7359F3F145FA8736A39FA510B7DC862F84D9E95E1C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5915a58d4e50ce2fbe109a35890e7283f8364d74ada323eb3ae61edcea572f3a
MD5 5033d0d4292702a0d25f4f46e0336091
SHA1 c6337d92d63d634697142a3163f7d5fe9b2611e0
SHA512 c950000a6f93e4daa402ed8826a52d97efeedd3904a771a25157eb813ccad030b6d1afeab7015a10c675a770aeea1eb763a43e0151320205c9aabcc713dd13de
SSDEEP 192:zRsNGeQP7+3vZuQmiU1RKjd3ratb0gO2KnyF0SJrycMqqxgNnm:zRsNGer8ajdba95OVnuzJrueVm
TLSH
T16E423A356838AC6399F7F106F98B36678FB410B79C851F40E9D9AF0C00CB29C274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59fc209e3eba9274fac2f991bb3440ead5426daaa0d66f77d501be1d1049e644
MD5 e194259bd4b016a8d9eb977665a2599a
SHA1 c960dc37bb01fb97142bb1bf7fb8405fb387435f
SHA512 abf8c1d3fe6bbc693fed99291402bcc4102ccb224f139fbd82b0f7b876666c679b1718a8c11c68540db3078e776cdff1ff31332f6572b69688e4342d449d385f
SSDEEP 192:UONP6O7+38QmiUyWAsttb0gO2KnyF0SJrJcNqqxgU6:UONP6q4st95OVnuzJreeU6
TLSH
T1521218357828AC635AF2E045FA8732A79FA511B7DC866F40D5E85E0C00DB69C2B4BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0f1d56358e211e829179787015bf1ee377d4dddc8827b39e9444f8688d325fe9
MD5 6c55f46fb9c3194f9d67418cac31c3bc
SHA1 1e79705cf8166761b5d9ebd8269a1770afd3bc40
SHA512 d5c82b4008a6358abce4c5ef5a13fd7521648cf5d2e0ad987e199a2ffe571ca04ffc2625e6649a9deb6905ef9e0be062139fda67b9b75307d29812107c7a9d4f
SSDEEP 192:uuS/sNG4QP7+3vZpQmiU1UKjdBIatb0gO2KnyF0SJryLMqqxgNnm:ngsNG4r13jdCa95OVnuzJrLeVm
TLSH
T1104219356838AC635AF7F145F94B36679FB410B78C851F84E9D9AF1C00CB29C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 cee4455c4190417959491cf76f75f8d755ef9696ec3159a6f854bfc646b37d90
MD5 a8bf2979180e6091b8351cd1f0cc5ba6
SHA1 3c25aa2e4214b7681de9e48d36b0e764a8c9393d
SHA512 5fa03081403f781460b3268c582fb83f8ccfb4d469d7c9c5c4100a9805583dd5fdc6c515cf8b3353dc287f5749b815818d61b538631e032870ee5979e6702277
SSDEEP 192:zAONG6O7+3vZZQmiU1EKjdP8Uatb0gO2KnyF0SJrJcMqqxgU9:zAONG69pjjdPHa95OVnuzJrPeU9
TLSH
T1962207346828AC7359F3F145FA8736A39FA510B7DC862F44D9E95E1C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 822df3d827adad125a8f935b2e32bd4370e4a02bf00d21d20388cd3a7e56e8ea
MD5 88e6ec862fea27b793b7c7c392556d9e
SHA1 55c525ac2baa3a7d01d8f4ee636b122d379746c1
SHA512 178fcb5f6a0bcd1b5cbc5b75101dccf1f293d7abf7628e63c78597bed02fdbf6e7dfa74e4ed84d47615f058d0460e32db5eae2d6dd23fb4242e29a00eeb55562
SSDEEP 192:zAsNGVO7+3vZZQmiU1WKjdWyatb0gO2KnyF0SJrJcMqqxgU8:zAsNGV9pRjdDa95OVnuzJrPeU8
TLSH
T19122F8346828AC7359F3E145FA8B36A39FB510B7DC862F40D9D95E1C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed33edfa-c1a3-4caa-876f-97dd4a708770.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed33edfa-c1a3-4caa-876f-97dd4a708770.tmp
Size 12KB
SHA256 b5a8a846268dcb37875937059e289e6945f615a11d9caf3a7018a43500521bc2
MD5 11f83ce37dbc87fc547a9fb12775259f
SHA1 f7b6ae6dc3a495873947e4dee733ac1437250e25
SHA512 39520e1cf0e056c9711983e4b4869bfe2326549b3698a780653938e825df4f7d1bf3d410bc2022c2052cd6028d751bc71809be837ce7ba746085ff0f086bbc83
SSDEEP 192:uuSKsNG4QP7+3vZ4QmiU1+KjdCLatb0gO2KnyF0SJryLMqqxgNnm:nNsNG4r+ljd0a95OVnuzJrLeVm
TLSH
T168422A356838AC6359F7F146FA4B36679FB410B78C851F94E9D9AF0C00CB29C274B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16232015-6298-4124-8bac-e22e1658a49f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\16232015-6298-4124-8bac-e22e1658a49f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 77dbb836e5c20f7bdc86af9a8b88e2f0792011bfc2b2006b378bb4ca958288a8
MD5 393a99dab02ae98c6a13313c5ada1aaa
SHA1 ebc30e8d374dd54c06336b6f418895a7303c5202
SHA512 78cc7b4ddd5e67aa75afc201e4340e43f7c876387739c908e2cd8ff72ac9397da4c037b959e5a6def61b7b12b9f284737017470039ebaa0fdfa377a3039d0fa7
TLSH
T131412C5DB6E9114CB3B36E5A9BF6A86D487FB8772A06D05D00010E4F0663B41CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

4ea1cbba-1d0d-4d93-a803-62a7fc76e2e5.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ea1cbba-1d0d-4d93-a803-62a7fc76e2e5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

621c63e6-9420-43c3-a934-772460044e60.tmp

Path C:\Users\Admin\AppData\Local\Temp\621c63e6-9420-43c3-a934-772460044e60.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\base_library.zip
Size 711KB
SHA256 798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6
MD5 05d0908ee6fa68c754467fd809f1d9c7
SHA1 cd98cf488daa557e2209fdeb9854567cc0caf784
SHA512 898481b2da12d3394b716f2bdafe025ca8c5a6c8ed2b0e5059dbc32518867c34264a8b53be1f46fd62bcc29e57348169d61a06b7dadd8bd0784ba661a1614d98
SSDEEP 12288:M82osQNRs54PK4I1/k11Eddc4axDfyEDV0cJaoQDSQhmu:D2osQNRs54PK4I1/7dC4sDfyEDV0cJaj
TLSH
T171F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ad0b184-4ee6-4734-aa75-0a05f9d0a1a4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_288987068\5ad0b184-4ee6-4734-aa75-0a05f9d0a1a4.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p6dj0j8j.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m4dw5otq\p6dj0j8j.exe
Size 5.4MB
SHA256 9c995571f84d46a51cb5dccf15faa124428e29769aea0125f21b84879781780b
MD5 799c425ffebf3cc896d970212f3f6474
SHA1 00816660d58629498a33b182e63b25c4e25d52e9
SHA512 a8a52bebcaf3df6f9a75d758f047bcf6924d34dc28eae59b6cf20ef6c7c26182f35b69f8bd867c96dd78547aa24735491a2cdd18236b2b139e918b757ae3383a
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNs:GHICteErownP0oTcMsABql4Ute
TLSH
T149463348B3E809E1FAB3E03D81565221D572B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads