d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06

Analysis

max time kernel
59s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
Size 5.4MB
Sample260818-mgsreshm9x
SHA256 d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06
MD5 acaff044266b5e5b2204e70ac22efc0e
SHA1 81f9039cb6d8ec2fd35bccd777320a71739c2de4
SHA512 427ebe3aaaa7d57221c2ce2adf20f9e7ccdbbeaa5ef7f96356a7a7539909772aa8cb8e53ee4d7cb5dccada74072b64f81b0a66ef9ae468e8eb5a16ec56d22302
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6up:AsTICteErownP0oTcMsABqljki
TLSH
T171463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2942
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6035
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2682
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8684
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5277
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3683
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8084
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2498
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1304
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6486
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8401
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7692
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9992
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4550
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9359
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1537
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2214
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2700
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2272
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4175
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4564
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5933
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4444
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5140
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5401
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2726
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5335
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4510
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7358
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7047
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4963
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1928
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4954
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6354
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t73zwl.exe	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t73zwl.exe	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	jnj43s8e.exe
1292	jnj43s8e.exe

Loads dropped DLL 22 IoCs

pid	Process
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe
1292	jnj43s8e.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\yh9dz0zp\\jnj43s8e.exe"	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
58	ifconfig.me
512	ifconfig.me
573	ifconfig.me
659	ifconfig.me
56	ifconfig.me
399	ifconfig.me
1842	ifconfig.me
1903	ifconfig.me
142	ifconfig.me
1660	ifconfig.me
1736	ifconfig.me
2254	ifconfig.me
2510	ifconfig.me
95	ifconfig.me
197	ifconfig.me
378	ifconfig.me
519	ifconfig.me
1332	ifconfig.me
1347	ifconfig.me
1549	ifconfig.me
2530	ifconfig.me
166	ifconfig.me
234	ifconfig.me
265	ifconfig.me
1014	ifconfig.me
2111	ifconfig.me
280	ifconfig.me
561	ifconfig.me
612	ifconfig.me
1871	ifconfig.me
1922	ifconfig.me
2203	ifconfig.me
2397	ifconfig.me
97	ifconfig.me
239	ifconfig.me
367	ifconfig.me
386	ifconfig.me
554	ifconfig.me
648	ifconfig.me
1005	ifconfig.me
225	ifconfig.me
340	ifconfig.me
511	ifconfig.me
617	ifconfig.me
634	ifconfig.me
667	ifconfig.me
748	ifconfig.me
1012	ifconfig.me
271	ifconfig.me
282	ifconfig.me
310	ifconfig.me
311	ifconfig.me
346	ifconfig.me
665	ifconfig.me
773	ifconfig.me
1855	ifconfig.me
110	ifconfig.me
916	ifconfig.me
1251	ifconfig.me
289	ifconfig.me
717	ifconfig.me
1930	ifconfig.me
1971	ifconfig.me
2453	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3764	cmd.exe
3372	cmd.exe
5188	cmd.exe
2552	cmd.exe
6580	cmd.exe
5820	cmd.exe
5756	cmd.exe
4024	cmd.exe
5740	cmd.exe
6524	cmd.exe
8768	cmd.exe
3888	cmd.exe
5884	cmd.exe
3020	cmd.exe
10468	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3228	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2088	4124	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	85
PID 2088 wrote to memory of 3764	2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	86
PID 3764 wrote to memory of 868	3764	cmd.exe	88
PID 2088 wrote to memory of 3228	2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	89
PID 3228 wrote to memory of 3304	3228	msedge.exe	91
PID 2088 wrote to memory of 5036	2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	117
PID 2088 wrote to memory of 1816	2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	93
PID 3228 wrote to memory of 2136	3228	msedge.exe	95
PID 3228 wrote to memory of 1600	3228	msedge.exe	96
PID 3228 wrote to memory of 1600	3228	msedge.exe	96
PID 3228 wrote to memory of 1600	3228	msedge.exe	96
PID 3228 wrote to memory of 4320	3228	msedge.exe	97
PID 3228 wrote to memory of 4320	3228	msedge.exe	97
PID 3228 wrote to memory of 1652	3228	msedge.exe	118
PID 3228 wrote to memory of 1652	3228	msedge.exe	118
PID 3228 wrote to memory of 1652	3228	msedge.exe	118
PID 3228 wrote to memory of 2152	3228	msedge.exe	99
PID 3228 wrote to memory of 2152	3228	msedge.exe	99
PID 3228 wrote to memory of 2152	3228	msedge.exe	99
PID 1524 wrote to memory of 1292	1524	jnj43s8e.exe	100
PID 3228 wrote to memory of 2692	3228	msedge.exe	101
PID 3228 wrote to memory of 2692	3228	msedge.exe	101
PID 3228 wrote to memory of 2692	3228	msedge.exe	101
PID 3228 wrote to memory of 1404	3228	msedge.exe	102
PID 3228 wrote to memory of 1404	3228	msedge.exe	102
PID 3228 wrote to memory of 1404	3228	msedge.exe	102
PID 3228 wrote to memory of 4980	3228	msedge.exe	103
PID 3228 wrote to memory of 4980	3228	msedge.exe	103
PID 3228 wrote to memory of 4980	3228	msedge.exe	103
PID 3228 wrote to memory of 4964	3228	msedge.exe	104
PID 3228 wrote to memory of 4964	3228	msedge.exe	104
PID 3228 wrote to memory of 4964	3228	msedge.exe	104
PID 1292 wrote to memory of 3888	1292	jnj43s8e.exe	106
PID 2088 wrote to memory of 4416	2088	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	108
PID 3228 wrote to memory of 632	3228	msedge.exe	109
PID 3228 wrote to memory of 632	3228	msedge.exe	109
PID 3228 wrote to memory of 632	3228	msedge.exe	109

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5316	attrib.exe
9420	attrib.exe
10748	attrib.exe
4660	attrib.exe
6052	attrib.exe
6200	attrib.exe
8428	attrib.exe
868	attrib.exe
4660	attrib.exe
5344	attrib.exe
5852	attrib.exe
5260	attrib.exe
3060	attrib.exe
6632	attrib.exe
6380	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
"C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
  "C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe"
      4⤵
      Views/modifies file attributes
      PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffac997c188,0x7ffac997c194,0x7ffac997c1a0
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7168250530547109447,16125561937818538919,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
      4⤵
      System Time Discovery
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3518209286839734839,6612539940323130952,262144 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,6302650801488445126,3762630183247423288,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,276939674307231,17684542898584176758,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,16441506754360999422,14075118937738772576,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16173065096289354661,116390366438396755,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4884746397286046226,2459028367218500124,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4620,i,14298625981556076980,10979984693493750151,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4912,i,5894193811913268914,11230462503835325099,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,14722266739884916680,1957411588890541323,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,6688511376488676398,12255715927379759188,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5138842717192912531,8122961303578015623,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6024,i,16685080408501506942,4926921563089096509,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6212,i,7525324558985077987,14210904798384031660,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6348,i,12572159911277454438,9550675808992704689,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,6187570415534346290,12464455746678767404,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,15312520762165008035,229719476146040495,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,15385569936444465853,6426747212043782398,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:8
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,15385569936444465853,6426747212043782398,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:8
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5416,i,6686270929324669131,4196369660348527984,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7036,i,9790246519333654819,3325402522259034721,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5028,i,17567455716528321992,425449693752663767,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7044,i,3593593547554777630,1136674809299007643,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:1
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7056,i,15083968624155796855,7202473441077244192,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7084,i,15794123761425212437,13912427697424048347,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10000 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7124,i,10147646246921639391,11194934513948712029,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:1
      4⤵
      PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7144,i,10274521147558562240,17164635665181889392,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:1
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7240,i,14660577030261928717,5144489468192458986,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7280,i,7630005009759679783,10595112201180736243,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7304,i,11083012718072956917,11121375889806429021,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7400,i,5909687701389236678,5546637153364289766,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7420,i,5819780550750589047,4316050112055192523,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7448,i,14886041074551545104,7550945433900605351,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7476,i,106864569485785272,5211830488187633891,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7516,i,10599379384892966754,7584314182697210390,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7672,i,18287168339594158332,1575772550509106356,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7712,i,9868847735931807888,16354212347033703894,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10168 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5700,i,6743521364587426216,17084210061441721568,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5788,i,10461022618816641779,3512396562307942034,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10232 /prefetch:1
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5848,i,17445335075584106399,12981956335779917276,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5796,i,11421884290278290277,18226600519246669596,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7760,i,4983988169558073551,15963599141935002759,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10244 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7800,i,6996320716719144570,4310289089361945016,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10328 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7796,i,7692837316510345628,3003500178182739109,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7844,i,5861685229041823837,5384369894057788689,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10260 /prefetch:1
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7872,i,14146836049321121574,9609518457772580604,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7980,i,15874026870506094734,16888740510575530111,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10424 /prefetch:1
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8028,i,629956189618739568,829189764069330182,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10436 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8048,i,11063644517342076838,13459484159979509907,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:1
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8056,i,15403417722995957235,10037389294768940184,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8116,i,3917465713790694392,16617889645079126011,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8136,i,12502398851692055384,3038525783532688796,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8152,i,10051870279571833582,541878028247792869,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10512 /prefetch:1
      4⤵
      PID:656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8340,i,10577346804701277438,18233863579848355950,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10532 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4596,i,3889796087915699385,6884837947543317003,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=3692,i,12587740240620338462,12260626245127122737,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10552 /prefetch:1
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8480,i,8862199261136627197,15330145226334050099,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10572 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8488,i,10022629033951465581,5030298399182811426,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8548,i,12751854074671003868,4347879588077997457,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10636 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8552,i,4683744229270055702,17633721566701991183,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10744 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8608,i,4185281693503041479,8514622294708800111,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10760 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8640,i,11615610197855079299,11129405895209519877,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8672,i,18080555086498898999,9080307768379177476,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10812 /prefetch:1
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8624,i,2794084634015817630,13186119285884700243,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10792 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8592,i,1320884080769601544,11262446409398359571,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8744,i,16987454008664464909,516990295721399967,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10852 /prefetch:1
      4⤵
      PID:6252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8764,i,5164719824294014321,7532451851664986351,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10752 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8888,i,756529547214073222,9875894648321764761,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8904,i,13777510353288864464,17820378693622320324,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11036 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8916,i,12069379242432146989,17668608545029485183,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11040 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8948,i,3140176897152247365,17251804154144628923,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11052 /prefetch:1
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8976,i,575822367032238823,5968346939587290855,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
      4⤵
      PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9004,i,14607898346813872093,4583297659590494341,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11184 /prefetch:1
      4⤵
      PID:6768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9016,i,17412692644216928822,6271450008444838073,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11176 /prefetch:1
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9044,i,17131203546905327927,6951551552610828831,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11200 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9064,i,13084403848712933373,4888102232833254823,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:1
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9120,i,1755233499141517613,8174260050618151760,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11412 /prefetch:1
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9088,i,466870822272579212,11457243609103684405,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11392 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9172,i,16972662028225242717,17304050596527070292,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11448 /prefetch:1
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9112,i,11632126540481070870,3820219700594093329,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11552 /prefetch:1
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9232,i,18299176424217428214,18177677148417722888,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11556 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9184,i,17125779451301362070,17208578479458774076,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11548 /prefetch:1
      4⤵
      PID:6780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=4468,i,7027459779980054048,7249847144396435862,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:1
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=4496,i,15082077823117448776,9997708220423663198,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11716 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=4476,i,15957730587370671365,12887036151491939999,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11816 /prefetch:1
      4⤵
      PID:6904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9348,i,4149272118565219652,14889522804784079338,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11820 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=4284,i,2147045408057547317,6954828528020934390,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11832 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9640,i,17152140545546315148,291142104869535449,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11864 /prefetch:1
      4⤵
      PID:6776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=9868,i,13017932217235335215,11884178635474345999,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11824 /prefetch:1
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=9596,i,1826779976209605524,11565209501706665544,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11836 /prefetch:1
      4⤵
      PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=9912,i,13052105426644231164,16415080251052747984,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11908 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9268,i,7456846823722281360,251754277161568462,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11692 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=9296,i,14874679599389463422,5228354661280483817,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11748 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=9552,i,14883523635061524378,18205692634437707166,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=12140 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=9524,i,12009731623920351905,6879024332006821567,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=12152 /prefetch:1
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=9584,i,3523727209937841208,9371547775758155791,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=12132 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=19312,i,18432564986324352376,2110004094679772447,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:8
      4⤵
      PID:7584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=19316,i,13284873460928648937,137147504444051809,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=19600 /prefetch:8
      4⤵
      PID:7592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=19320,i,12724626122287342243,16401014709097470549,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=19616 /prefetch:8
      4⤵
      PID:7600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,16001395775681487843,2435636097765541093,524288 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=11964 /prefetch:8
      4⤵
      PID:8504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=7516,i,9595461287613015399,2607230397294086909,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=18668 /prefetch:1
      4⤵
      PID:8716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=19904,i,14268393262004693311,16143520004594978044,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=19872 /prefetch:1
      4⤵
      PID:9028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=20040,i,6027503165114164371,17489527540100311621,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=19928 /prefetch:1
      4⤵
      PID:9184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=20192,i,15942927130490242846,3534638774754198707,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:8356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=20332,i,11626408941618938472,552973244372086780,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=20348 /prefetch:1
      4⤵
      PID:8324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=20564,i,6526650231237931635,573238144289818319,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:8976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=20668,i,10633722044950046774,6700966039458808777,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=12348 /prefetch:1
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=12516,i,9546936467485618591,8786001765197934398,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=12496 /prefetch:1
      4⤵
      PID:9516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=13172,i,14057616525787881648,9152978189394215947,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=13156 /prefetch:1
      4⤵
      PID:10500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=6488,i,8476518601476398325,13274838499436977264,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=20080 /prefetch:1
      4⤵
      PID:10668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=20916,i,6259768350342740813,17982879071429994998,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=20932 /prefetch:1
      4⤵
      PID:10772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=21068,i,16565737561521713535,14262115363134762261,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=21104 /prefetch:1
      4⤵
      PID:10868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=21240,i,14911199632259808020,12466100061786701685,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=21268 /prefetch:1
      4⤵
      PID:10984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=21892,i,13798367968484315171,13069694372014246443,2097152 --field-trial-handle=2364,i,1077223123631408852,12511946547641836236,262144 --variations-seed-version --mojo-platform-channel-handle=21900 /prefetch:1
      4⤵
      PID:11188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3372

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3888
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe"
      4⤵
      Views/modifies file attributes
      PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1652

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe
1⤵
PID:540
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5fukhmym\ip8r1i2y.exe
  2⤵
  PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3372
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe"
      4⤵
      Views/modifies file attributes
      PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5280

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe
1⤵
PID:4152
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nhnh8gjz\ur0kymtb.exe
  2⤵
  PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe"
      4⤵
      Views/modifies file attributes
      PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5768

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe
1⤵
PID:5716
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\85txul50\5giw15cy.exe
  2⤵
  PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe"
      4⤵
      Views/modifies file attributes
      PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5636

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe
1⤵
PID:5680
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1wg8izxy\j0de7ho7.exe
  2⤵
  PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe"
      4⤵
      Views/modifies file attributes
      PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe
1⤵
PID:5440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oknphu3i\lg3ypacv.exe
  2⤵
  PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5756
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe"
      4⤵
      Views/modifies file attributes
      PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2756

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe
1⤵
PID:5660
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9w8yomt\n7i9w4zl.exe
  2⤵
  PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2552
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe"
      4⤵
      Views/modifies file attributes
      PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe
1⤵
PID:5964
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr0eevxn\3j2ghgqq.exe
  2⤵
  PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe"
      4⤵
      Views/modifies file attributes
      PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6276

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe
1⤵
PID:3224
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yxkroasw\3k7elfan.exe
  2⤵
  PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe"
      4⤵
      Views/modifies file attributes
      PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe
1⤵
PID:6476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wtcj7xwj\bbseun5d.exe
  2⤵
  PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe"
      4⤵
      Views/modifies file attributes
      PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6596

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe
1⤵
PID:6256
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wa5wtao7\dc0w7brn.exe
  2⤵
  PID:6312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe"
      4⤵
      Views/modifies file attributes
      PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6996

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe
1⤵
PID:7132
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrntdbhw\wzwxy29y.exe
  2⤵
  PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4024
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe"
      4⤵
      Views/modifies file attributes
      PID:8428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe
1⤵
PID:8276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h781hg7t\q9tba5m6.exe
  2⤵
  PID:8608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8768
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe"
      4⤵
      Views/modifies file attributes
      PID:9420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10964

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe
1⤵
PID:7120
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\817bagcg\w7ixd6y8.exe
  2⤵
  PID:10440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxkvygp8\1owtnzxs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10468
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxkvygp8\1owtnzxs.exe"
      4⤵
      Views/modifies file attributes
      PID:10748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

70ded859-eb58-4d30-a3cc-e71168ba635b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70ded859-eb58-4d30-a3cc-e71168ba635b.tmp
Size 12KB
SHA256 2ef20103eef283e216cd76c60bddaa6b64720a4681a085534ccde413cfc3b7c9
MD5 0c5e3af7a7060f02137fdf7e567719e0
SHA1 e1c7ab1222e5d33348f9b718409ab6bad5baa7c7
SHA512 9986f5042be7db5291730a248b352dcb941ce7e93753eaeeb187a42efc2338e5c13d6fd8c3b57ea7dcde84d85cdd50643872f2cde7ed83fdce9a297c959ed1f0
SSDEEP 192:zasNBPQjsd7+3vFndQmiU1qAUyatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDTKS:zasNBPCfFbr1a9uOUtWzJrnp90fEoQ/t
TLSH
T1F742F8396878AC3759F7A245F98B37638FB410B799862F80E5D96F0C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 280KB
SHA256 6f43813e456cee0352ff7e2cb15363f556ea45442f2e3842d503a1d7044fffb1
MD5 9643f17174411b88db3f1f7234f6869c
SHA1 9c3ec7c498bea59b73112fa5e08fd41b413df6cb
SHA512 1cecc3cf210ff96bfc1389b8c934e09b000c57e2cc0a4c12d8610097ef944d2fec5816531a3c84721d23a6f7486aacf1763a2789f8b2ff4b50b87f3b8021d224
SSDEEP 6144:fPg/0+vqaW3pGpYBF2dbRfFILA3CUAz0o49d01bjlgJHcsrlBlNNd:f8h2BF2dbRfFI0rgUqbAHcsjZd
TLSH
T1EF54237AEA6A4141D470F8DCBABF029151AE65DC68B62D0DF5EED332F7318114ACB4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 205KB
SHA256 4c9a35988e43dd60f97a1db4f53cdadb82d0e9cde6ace47d3405e08624ee25fd
MD5 2c1226671f50a340a9c83ee44893951c
SHA1 28dc13bcc938e729a47d56b98a0a761e4225df99
SHA512 ebd496cb0c20b9c61cbe2e4e6efdbbbbaef0abd44068c1a1215744b62c2ef98323afe0a152902daa11f6c4f13ec31bbe12e1ce6314f778f7b07d7beaccbae16e
SSDEEP 6144:Rj8NBNT44hUIsB977SKEGF6wrhUfIkEjnv4tx34btH:RANB544bM1eKrVmfI1nm4h
TLSH
T1FB2422554F62D80B81EE30C968283D5D60A982FBBE023A19E8CF7C4BDD3856F7545EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 43KB
SHA256 0b14ab9d0e4863752717c058f8c982eb4d624d5e39216664f57d4aab98526dd0
MD5 a24f60462094703b479746602f6ac25c
SHA1 952042cf719953b7ccfb796cf11cf5034d9171fd
SHA512 625030ff305be05987ab67afd6a9c7802c122fc7e8c374acad8ce247ab3ceebb852a4644372429c702cdd59714879f12f57ab06ffdec30024713e50549589a75
SSDEEP 768:6hy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30/3M4ITeCbFhd+:6hyqeUG44t6gecNW+o30/Lqeb
TLSH
T1D5130222F3204A2B382226EC580CD1851E0EFFD0E5562CD1C7A96C9EF5954F34AEB4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 38KB
SHA256 ae1b3b031128f844d86b6ba50b57da647410e99483a5b1ff3542cd9de587c243
MD5 b2f2bdc203810097abac1ee04c6af3d6
SHA1 01be48aebe26f6a1560cff82d869b5a4f5d6923c
SHA512 0a7f4e80296f3234ce6ec3ce8b7a753edb197ac6b15fcd3877f5ee3b53507035779d707bfd83015aa48f9e79005d8be0ce6276e923c51031f4194fe383e7ade2
SSDEEP 768:Jnte9CXM9YJBOYF1CA25gPUREdpz+tAENQIYQI6pYqFxeSL8kNL:JnteUMOBNXCAxMYeXYQXMDkNL
TLSH
T15003019BC67681F31A397C489D155F698EDC82BF316F8B96F04607C98A4DC05F2E5432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 67KB
SHA256 46329ca0cdf320d7b3bf6c6ad81fd16ebbe39fea143c7700f0d809006b144c84
MD5 1477ae015a58a08f6c49126e00925d77
SHA1 5ea97858b2a3f56db9bdf47cab9f2f583d01dbd2
SHA512 8b827399a498c2419413dc9a151d2e2f6790bc1b67bb87d5c0ee67d9178cbc140cc4fc853a314fceceabb17e7a121576e0f68ad1c6451a82e7bb0725588ce0a0
SSDEEP 1536:gUylCXh1MfzyBHq3ve+lsuR+vb7gP4uNsLdrI4q01oWs7e:PDMfO83VKC+j7gP4QsLNNMWs7e
TLSH
T17F63017807AE4976393DDCD5168EE0178E490A2A455FC61F6BD83686F39FDFCE201288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 93KB
SHA256 329ad196557dfb23e145a6eacc674a7711705017fc105ae15487696d86fdf022
MD5 700825ed1124f4fbd2c7bda271e30eab
SHA1 82dd04261c5a2710eda72bb3e532b0cc5e7b90e9
SHA512 0bc83d425617d3adc28536929a76254df82c92552af75a1e73d87faa35a49276c04f715b67cddde4e52322eb9942f4c30ba3f3fd9c8068c8f7c1d2cf624fdb03
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWki+APB1hMS5Q1FJqRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7Xb1hMJ1FJqopRi8G4RX
TLSH
T1749312F46DE989089071A3C257DF9A14BBB30E1296066533BDCAEA3EF959C4B1DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 105KB
SHA256 d937468e413a53654aed83483338154cb23ca25653fa8d46a989e0c1ab38063e
MD5 498156d97470930e2d6526c7da35f527
SHA1 f2a8f8e2196059d3d93fedf4c895c43d6210ccee
SHA512 442e0b0dc23f7f4aabb54039826d5c2d95a4e56e5b80a281257ebc02ebfbff8829508d69d31bab24e21ef9c5e83a5a4961a10d4ce017d17b378b842c41d481fb
SSDEEP 3072:EZLJfb80HIjnoc6V4bDCOguKeVvHZZztI8Ma7VbuS7uZ1:Itfb1bpcM8Ma7osuZ1
TLSH
T115B312A8208386E471CA94CBE63D9851FA310D7344A686CAE37E1D3E7B4D33E84757B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 158KB
SHA256 6c04af325cef515153465cb8b19bb93aec94dcf5d33537f8d95b475cf9284882
MD5 a95e2032d6882ce13d25f28489c793da
SHA1 9bbc45be6424dd709b17eae7b70235614a51dc24
SHA512 ae8a18dd243c5c8a6d46b0b151ce4f3bafda9d4dd9ebf7aa13f7da2d278a6d517774db97bc32ced243a15e572477f6c0403818fa646b7f9c84a6455e468882e0
SSDEEP 3072:dqzrleBAAmXxojKh2cauRn37QQIYDPrsdCBOEZqDxX+XBXtuNYYz:dqzrwcxM6HN37mYDPQQnqDxXKBXtk
TLSH
T18FF312530CFE623B9A5610D35276B85D3765E1908FF6DCB1E28E0D60EDB8B27084D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 21KB
SHA256 a3d8bdb8d4e94c935586972bc44ca6de73f85b2b8b1774bac16d4b337bdcddd0
MD5 634193278226985204833cd63e5b991b
SHA1 86f97c9b8493e5075edd34a9491d25cbb28343dc
SHA512 e4ae39e4f74d4634625129d3d0734fddd75fe289310825c604aeba0699f0e62852a039b323fa905d0ae36fe1faee948615c7c1735e50d776f78255ce3d29cd98
SSDEEP 384:eiRzNh7h1JYfi5X9rfUORMBw7nGx0kNW51bq6hMU0b+ZdYqdQf6ubXw7ngZ:eSH7hYC18ORti3Y5F6ydYFff74nW
TLSH
T1A1A2D0A6D81D4DCA83DBDB1C30D397B9CB712A0E9C41AD7C98CBC74564C561D2A1870D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 92KB
SHA256 192a28957868efbf872db847b27a57818414455acd35e2de97905944e8edc921
MD5 54ce41a349223e8fde50c180ded5bb38
SHA1 5c5e07395b854a4d04f32c80f3202abe2678b3ad
SHA512 e773310074a89041bceda5e14eebe3015da68edca4283d45ffe6d7daa411ad2b9c26a500ef2d2b4638c57bf9294d0189b71b1e13be779cefed0b0fee2cbabf83
SSDEEP 1536:ehE3fMb2qNofLd4Iaf7kc0ciAYQ854fCiJtWWWd0gJshDWLwWwP0bva+kS3+wmA6:kMMb2QoOlfQDrAYX54fC0WWq0cWcwP0+
TLSH
T16E931260A279493B0E3C8703628DF513C3B042564562EBB34E9BBE9529EC474867A3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8515013f881f40ba2e74ffcaa2b4446cff905a64bb276a74b50cceff89f673b4
MD5 aca288c008e13a52e45ccc8a4bcb7a4a
SHA1 07d009fe952ac6e2303a3995cf962f3aece9bdee
SHA512 2f7ed6f7075355f496429f05f914ecfdcb8143412ffa2e8ae490cfb0c698d2df6b87ea90f3a50281516c42186122ffb8396d209cd60127e224602dc0bac4cc71
SSDEEP 192:sxZzRCyM/jK1Ml8MjU/fksXHTEdp5W2ZFp/W6+WNi2SJlSSNdBSZnASL/YB0B96k:sxZz47U/fksXHg/PbKJ1NSZNL/udO
TLSH
T19252D8566A386E778CDBD319F911BB53D7F5446292900E84AAFCCA1C00E6AED3217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1b424ff4d01adaf3a5479fd29077b911378db20a2fe16e02265e4efb32620373
MD5 ad9b4c284daebbbdd618f8ca5624c63f
SHA1 a176d94f6cbf79731dbdb268f8c7b5f0149763aa
SHA512 9e73cbf68f86d8e3bdde82dcfc8d9855ae40b93e3250e5882fe7543313c0d43d83162640cf39c23f88d012cf3c2335155a3e047b558dcfc4c58397c9893e0bf2
SSDEEP 192:sxZzRCyM/jK1Ml8MjU/fksIHcEdp5Y2ZFp/W6+WNi2SJlSSNdBSZnASL/YB0HF9+:sxZzY7U/fksIHDFPbKJ1NSZNL/idD
TLSH
T16E52D7266A386E778CDBD319F951BB53D7F5446292900E849AFCC91C00E6AED3217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 494342b252c7c16329cdbf9779d24e0d819e7513b05b432df5bbebc67ddf5add
MD5 78c27a2b3c1749ead5b01e4c9fb8949b
SHA1 5fcabb88503b386e139a7910da22805c3e36b71c
SHA512 5bdbdc9d8a94fe16f8aa2c0162c49fe07b5675ac2c955e09f937fa989eb63c70ec386e7ac6cda472948c3ba9dd2ea17ea3e2de53a8bf71eb4953d8b5ad63e1ce
SSDEEP 768:HPs6pY1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTILlWwJNgroLfA:HPs6pY1WvxzWju1jaAILIsNrL4
TLSH
T1B1E2EA3B680CCB7E4F841E5CAC2A6F967DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 25462e9f14a1ad61293782a9f753e19add9900919ecb6117ae2b7fd2b5e1c472
MD5 7e75f17bc73d86492cda92d065bc3147
SHA1 685e335871bced49eb61cf25e74b57d40a8575c8
SHA512 106630170a95d05ecfbb142e98a6024c84a419f845156c5df167561a8b6f6916347298162295463169c8caec64dc6f01059efb55bc0f405fa10db512e5616fe8
SSDEEP 96:KUAAKtePOP+KsMCq+oKjy4ogKta6qMQKlOZ:iiJtPovba
TLSH
T169E1570273B712433C7E289CA354872B4B46B1673014B66B3BE804751E66E795DFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0fcdb5f7f5acb0b18cb26f10798257da153c752e6ec9e03d3d3f82a980434a09
MD5 c5badeeb99d740238b84ace6dd3e761e
SHA1 08597db55de81e4f71ee743695bd07b122b3e8df
SHA512 3fe021d7613d4b7993c46c935b47aa4b608f1ea86d0f9a07e09cadf52d27d56033bd2a329cc44524a6a553625b2af78b5424ad3c2ba6218fc329932795566bd7
SSDEEP 192:zLsNBIQjsd7+3vFIQmiU14Aigatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDTZS:zLsNBICfWVZa9uOUtWzJrnp90fEoQ/8
TLSH
T11542F9796878AC3355F7A245F98B37638FB410B799C62F80E5E96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83b260c61e05085a9c282979fbf86a155366361290d12084ab4a0c96e541dc93
MD5 715baaa035bc76351680b6754f8a37f6
SHA1 6243ccd06041636c6852bbdbcd27a3bbae75cc26
SHA512 509452668952d6612d2c7e939e6fa93f9a7311477320ea392fa214a6fb70300d284fe4eca97dc37a3a5dd2b9465c60262205fecbd4e28dcd2e6a7899c1d8a512
SSDEEP 192:qONx6O7+3hQmiUyjlGttb0XO2PxgG0hy0VU6:qONx61GGt9uOUR040VU6
TLSH
T10302E8396C6C6CB79EF2AE45FA8727135FA5107BE9962F80D6E81E0C00D765C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ed14326d97eeda09750c11cc7dcd9835f17e8cbcae36db3801b9ddc637a6286
MD5 93e5862b59b14c265d9d060a9be8c568
SHA1 6d779b6354e3f211f0d3a22205c293e25bc16c4b
SHA512 38203239fb1f842cd27f30fc5c22a1b532fc1fb32ccf28139fe3f8d0f398ddd50a14257308c346585d571904ac447fb1c756c292e9701720db593e813dbc7a89
SSDEEP 192:IONE6O7+3wQmiUyClYttb0XO2PtaF0SJrnpbcN0GqjTwU6:IONE6mtYt9uOUtWzJrnpA0fEU6
TLSH
T1C2120735686C9C6359E2A644F9C737A39FA410B7EC866F80E5E85E1C00DBA9C374BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 69e42dd571022205b60f194de7aed73c8bd144dd170b4c63b2e088851bf04b4f
MD5 19c388748d92ab99b8fc74f38930fa3c
SHA1 80bb6baec0b68c2627d2e2bb28718a55abd713f0
SHA512 3d8c9bf5cf457ebc2f90f9e62b7c8af7fafeea09a7238fec6ea702562a60b61d37bd8365efad5846b977ce892012d126b53368ea81bc3977e73592dc3f636ce3
SSDEEP 192:zLsNB9Qjsd7+3vFndQmiU1XAD1atb0XO2PtaF0SJrnpbcM0GqjTw/QobZDTZS:zLsNB9CfFbyxa9uOUtWzJrnp90fEoQ/8
TLSH
T14E42F8396878AC3759F7A285F98B37638FB410B7D9862F80E5E95F0C00DB69C2347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 263b62696b7487ccae30f7277b02f415b1442e3d35afb6430acee3960c21a656
MD5 be2c3c2cee46da0a1f0deeb02baa423c
SHA1 d21b09bb00f95df6870945b272cdedccb96330a9
SHA512 728e07fe98028a4cba28585b624d5f9a761885d0b19a7f5015296b8f2abb18c1385ee2392296ca3557f26bd0b0d470ac95eeb5a8caf6d4de27a79f511b08f93c
SSDEEP 192:zjsNBIQjsd7+3vF1QmiU1ZAf1atb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zjsNBICflUda9uOUtWzJrnp90fEoQ/7
TLSH
T1F342F8796878AC3359F7A245F98B37638FB410B799C62F80E5D96F0C00DB69C2747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4e86679326b4521d5aaa0f70d0870541b8bf6208429e55d7a9a1d3702abfe469
MD5 c9a172b89e40061fbe1221074df49e7b
SHA1 3ac57ea8a11c22bffddcdd3886ac7f20470d28fa
SHA512 fda55de1fdb5c6c60536c8f192e108679702c29270bf2432b87767563f8140f8d56514d556b1ccf7028dc09873d4a286a56dd826e7276776b060970614ef0ca6
SSDEEP 192:zjsNBSQjsd7+3vFPQmiU1UAAyatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zjsNBSCfndDa9uOUtWzJrnp90fEoQ/7
TLSH
T17142F9396878AC3759F7A245F98B37638FB410B799C62F80E5D96F0C00DB69C2747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c1fce64dc995577c476349059fe9b3161f65d3af5c0f7bcdf8927b0e23d446d8
MD5 1a2b8973a4a5e481f09e25ffc311d127
SHA1 add4957d2917575c864fefa0ec7edc6eb035fc0f
SHA512 03ac3f0348c51986723f70fe06ff35ca9ca687698f3389ee6dc30537304f32325b88a4c03fe1ec6dd721e55afd49af375446f791969a5e30b62d8e0f31e714a8
SSDEEP 192:zKsNBSQjsd7+3vFdQmiU1AA82atb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zKsNBSCfppba9uOUtWzJrnp90fEoQ/7
TLSH
T18C42F8396878AC3759F7A245F98B36638FB410B799862F80E5D96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 657e9ff46afb6b5fc0c093215a7d996750a2211e2552e137203e834114d3b849
MD5 9c71884633ea49744c1e211abaf1d1be
SHA1 c185aa3310908b129c428ce88c943f5ef4496f14
SHA512 2b9a0954d9553c1751fdf4f16216a181c462bf5d7b7af364d1fec8a6c9cf4509a8025e2f38f782feb99076e4c5957c325fce09e071da988598d812f8e93ed029
SSDEEP 192:zp4sNBSQjsd7+3vFdQmiU1MAobatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:z2sNBSCf9hya9uOUtWzJrnpM0fEoQ/7
TLSH
T13642F9396878AC3759F7A245F98B36639FB410B799C62F80E5E95F0C00DB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 daf7c9822b997ef535f1180cff395fd49a2837e754ace1ffb5d75ee65dd69583
MD5 b8371ad845553a2755b8b30c036899b4
SHA1 146623ab2c206fc01bd0e3eb73a4828c6f2ba95b
SHA512 263651fa44bbf93c4318c0017a58b01636c8d6ff502e06f12ff472e10bb8959933932e9e3c05f4aae7566c088a9022524a9baa88eaba419e318dd0111c2b3ad8
SSDEEP 192:zpRsNBSQjsd7+3vFNQmiU1NATkatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:zvsNBSCfFsIa9uOUtWzJrnpM0fEoQ/7
TLSH
T16342F9396878AC3758F7A245F98B36639FB410B799C62F80E5E95F0C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ba3707c302b7d90a01b355e26231098e267a958c60510198bf53e3ba05ec30a9
MD5 9176c1850b1385ebf99cc57f2aa55ec9
SHA1 f69c14f0563f832c8ae7702213d5ace47f3742e4
SHA512 2c3ee0ec80cc74c42737f1d137b7cf0bb3db26af9ed9a5728d2628d0732f367275633112f65532715a439a14a99690844c41854d92b48cf02687bf556caef961
SSDEEP 192:uup8sNB+Qjsd7+3vFpQmiU1bAxuatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:nSsNB+Cfpuka9uOUtWzJrnpM0fEoQ/7
TLSH
T19C4209356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 349d616033df44cda0180e42039e80ff8c2858a8bd0ed8fdd8bfd7b71feb67a3
MD5 132b0049a9836916094649a50ceace35
SHA1 71765f2a0c7aae0a9a8b79578988eeee5dd0304d
SHA512 9174ac9b30339c3299fd1c23549f8742aa0ab3670d340a7aeef2b41074e84c4fe9325431b2d237fe31b4c9f696d427ae06e161b7b0fe81ff4923133ffe9bb7e0
SSDEEP 192:uup8sNB+Qjsd7+3vFnQmiU1OAihatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:nSsNB+Cfz36a9uOUtWzJrnpM0fEoQ/7
TLSH
T142420A356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d69ed280cb5ce202ed9395a9b852807dd8eaafaf0a4a69406370120cb8a2bf46
MD5 9e4482adc2e160a9f83c159bfab0306f
SHA1 09b1133f7407751fcf234e94050ecb698073bdf9
SHA512 81dc9be3fe0e96ca0b8c6ebc289244c258126cbe0e1effe7dfc844f7456aad0e6332a4e1177063a2ca70bd96b37eca6ddd9ee7d18aaff0b2042a75ed56e94d4b
SSDEEP 192:uupasNB+Qjsd7+3vF5QmiU1aAJstatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:nosNB+CfljJMa9uOUtWzJrnpM0fEoQ/7
TLSH
T1B34209356878AC3759F7A245F98B36639FB400B799C62F84E5E99F0C00CB69C235B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fc9d34146b6334dbcecde2a66a0aa4f4be3e5a70241a177d62d63ad63307b503
MD5 73c61e0631f391e04d4a5c3b7807d001
SHA1 f23ff42ea84bbcddef63af784cc62e60ba50e9cd
SHA512 f3b673c29bfeb650b16e2e31998d34cb69f8c793aa72a84452e77324d1b8c5925b1d16969f687010fa12eb47dd8f788203a03f00eb8d2aff79a88b5d638ae831
SSDEEP 192:uupasNB+Qjsd7+3vFwQmiU1ZA3Uatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:nosNB+Cf2UEa9uOUtWzJrnpM0fEoQ/7
TLSH
T1284219356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cd3e392f31b6a6d52874b168ec150a70e9b03cf7ea7aae566aa9fe35006b552f
MD5 253586b5dd69e2b5fd7887896dfad33a
SHA1 b2f0524dce4f93a2498059bea1f145ddfcbc5d37
SHA512 86b026837dfb69873d6a0cc5405da016d68930970d672d4b9b9918308b5e9b018f14773b36827a90051c02c03e5e84ba3938fb98cbcb6885f01bd8fe8504c077
SSDEEP 192:uupPsNB+Qjsd7+3vFoQmiU1BACtatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n9sNB+Cfy4Oa9uOUtWzJrnpM0fEoQ/7
TLSH
T1B9420A356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d419b158c5311dbbce67a87591e9b768a8e99f44ffee3d2ee79b4fa3e49c9234
MD5 e4156208d0789e08b5363cfe333fb956
SHA1 5008247f064fc1ca57dbc0107b7e8a7d07b8a3e1
SHA512 9ca1b0ac3adf37c44b2ebf7e9ca6e82649e82a16ccacc29443a7e663c14ad01398771d39d4c2440a024029ed446eb3dc39fdb41860b9e9ea6bc7db662a7fd2b2
SSDEEP 192:uupx3sNB+Qjsd7+3vFfQmiU1sABeatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n33sNB+Cf/F8a9uOUtWzJrnpM0fEoQ/7
TLSH
T1ED4209356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b29e44a3f7b32cb1d238767d834ac198411d4b2b11c7988b82573a613aed75b2
MD5 a75ace9c16b66b265b5edd883f36968f
SHA1 337081f2f571f6eb5c38a11d82d21469d0250ca2
SHA512 7bd453ec5917b8e7dd95a408da97ed26c97b6ff95cfc64ca39bb73ece2267973fdb6bd4889abaede864b97b1664bd83fe7ebe33147c3ddd26a35fef4d99178cc
SSDEEP 192:uuB5sNBTQjsd7+3vFfQmiU10kAs/atb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:nXsNBTCf/mqa9uOUtWzJrnpM0fEoQ/7
TLSH
T17C520A356878AC3755F7E245F54B36639FB410B799C52F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 424db1bc9350cd00c00c33480fa041a2fe464e8a4978f0decc858e10c972cdb1
MD5 06f007c5074f1125c274d248756b8c0e
SHA1 7eabfe5601748ff1ca3269c99f261b6d3380fc68
SHA512 ba9b689829a935abb55fd2f021b7e165d29f4fb8535ebd7866d8f8edcc5ffd09b8bc269c7e68081b57a431fc37f8808b0510cbd744cf728da230b9b56281aaca
SSDEEP 192:uuB7sNBTQjsd7+3vFqQmiU1iAbsatb0XO2PtaF0SJrnpKLM0GqjTw/QobZDT4S:nRsNBTCf0P4a9uOUtWzJrnpz0fEoQ/7
TLSH
T1B8520A356878AC3359F7A245F94B36639FB410B799C62F84E5E99F0C01CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 db85097922315ee4837b52d5e024bcc14b5bbd62695e780cfc55a63bc5136b28
MD5 f39755b4756ca290a32a3eacfaec8c6b
SHA1 794b3d50c06fcd0a5d1fad33c5c1c3ad26b3870b
SHA512 fed51e5dccb0375f53b38944d98688094bcee82a6741f4449d8d83e6e09d6147cee8c4c53ded4beced8e2a433fbccd46fcb7a49d19ccbe525a2e22717ae25dec
SSDEEP 192:z6sNBIQjsd7+3vFIQmiU1NAxratb0XO2PtaF0SJrnpbcM0GqjTw/QobZDTZS:z6sNBICfWsla9uOUtWzJrnp90fEoQ/8
TLSH
T1034209396878AC3355F7A285F98B36638FB400B799C62F80E5D96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cf8cd7295b724f6fab49ac8ab06f1c52bddb18524394e09176882364944a15f7
MD5 4f41ee40f0415aa2148c5738abe043f9
SHA1 578a0ee4e94b41dd160d63999564b9bd4f4caebd
SHA512 571c64132df14f0ed43c6562f861ff0ea461204a54ed1f8de26fff135eda3a5b03730e04480069b615c943f2c6a76470a30a958840b1008e991bc1cf01f18e1f
SSDEEP 192:zpLsNBSQjsd7+3vFdQmiU1OAKUatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zRsNBSCfp3va9uOUtWzJrnp90fEoQ/7
TLSH
T1F4420A356878AC3758F7A245F98B37639FB400B799C62F80E5D96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2b671e7ad176daf6f030ba7ca5fcfc2a72587dd0bb4ebe7a3537cbaf3770ff2b
MD5 dc120fd620c14515fadc4c62d14c8e4b
SHA1 a1ba18faa665d49aae03afd77a89aea6a0da43f1
SHA512 1c1e8278e511cc3f0f551b548688d7ef46c50a05eacffc5dae45a533edf01c5979242e37531e89f5c488dc131c989c8635e458b3c4d4e752dee7c2cc5af2d643
SSDEEP 192:zpcsNBSQjsd7+3vFqQmiU1cAfAatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:z2sNBSCfQFYa9uOUtWzJrnpM0fEoQ/7
TLSH
T18C42F8396878AC3758E7A245F98B36639FB410B799C62F80E5E95F0C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e48c38151deff23bbacbc4ed31f900eacccf2c2e4d192c3b90a2509ebfbb443a
MD5 5fbc480ea2d90ed0842f39c17afe826d
SHA1 e4b4ac157d1440e080fa1db215f643c3f16f22ca
SHA512 4a8c4a0ed7a19c6cc38a287de164bcdcde2a044ed47f2ab026104ed1919e29009dc693c64f5662e48fd764676b82be1115faa8f334a38526c04c0a2ee2634f96
SSDEEP 192:uup/sNB+Qjsd7+3vFwQmiU1UAYnatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n9sNB+Cf2dma9uOUtWzJrnpM0fEoQ/7
TLSH
T1A6420A356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a24f4cc9835bb7e53852e2fbc2edba30f5a535443a82fa8b7182c5ab8e762d85
MD5 4d5a1226555e19c6705b601239655fdc
SHA1 269681bc432274c144e05bbb854d733754aa6a1d
SHA512 4eae250906812d38c285175b7a464b4e2bbafc355daab7e115811c590ac8354bd79e987a41e75e4087494268005229c570ebdbef6c033a108cac6e2526cb1609
SSDEEP 192:uup/sNB+Qjsd7+3vFoQmiU17Apmatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n9sNB+Cfy6Ua9uOUtWzJrnpM0fEoQ/7
TLSH
T119421A356878AC3759F7A245F98B37639FB400B799C62F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 71cdc7c04587d9ed9546577b916de14428e4abbb5a4fa0bc16241ab7e040bbff
MD5 13d4051ab997b7b67a3ceb62a4d9187b
SHA1 0403ed3a403c6adfff856123013a65cdbc757fcb
SHA512 34ddc806b15ac5d4708ce78b8b33cc72528d0fd26eafee8522445d4d5f52480ea69a0a282f1ff8c50e0adf87083e287255fee67fd27cd3161f354d2420da36cf
SSDEEP 192:uupPsNB+Qjsd7+3vF5QmiU18AR6atb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n9sNB+CfBB8a9uOUtWzJrnpM0fEoQ/7
TLSH
T1A74209356878AC3759F7A245F98B36639FB400B799C62F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5b81700fd823affe535c7009fa3fb37aab30f98fe1dd7287d7a7cb487586a710
MD5 6f4feba46f7dd1631df7d3049096cf27
SHA1 b3393a8d2264d7f3ef4ba347c0ed22ab8352de73
SHA512 019c63309cd8a2bd613a95c227fc146e56fc9653d4d75e47dac66b3a72fd64dde44ff1beb5bac7488fb691ef15ed55b90814a86263867bc42f6838b4667c1a5c
SSDEEP 192:uuBsEsNBTQjsd7+3vF4QmiU12APQatb0XO2PtaF0SJrnpALM0GqjTw/QobZDT4S:nSEsNBTCfS7oa9uOUtWzJrnpl0fEoQ/7
TLSH
T1C15209396878AC3759F7E245F98B36639FB410B799C52F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fb6c49c0c94d287781b948470317b1a33ac3f00336ac0ee368005e1947c29cdc
MD5 ff352a480d2332ca0b45adb8dc0a22a9
SHA1 5136aff87ab997365e3316cb1b8802b4746ed6d8
SHA512 85e646066d73f322516b219979fd4fe89518ccb3168d9fb2eb2aae635078cd0f2f881abe3c47bc802d88811ff74791853bc6cb2f3f57e1b3dde9a839db03a22b
SSDEEP 192:uuBosNBTQjsd7+3vFIQmiU1YA9Gatb0XO2PtaF0SJrnpALM0GqjTw/QobZDT4S:n2sNBTCfGlUa9uOUtWzJrnpl0fEoQ/7
TLSH
T1DA520A396878AC3759F7E245F94B36639FB410B799C52F84E5E99F0C00CB69C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b683ce6777b6ccdd146930e4e3939e1b8de9941e0c26f4c063bfa6d7d8f5882c
MD5 84b6f26bce037ad7af7fb53893ee2bbc
SHA1 6c136cb9f395a3d9a4a78eefa16b472848e9b249
SHA512 b56295f56c9552cf0043f84392b5a73fab3ab7605e68942fbaf8a2a260fa62181f89554e4c2566090f28af0b207fb16a7a8cc344a8eb1567e476474f4ff17016
SSDEEP 192:z6sNBIQjsd7+3vF1QmiU1zAwOatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDTZS:z6sNBICflG1a9uOUtWzJrnp90fEoQ/8
TLSH
T1F94209396878AC3354F7A285F98B36638FB400B798C62F80E5D96F0C00DB69C274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d880db596eda577be41b9a0e5ca4a1fdc52714cef1af92710ff39189c2eeadd7
MD5 d5813c223b5dd999e0e2d61bb66caac3
SHA1 095345bfb9336d9f20687fad6933c20a4583f558
SHA512 e19734d94112152a175fae9f2f9fbe21f594a21eba26ac00a6f912452db3c0d8afd94f0bd9904382f8fae3586d83c8bc96f602212f398684f19d91197800049e
SSDEEP 192:zKsNBSQjsd7+3vFPQmiU11ArZatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zKsNBSCfngFa9uOUtWzJrnp90fEoQ/7
TLSH
T13542F9396878AC3758F7A245F98B37638FB410B799C62F80E5D96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0ed6924a471adb31da823fba8ead7142ccf768769124c2ff856bdf7a2256435d
MD5 5ae19d07bdd4e2dab33eaff11636334d
SHA1 f0a05a728bfb35d0a3be4d83804e71c8b870a1e4
SHA512 dd35aca6538c46c4db1108a4676ff4b0c0821fd2043930dd04d3f537181d164f61a00af55d53dbdb4889efc9c24f16df1969e94f14c8e86af4c7e994b32d613c
SSDEEP 192:zp4sNBSQjsd7+3vFdQmiU14Ak3atb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:zysNBSCf9Vqa9uOUtWzJrnpM0fEoQ/7
TLSH
T18A4209396878AC3758F7A245F98B36639FB400B799C62F80E5E95F0C00DB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b9371f7a5cb57b20c779126c1606e07a22859d0531f6f4aefd7ae9e3c4f24c30
MD5 3e19fa7cedbfcd5d527fe1360ea36b00
SHA1 9469c91ab099495eee7fb9a164415619401cbb43
SHA512 7b1e1e9625c971c3786f16b8bf389afb813f7c89281698dcd6f255084c5faa57ca3a894eb6379896abbf5af0fa5dfeba95f1eb1fd80f8100ed5874b7d8a4d158
SSDEEP 192:zpcsNBSQjsd7+3vFNQmiU1hAATatb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:z2sNBSCfFcya9uOUtWzJrnpM0fEoQ/7
TLSH
T1F842F8396878AC3358E7A245F98B36639FB400B799C62F80E5E95F0C01DB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 74e1949e378d347fd46524dd499795a021caecd4f8966ef5e4b5d24e891ef36a
MD5 d34c825b6587dc4a3934b4d13066b937
SHA1 5a3197c7729d1f8d87e3386f5ffc7b8c59969d1f
SHA512 d7661177488a01d9911db7ec50bc30dac2d4ba25e3ca5bba05e4905debfb5d46d1f786bd2d63e2554c1eb8ea626a98087eb2a82a123625323b93a6c948f35bee
SSDEEP 192:zpLsNBSQjsd7+3vFVQmiU1+AHtatb0XO2PtaF0SJrnpbcM0GqjTw/QobZDT4S:zRsNBSCflzNa9uOUtWzJrnp90fEoQ/7
TLSH
T167420A356878AC3359F7A245F98B37639FB400B799C62F80E5D96F0C00DB69C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d441ed34354688e432b7f7d0bd9173947244c95c33a84704d64ca79e586fb472
MD5 a10af42bf9597a62a26b502dcaa1bbc3
SHA1 3b6b6cf4ca4a089fe0b86779906ac670ba5de135
SHA512 9fa5ca555d6d30d21e87a3812c71079b18a071edada9842e847ebda64b06f740a921582c40327eaa7078313dd0729d49f457be8b83419a8f2fb9d01a30c847b1
SSDEEP 192:uupx3sNB+Qjsd7+3vF5QmiU1XAk7atb0XO2PtaF0SJrnpbLM0GqjTw/QobZDT4S:n33sNB+CfBKqa9uOUtWzJrnpM0fEoQ/7
TLSH
T1594209356878AC3759F7A245F98B36639FB410B799C62F84E5E99F0C00CB69C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 85a59c8cb4f6e809f66f36b0bb5ba18fa9161b1a88fc16e72b26dcf0d3791c42
MD5 c08e1070990b1541fd64c6b0f61c0d16
SHA1 64471e44fe68ab2d84d85156374fdcbb9a849c53
SHA512 1395e01113b26476764c1e9277a0db53877537a07144b74ff8453e995ee9324865bd96c0d5294f391ea1dc54989dceaef186a708ef1691012897b7602f13d72c
SSDEEP 192:zbONB6O7+3vFXQmiU1rA3Zatb0XO2PtaF0SJrnpbcM0GqjTwU9:zbONB69HWJa9uOUtWzJrnp90fEU9
TLSH
T12A22F83968689C7358E7B244F98737A39FA510B7EC862F80E5E85E1C00D769C379B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c2717e607d9cd7606e0f9f323472aaa9f3174cc84215abd92565f6123afca2f6
MD5 4e32a24e23a588b7e1defffb679161c5
SHA1 fac4da6d565548bf6eb22a24846692c3ec750699
SHA512 f44b4c81d3368cc93171e25699f436938efe0cf21d01a1be80d3135f5c89ed3f9f172f67dc90262c763705aadd1d39b48b173b28f17703fbcd76f6bf6df72595
SSDEEP 192:zasNBVO7+3vFXQmiU1tAl/atb0XO2PtaF0SJrnpbcM0GqjTwU8:zasNBV9HwVa9uOUtWzJrnp90fEU8
TLSH
T1FC22083968689C7358E7B245F98B37A39FA410B7EC862F80E5D85E1C00D769C375B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3907fac60f91711aee26c7d4928bb241292c777dcb7089e16d1039c4de2812b2
MD5 8e642282a4d1e9c1b2cced83c9d21155
SHA1 fbc122d15af11147d676fe5e450c45160c9e152b
SHA512 aa2ad11e322d69021291711f483087c0e1b421c1aab6890fb19e4b9762df0db1b4231c1ca07b09d4d6262b93e2aeb075c4e74333c465ab4f03c32fdf37a88a3d
SSDEEP 192:zbONB6O7+3vFXQmiU1YA58Uatb0XO2PtaF0SJrnpbcM0GqjTwU9:zbONB69H55Ha9uOUtWzJrnp90fEU9
TLSH
T1EF22083968689C7358E7B244F98737A39FA510B7EC862F80E5E85E1C00D769C378B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e1c7124-0732-4d9c-8152-3b6614f55e57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e1c7124-0732-4d9c-8152-3b6614f55e57.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41242\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnj43s8e.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yh9dz0zp\jnj43s8e.exe
Size 5.4MB
SHA256 d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06
MD5 acaff044266b5e5b2204e70ac22efc0e
SHA1 81f9039cb6d8ec2fd35bccd777320a71739c2de4
SHA512 427ebe3aaaa7d57221c2ce2adf20f9e7ccdbbeaa5ef7f96356a7a7539909772aa8cb8e53ee4d7cb5dccada74072b64f81b0a66ef9ae468e8eb5a16ec56d22302
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6up:AsTICteErownP0oTcMsABqljki
TLSH
T171463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads