800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45

Analysis

max time kernel
7s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
Size 5.4MB
Sample260818-sdtgfacq5v
SHA256 800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45
MD5 82fc0353c96e92e365feb73677672ea0
SHA1 0dbaa722e8a4dcb8aac114c6213754f721640fc6
SHA512 0aba4d9f154ef5e3774093af3c18040ed99cdcb091744335379b2056b3c86f3c8cfff8fcb6197ea12df28b23949adc5b7e22ff6d92e293d45a9d7e69fd7d5061
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRQ:OrICteErownP0oTcMsABqlaOz6
TLSH
T1D3463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5187
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1680
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6729
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7059
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5091
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3070
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7877
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2841
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9254
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7117
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6192
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3417
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5405
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2773
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8881
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6467
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8507
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5705
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1245
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1608
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2735
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6008
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9303
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6688
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8129
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9212
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9218
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5229
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9575
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1705
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6672
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9462
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9553
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7268
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5711
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9174
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6769
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2239
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6700
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1877
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4209
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9025
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4259
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3885
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6652
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3732
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3513
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4417
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7252
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7003
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2867
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5911
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3783
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4975
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8944
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2414
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2829
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7831
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9900
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8658
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1727
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4827
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2312
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1153
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4144
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8705
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1166
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5172
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3043
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4195
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4229
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4611
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8248
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9812
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1101
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6349
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1954
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9791
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7600
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5962
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5205
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8392
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1026
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6766
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3593
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8232
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5354
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2971
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2137
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1707
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4026
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4502
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7618
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6010
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9879
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9233
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2278
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4986
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5750
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1682
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4724
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4149
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2316
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2027
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5682
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1612
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5453
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4599
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5434
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4201
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4784
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8459
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2165
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6849
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6013
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9923
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8636
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3433
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3768
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1371
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3025
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6663
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1174
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5078
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2887
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5114
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6896
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4580
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3950
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5699
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5028
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1313
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8980
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1928
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5819
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8779
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7042
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7810
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1990
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8877
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6751
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8525
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8214
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8928
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5343
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2008
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9107
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7602
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7207
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2398
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8162
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6093
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5120
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3232
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1839
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5634
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2998
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7734
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1464
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6998
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6996
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5593
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4878
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1344
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2839
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7166
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7541
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5852
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9313
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1614
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4472
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1381
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4680
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7684
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9394
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4625
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3192
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6975
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5872
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8307
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4890
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9758
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8727
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4795

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bx8eij.exe	w8o9jtbk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bx8eij.exe	w8o9jtbk.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p1yod9.exe	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p1yod9.exe	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe

Executes dropped EXE 2 IoCs

pid	Process
3988	w8o9jtbk.exe
1684	w8o9jtbk.exe

Loads dropped DLL 23 IoCs

pid	Process
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe
1684	w8o9jtbk.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\i0h2va4g\\w8o9jtbk.exe"	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\yw870jjt\\afwti3k2.exe"	w8o9jtbk.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
394	ifconfig.me
418	ifconfig.me
645	ifconfig.me
1185	ifconfig.me
1358	ifconfig.me
1499	ifconfig.me
7	ifconfig.me
587	ifconfig.me
1786	ifconfig.me
2147	ifconfig.me
2433	ifconfig.me
3723	ifconfig.me
3963	ifconfig.me
4039	ifconfig.me
388	ifconfig.me
200	ifconfig.me
235	ifconfig.me
243	ifconfig.me
440	ifconfig.me
1661	ifconfig.me
1727	ifconfig.me
2299	ifconfig.me
148	ifconfig.me
1131	ifconfig.me
1693	ifconfig.me
1772	ifconfig.me
2325	ifconfig.me
2961	ifconfig.me
3046	ifconfig.me
4063	ifconfig.me
112	ifconfig.me
439	ifconfig.me
1189	ifconfig.me
1535	ifconfig.me
1647	ifconfig.me
2575	ifconfig.me
3906	ifconfig.me
8	ifconfig.me
234	ifconfig.me
288	ifconfig.me
448	ifconfig.me
452	ifconfig.me
1040	ifconfig.me
1208	ifconfig.me
3439	ifconfig.me
124	ifconfig.me
197	ifconfig.me
423	ifconfig.me
802	ifconfig.me
1787	ifconfig.me
2554	ifconfig.me
3497	ifconfig.me
4124	ifconfig.me
123	ifconfig.me
215	ifconfig.me
463	ifconfig.me
499	ifconfig.me
612	ifconfig.me
3154	ifconfig.me
4621	ifconfig.me
493	ifconfig.me
2304	ifconfig.me
4363	ifconfig.me
4457	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5232	cmd.exe
6032	cmd.exe
556	cmd.exe
840	cmd.exe
2056	cmd.exe
5896	cmd.exe
7100	cmd.exe
6988	cmd.exe
7844	cmd.exe
5540	cmd.exe
1252	cmd.exe
5244	cmd.exe
6040	cmd.exe
4092	cmd.exe
6832	cmd.exe
5756	cmd.exe
5996	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4256	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2268	4232	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	84
PID 2268 wrote to memory of 2056	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	85
PID 2056 wrote to memory of 1632	2056	cmd.exe	87
PID 2268 wrote to memory of 4540	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	88
PID 4540 wrote to memory of 2664	4540	msedge.exe	89
PID 2268 wrote to memory of 4132	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	90
PID 2268 wrote to memory of 4500	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	91
PID 2268 wrote to memory of 3340	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	92
PID 2268 wrote to memory of 2068	2268	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	93
PID 4540 wrote to memory of 4256	4540	msedge.exe	95
PID 4540 wrote to memory of 1468	4540	msedge.exe	96
PID 4540 wrote to memory of 1468	4540	msedge.exe	96
PID 4540 wrote to memory of 1468	4540	msedge.exe	96
PID 4540 wrote to memory of 1392	4540	msedge.exe	98
PID 4540 wrote to memory of 1392	4540	msedge.exe	98
PID 4540 wrote to memory of 3280	4540	msedge.exe	99
PID 4540 wrote to memory of 3280	4540	msedge.exe	99
PID 4540 wrote to memory of 3280	4540	msedge.exe	99
PID 4540 wrote to memory of 4120	4540	msedge.exe	100
PID 4540 wrote to memory of 4120	4540	msedge.exe	100
PID 4540 wrote to memory of 4120	4540	msedge.exe	100
PID 4540 wrote to memory of 4760	4540	msedge.exe	101
PID 4540 wrote to memory of 4756	4540	msedge.exe	102
PID 4540 wrote to memory of 4760	4540	msedge.exe	101
PID 4540 wrote to memory of 4760	4540	msedge.exe	101
PID 4540 wrote to memory of 4756	4540	msedge.exe	102
PID 4540 wrote to memory of 4756	4540	msedge.exe	102
PID 4540 wrote to memory of 1476	4540	msedge.exe	103
PID 4540 wrote to memory of 1476	4540	msedge.exe	103
PID 4540 wrote to memory of 1476	4540	msedge.exe	103
PID 4540 wrote to memory of 4644	4540	msedge.exe	104
PID 4540 wrote to memory of 4644	4540	msedge.exe	104
PID 4540 wrote to memory of 4644	4540	msedge.exe	104
PID 4540 wrote to memory of 3668	4540	msedge.exe	105
PID 4540 wrote to memory of 3668	4540	msedge.exe	105
PID 4540 wrote to memory of 3668	4540	msedge.exe	105
PID 4540 wrote to memory of 1940	4540	msedge.exe	106
PID 4540 wrote to memory of 1940	4540	msedge.exe	106
PID 4540 wrote to memory of 1940	4540	msedge.exe	106
PID 3988 wrote to memory of 1684	3988	w8o9jtbk.exe	109
PID 4540 wrote to memory of 3420	4540	msedge.exe	110
PID 4540 wrote to memory of 4932	4540	msedge.exe	111
PID 4540 wrote to memory of 3420	4540	msedge.exe	110
PID 4540 wrote to memory of 4932	4540	msedge.exe	111
PID 4540 wrote to memory of 4932	4540	msedge.exe	111
PID 4540 wrote to memory of 3928	4540	msedge.exe	112
PID 4540 wrote to memory of 3928	4540	msedge.exe	112
PID 4540 wrote to memory of 3928	4540	msedge.exe	112
PID 4540 wrote to memory of 4184	4540	msedge.exe	113
PID 4540 wrote to memory of 4184	4540	msedge.exe	113
PID 1684 wrote to memory of 1252	1684	w8o9jtbk.exe	114
PID 4540 wrote to memory of 4492	4540	msedge.exe	118
PID 4540 wrote to memory of 4492	4540	msedge.exe	118
PID 4540 wrote to memory of 372	4540	msedge.exe	119
PID 4540 wrote to memory of 372	4540	msedge.exe	119
PID 1252 wrote to memory of 4896	1252	cmd.exe	125

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7160	attrib.exe
4896	attrib.exe
6016	attrib.exe
6060	attrib.exe
5268	attrib.exe
6180	attrib.exe
10024	attrib.exe
1632	attrib.exe
6176	attrib.exe
6912	attrib.exe
6828	attrib.exe
10400	attrib.exe
6292	attrib.exe
5360	attrib.exe
5984	attrib.exe
656	attrib.exe
876	attrib.exe

C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
"C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
  "C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe"
      4⤵
      Views/modifies file attributes
      PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x334,0x7ff8af0ac188,0x7ff8af0ac194,0x7ff8af0ac1a0
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8256156025429371629,8725184937128779941,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      System Time Discovery
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13385112593435421264,11044092301174946228,262144 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,1374541106259729994,10561277506268206677,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16912472859664541463,5228256200933922101,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5399508154684264311,12032980051229883414,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,16372413669854327704,13412956748194382506,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,4536536484259409445,4151092179019128834,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4744,i,1251888483523698668,9286245466446667121,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:1
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4896,i,13130394884831245644,13315996939081830539,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4952,i,14874601687213646705,344814119883589397,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5168,i,6725067109857732387,16665738776174206904,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10530998184701077049,10478724490334150435,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5852,i,10918338298590299687,7907436945831452039,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5652,i,17354714235621420281,3451492246488010644,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,1161621096725853213,1112593728809165048,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,9740001000739670991,5632381130260032290,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,11686751048308445460,9323714008333133388,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4220,i,17170241285136277490,9800285966172243427,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7056,i,9966091497598829255,7798730120959726226,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7256,i,13361237553384878150,2186822748653246926,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7412,i,4397564904294837630,842137890542889259,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7588,i,16302691529132784406,17129013571844936038,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7756,i,16744954891685520181,14323246280784141705,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7896,i,3867752364981939863,452227946809531586,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7560,i,12005590467965541453,5440944188344248450,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,3236360528392737632,11344403148805297686,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,3236360528392737632,11344403148805297686,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7628,i,1243288338458452910,7765207876594783718,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
      4⤵
      PID:7996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8480,i,8253455380459783272,10963092602803820630,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8500,i,9242357379789517750,14599956083691754713,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8464,i,14427082411556652178,10969064813039969617,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
      4⤵
      PID:8020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8536,i,448899927953067609,7444645594260378288,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8956,i,878755719111027954,9426719951072274798,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8992,i,9702767733519290789,8672107327776496513,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9032,i,15226688034531837908,4742207183032711403,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11152 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9044,i,6067471313295398120,1701216853125996130,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9448,i,15751555462393996322,17265239146281322059,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11120 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9396,i,10875300445702188266,17293682306350180594,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9364,i,13862065816271945259,2176705948748132873,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9048,i,15531730212823955817,16056248370972728099,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9352,i,2187338658474799187,4793317084622515995,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9252,i,7727932715095165394,13609628601144100465,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9640,i,6720122388573413013,2621480176379729738,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9232,i,298808768743325848,8092033253827694321,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11292 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9600,i,5713264955546368989,8955254945290400033,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11296 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9576,i,9042944819196226985,8178714580649428314,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9480,i,13754369614989746372,16211030565966399285,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9828,i,17261353530316580014,14775564406139250411,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11540 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9476,i,7085042972866381203,5247271187506304507,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11432 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9848,i,15250901211412593684,9431563057754482838,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=6416,i,10249608836703501865,13800886166508624222,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11624 /prefetch:1
      4⤵
      PID:8188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9704,i,14532055664796029320,14711814780743420986,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9716,i,7844097030223504275,9231012791348723393,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11456 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9752,i,7943858421400192164,14562292241726166734,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11476 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9800,i,14525083229146276712,11788394258551235904,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11516 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4820,i,8336544801157807745,7012248680367504396,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11560 /prefetch:1
      4⤵
      PID:7156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9896,i,1744755327022960299,13937988100024832862,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11760 /prefetch:1
      4⤵
      PID:7280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9960,i,18246975120070414272,11568576754679514206,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:1
      4⤵
      PID:7292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9924,i,7616271559567251953,467504312923437403,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11828 /prefetch:1
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10016,i,7924528583805303512,14924206408986025163,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11836 /prefetch:1
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10040,i,10309425932099724752,3355495345196501750,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11920 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=5592,i,15948170655739982484,5468702522949552228,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11980 /prefetch:1
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=10156,i,11607921894231758828,1872430534023742730,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11912 /prefetch:1
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10152,i,14586700142809876675,586765938304843796,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11960 /prefetch:1
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10272,i,17006652341790267995,1957113935827628389,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=10312,i,5785268881845605313,13353038835416533838,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12092 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10176,i,3632565783557081844,4529095344386464371,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12084 /prefetch:1
      4⤵
      PID:7432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10336,i,3460798996524488853,8116379817578703112,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12164 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10656,i,6672037987775748837,10497612793357061834,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12200 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10628,i,246856387187945382,8803215476585875675,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12188 /prefetch:1
      4⤵
      PID:7552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10672,i,18277948934202780896,13620189429220795663,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12212 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6440,i,12661726938729478370,16893969647886873352,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12232 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10692,i,4524271370631788718,5733652509764621567,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12252 /prefetch:1
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10708,i,7427096154894302300,4258013882241865814,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12276 /prefetch:1
      4⤵
      PID:7616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6308,i,10211235182681762362,8900103867886736773,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12360 /prefetch:1
      4⤵
      PID:7624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10748,i,15048883181224727920,13304488810220736924,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12420 /prefetch:1
      4⤵
      PID:7632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=6312,i,18076145087711651829,1853329386200009597,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12380 /prefetch:1
      4⤵
      PID:7640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10712,i,290510912833065544,17548214649870786166,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12400 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10776,i,14171057021053288793,16645061723525198853,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12524 /prefetch:1
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10804,i,2386917318009492620,1611167750376765892,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12528 /prefetch:1
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10820,i,4299240466915959423,7711121293549823580,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12588 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10924,i,1568263319153044788,10716098048271216084,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12740 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=7408,i,17854760382626132932,7261505485876900606,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12532 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=7708,i,16435795162165191344,4379481121000887471,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12540 /prefetch:1
      4⤵
      PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=7700,i,3212054786418998989,17011814113041506409,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12756 /prefetch:1
      4⤵
      PID:7700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10960,i,15298132285393531170,8951815846706666915,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12784 /prefetch:1
      4⤵
      PID:7708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=7716,i,9159545312820137931,6300191734651528919,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12792 /prefetch:1
      4⤵
      PID:7716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=7592,i,15891269929828059365,6513953902886251429,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12608 /prefetch:1
      4⤵
      PID:7664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10880,i,17003853943388072278,10466317682670454086,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12544 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10980,i,18387430998079110218,5003085157592188577,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12832 /prefetch:1
      4⤵
      PID:7724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=4568,i,15066590640987447279,8531922704369244184,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12968 /prefetch:1
      4⤵
      PID:7736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10996,i,15532289673580499833,10012231930055655303,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:1
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10760,i,3762524755582251269,9015869650103470438,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13220 /prefetch:8
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=4572,i,7719465037669384210,13335432063130322497,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12980 /prefetch:1
      4⤵
      PID:7740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10828,i,3070611158140486770,5630509068980757411,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13308 /prefetch:8
      4⤵
      PID:7772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=4408,i,7182123299146877921,7740824545343104703,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13072 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=4548,i,4968315511357990758,13522598173071583181,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13000 /prefetch:1
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=7068,i,1250522623922784613,11955961954964900260,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13168 /prefetch:1
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=5608,i,9038002166555980677,1697339749075853188,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
      4⤵
      PID:7796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=696,i,10897705540511547004,13621253325417093041,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13292 /prefetch:8
      4⤵
      PID:7840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=4528,i,8046650508084630462,11573321264079779520,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13092 /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11028,i,5110577198656666188,13073541171790393776,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13036 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=8944,i,8931251405331169310,18277592540305407879,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13476 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=8972,i,2327430469782784024,18377507155701652817,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13488 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=5712,i,13555057155040664603,8215344074805821808,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13508 /prefetch:1
      4⤵
      PID:7928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=4396,i,15103339058265847011,18181791792774943918,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13560 /prefetch:1
      4⤵
      PID:7936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,3862312841382263572,12741412754006983674,524288 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13568 /prefetch:8
      4⤵
      PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=3004,i,9541891474578222691,961610910219712507,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13592 /prefetch:1
      4⤵
      PID:7952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=3764,i,1974280053265428365,11406368305846463439,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13608 /prefetch:1
      4⤵
      PID:7960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=5936,i,9396873505296675370,849288276436748741,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=13628 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10844,i,4991787820095114684,7061676231365311377,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=12592 /prefetch:1
      4⤵
      PID:7868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9756,i,6670675463132689101,13630694524053768145,2097152 --field-trial-handle=2284,i,13789145002197311259,4253379395075522412,262144 --variations-seed-version --mojo-platform-channel-handle=11496 /prefetch:1
      4⤵
      PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe"
      4⤵
      Views/modifies file attributes
      PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1980

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe
1⤵
PID:5084
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yw870jjt\afwti3k2.exe
  2⤵
  PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe"
      4⤵
      Views/modifies file attributes
      PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6000

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe
1⤵
PID:5500
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5z5a2pg\4lxhzi0u.exe
  2⤵
  PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5756
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe"
      4⤵
      Views/modifies file attributes
      PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5544

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe
1⤵
PID:5768
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a52x8f5u\1rdbkfmp.exe
  2⤵
  PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe"
      4⤵
      Views/modifies file attributes
      PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5864

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe
1⤵
PID:5952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvenitd7\gdppev9w.exe
  2⤵
  PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe"
      4⤵
      Views/modifies file attributes
      PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6076

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe
1⤵
PID:5584
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbdfx3t6\jvwhoe02.exe
  2⤵
  PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6040
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe"
      4⤵
      Views/modifies file attributes
      PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5512

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe
1⤵
PID:6128
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lryjx9v8\y7l22vj5.exe
  2⤵
  PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5996
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe"
      4⤵
      Views/modifies file attributes
      PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4092

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe
1⤵
PID:6072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tztg1tb1\qscwal5n.exe
  2⤵
  PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe"
      4⤵
      Views/modifies file attributes
      PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4188

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe
1⤵
PID:4696
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g7moy11\vtwqu6on.exe
  2⤵
  PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6032
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe"
      4⤵
      Views/modifies file attributes
      PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6568

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe
1⤵
PID:6688
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\23f7wig1\fmvzj7ue.exe
  2⤵
  PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6832
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe"
      4⤵
      Views/modifies file attributes
      PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6404

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe
1⤵
PID:6440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1fsfvtbp\pexzj1q5.exe
  2⤵
  PID:6604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:556
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe"
      4⤵
      Views/modifies file attributes
      PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6380

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe
1⤵
PID:5168
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snimcpds\i4tmzi6q.exe
  2⤵
  PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe"
      4⤵
      Views/modifies file attributes
      PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6380

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe
1⤵
PID:6720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u195qxf8\5apx0dr8.exe
  2⤵
  PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6988
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe"
      4⤵
      Views/modifies file attributes
      PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe
1⤵
PID:6528
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zulot1d\x5iwfsve.exe
  2⤵
  PID:6808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:840
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe"
      4⤵
      Views/modifies file attributes
      PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9936

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe
1⤵
PID:7672
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jz6zn7d\4sltchsa.exe
  2⤵
  PID:7800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe"
      4⤵
      Views/modifies file attributes
      PID:10024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10804

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe
1⤵
PID:9880
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghomute2\7gfre47q.exe
  2⤵
  PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0kh1k9o\g01csnst.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0kh1k9o\g01csnst.exe"
      4⤵
      Views/modifies file attributes
      PID:10400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3fd12b9b-3164-4aac-9a1a-0c759f1fe011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3fd12b9b-3164-4aac-9a1a-0c759f1fe011.tmp
Size 12KB
SHA256 8944eae97d991c766009f6355a9e889a900c75c69d79166ba7b3ce2ed9db33c6
MD5 5d7190c79940153517c5c522c795f565
SHA1 b7ba1d05301993c3b7fe1b82eae22168541f6f28
SHA512 235fb80ff7975ba2c69e67b86a217a5045bb7b30b31cdfcdbfbe3e570b830c0b7081ccbf539cff750cf7e9935aa15c6b60a55c4fed93efe72e3511344a72a399
SSDEEP 384:nGsNxZzHML5ZzX5od+2d6/Id+2CLcOk31:G00hOv3lCLcOk31
TLSH
T131421831A439AC3389FBB645F44B36939FF450B799856FD4D9ED9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 280KB
SHA256 fd5cd5d4564e179dfd88ffdc8f19a512715083250b9bd17ab65b12084dc8e82d
MD5 57c82fea5be2d986d05eb929d141b333
SHA1 815f64c06bc2f39f97d7e3695ec728dfd42336dd
SHA512 48e1d367dec8fa72b2bfe0eb316ce65d614282540c0899f32e7ea394de4bf427d6a70b53129491a14a0546e5024f56264c619658433612d8393fc21ab50c27b2
SSDEEP 6144:zPg/0+vqaW3pGpYBF2dbRfFILA3CkKqcUTCxdGwoDaeB01HY78:z8h2BF2dbRfFI0bhTUADDN+14o
TLSH
T11254233EA4E9E2406498A5C867AE4F8550FF4601DF5F7B0DF6BA8051F3228D143A5EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 105KB
SHA256 365cd7a2cf4725ab35d63321e811b31cf1e5c4fa807be90fa3a9c45891e18b8b
MD5 e92b3f6bc5245b3a0d528851a282eb3b
SHA1 692dc631b09bcb7ff0b4a08d306219aae1716651
SHA512 f9cd7536c9b642f7082ce428634f57308cbd4e3f8537fb7d281c4ec144eec9ed5075bca3c10336387e889b13b6a632e190439204b093acb4db1d5c368bf6922c
SSDEEP 3072:eGBqPBjrKRj+XbQhubPMs95fIZbHnMVwPCnSi8:eGWgOMhubPMsXKbHgsCnSi8
TLSH
T1D5B312168839DE86C3932EF384C06C0348B02BB45CE7999A18D958DBE94CF17E69D3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 43KB
SHA256 0b14ab9d0e4863752717c058f8c982eb4d624d5e39216664f57d4aab98526dd0
MD5 a24f60462094703b479746602f6ac25c
SHA1 952042cf719953b7ccfb796cf11cf5034d9171fd
SHA512 625030ff305be05987ab67afd6a9c7802c122fc7e8c374acad8ce247ab3ceebb852a4644372429c702cdd59714879f12f57ab06ffdec30024713e50549589a75
SSDEEP 768:6hy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30/3M4ITeCbFhd+:6hyqeUG44t6gecNW+o30/Lqeb
TLSH
T1D5130222F3204A2B382226EC580CD1851E0EFFD0E5562CD1C7A96C9EF5954F34AEB4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 67KB
SHA256 a457ee61b768bcf163dbe76c288b34757348482b36a3947945a3a328b2a7d04b
MD5 12348749e2880973531f8a372b6b11ef
SHA1 e45ad76d630df1f310993c20a05e6583940c14e1
SHA512 8924988ea11ce84822f6b838527095ecac8ddaee0a8a8b9843e2e6239a53275da2a814a5dd92ff40f6b1d525b3ca5a0e9b53ab5d09308ad3cac0d19de2493481
SSDEEP 1536:4tDggvovvcfrJxb1MO6xgRpcd8R3FjlsuR+vb7gP4u8f9/hB8HI1:Agcovvc9MZgXjKC+j7gP4795+s
TLSH
T11A6302BC9BCECE5530ACCAAD543D594ACE96EB710A0ED183DE2D468CF147670A37148D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 158KB
SHA256 b352e4f1729802ca1abf2b130e9c421c54f3fd39ba280fffbab247c121db901a
MD5 048b9248b1bf0ca9a0c218029544f853
SHA1 087681340f9d3ffdd4995324ab231a60523bc33f
SHA512 25cef35daa97236d9075380e53c2c18f33a53892dfef764cb42647472f70217c9d6d21c08c5de036893581f010efcfc0c8d3a68701ace587e4ff2d7004d55763
SSDEEP 3072:s4SzrleBAAmXxojKh2cauRn37QZg9YMXQnha4A3FcBX1gRO1kwsATq24p4t3I:s1zrwcxM6HN37Ug92l6qq21bur6I
TLSH
T1E4F312F30DBE983BA5F968674239E8DD235F94F52EF254A0DB4A0E8184C831C45B95E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 205KB
SHA256 cd57284edeb7b3bac83dea9ebaef9289d0422d3c7009eed8cedd5e1dcabe57f8
MD5 a7fa95fe9e9c41d2328d5d820e5c127b
SHA1 eb288f07b2761be375e6ebba266480a983a36609
SHA512 c51aa85f2cf17bb0c1fb31ab10aac2300b2a04daca03a791a8c91341716cf6be5eeb00bf948fb6f858171e8451b7f09b63852a77af33da70029640e1c50d8ad4
SSDEEP 6144:ij8NBNT44hUIsB977SKEGF6wrhUfIkEjYADcq:iANB544bM1eKrVmfI1HH
TLSH
T1B12423240D61BA0B92F834C41D286C992C9AD1FA79453F15F48EAD1AED2C3BF76C1ED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c334dd6b92df96878b59ed007f3a58a0c20b4607b351fef9c754f157aa9de68f
MD5 efa432593d269703ca8439bca421023b
SHA1 c259e447f191d212505861c69f9a6955cc474ac0
SHA512 5e603a452b541ac6d8ab809d401783d66edc4b562cd8ee2bf94ad7e03d9e48d8998e28a7e3635d794057e6d16e48bcf20591a3ac9fad776faa1897c7eab677d1
SSDEEP 192:sxZmRXyM/jK1Ml8MjB/fKs28yEdp5M0LFx/W6+WNiQQF97ddzZ/ZYB9wdoIgyJ:sxZmF7B/fKs28FR7bC3FZ6O
TLSH
T1B352E8166A3869778CDFD319F915BB57D2F5446292940E94AAFCCE2C00E6AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4ef34e7c7671db494a3a86314f139ad4ac42830b95f7852f71a563ffa5820b07
MD5 08954ba6521d2c6d14feedb049c99eb0
SHA1 39c439ac07813457e769a9d52f4fd131211b7b1f
SHA512 7f99b2e14e4205452811ad0cca4f2b8400c1db090feff5052e358803cb16cb4e48f74c5ebde8d349c16af885699840e05a6859f7c5323c3f20960189ea2b5591
SSDEEP 768:4nUZYGMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVweLlPZ4RJroVF0+:4nUZYGMWvg0Pou1ja7eLZmRiE+
TLSH
T1F9E20A2F280CCB7E4F844E9DEC2A6F967ED801CB5A584D5447EA894C02C72EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2d03c2aa10091582d849a17e266ecd89092c1d57ef19c0e2fd44acd9e591400e
MD5 91a707429d9a5482b1633727b31bfcf4
SHA1 b36a39d8228c0ef62e073f4a37eb6e0a70d83b74
SHA512 68f4669bbd49ee2ba315947f4d2800915f4da9a04c18ea57986cc9156f759164a9518e2139cefd5716ef5ab80b027ad29c159ad04e8a1dd5e8456c196104c9a3
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKliOz:EWE1r9n5
TLSH
T177E1D21671BA03113C7E2A0C86B59B669E417563302DA52F7FAD00B54E6AE209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c08950bc9dc23395f66b14d3287b15669697da7f6cc060cf77bf68e82e22701e
MD5 2723b45502f3bb6bb24d74cce67f7265
SHA1 649f268e8e2f4232857336868074195d5f92f4d2
SHA512 4d16e59bb66254bc29ede2bbc5c4865a597f20143f7f46deaf27eed6a716c28e8279200c4a6a04c3f98ede12dce21ebcd67577e1ed4cd9d311df1a4a173a0ec5
SSDEEP 384:ncsNxZzHMe7lzX5od+2d6/Id+2CLcOk31:c01dOv3lCLcOk31
TLSH
T16E420831A839AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 007a140d801fd6a04745c72421250619135907f1d408f523dbaf7b13e9893496
MD5 93e0f2d834f09d206e950e72d08ef163
SHA1 d3ef80475ca6ff86a99c11fd73af566d486fa5f4
SHA512 9fc535c809e3394815a6218f1a9aee012205bc6e9182ff75b294cb0a50977b7e5077cd33d0d3e62da2c9b338df7bf8b9648c1307607af3e2e330ac68905542a3
SSDEEP 384:nnsNxZzHMsDtFzX5od+2d6/Id+2CLcOk31:n0Rh9Ov3lCLcOk31
TLSH
T13D421931A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2935bcc34524b3b3039c531b0bdf33a47426538a0cbc0ea7c0502d24a2e500db
MD5 e2a06b72f23bf1e83ec4dd1ed379dec2
SHA1 8d15c6072a238da6edded86cf5a2fa85630f9948
SHA512 15ec87832ee0aa9d53ae420c4bc422508b04f16644cd29cbead25b79e88c90187688bf94e31d5b9602e6a9eb35f8541423708936ad264f57a7cba1c369c6e0fb
SSDEEP 192:z7sNxTQolet24LQmiU1QWM1zX5Obd+j1+FdgX/oxFd+2CLQjQQQqw6k35z4:z7sNxTHMtjKzX5od+2d6/Id+2CLVOk3a
TLSH
T1D5420831A439AC2389FBB545F44B36538FB450B7D9855F84D9EC5F2C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdc7d426a851f581f53d9fb66f7ff0f216acdaa1ccc83165edaa16ebd54d2a87
MD5 65abd0db1bbc0f413181312110df3260
SHA1 fddefd0df31376e7b378352b999755b93894ea43
SHA512 243f18e11d699a9c7d4979e2177b3bc64aa06c68b7c511f85d3114e3fc7731e154fb570bec4b5b19b41a341544453a22056da020fa0928497e40a762977384ca
SSDEEP 192:yONI61VWQmiUynigGX5Obd+j1+FdgX/t/aH3PXU6:yONI6WzgGX5od+2d6/w/XU6
TLSH
T1F902B73568787C6B8EF2BD49F48777135FA4106BEA952B84DAEC1B1C00D765C2346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ab7adb1f7625a710d342e9e00ea780e09acee9e26e023fe6b8bc7b30124b6f8b
MD5 4ae2bd4e685fe6f0b7cb4b73503bdbbc
SHA1 e8d895d0b12e80eda809557f6a28874aeefc0d7b
SHA512 63db223659d598e4c45ad2200527361a45932d191b8e9d7bcb6fcd37ba597f65bb1d498b52e68e9708fb89a990e0e3ed98c97b473320f920bf2605026f763a44
SSDEEP 192:zesNxTQolet24BQmiU1iWarzX5Obd+j1+FdgX/oxFd+2CLQjQQQqw6k35zv:zesNxTHMPVOzX5od+2d6/Id+2CLVOk31
TLSH
T13642F831A439AC2389FBB545F48B36539FF450B799855F84D9EC6F1C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 86bfa8b2cc808467efdbce6ffb220c99f5359a7a35e27f5bfe57963ad38b0702
MD5 c530f77d2dda2a9bac6587a2671e0577
SHA1 e2281f3e75262b59cc42e7c8839be8b3c7c9693d
SHA512 dc4c196a7bebf51129ef3fc478b381bff8bd1d07a03b7f0908ba5bdad7c19007296600b4c696a80abf0564784b9174e9a704b4393f6e064703a589efd6194eaf
SSDEEP 384:zFsNxMzHMP3ezX5od+2d6/Id+2CLVOk31:hTmyOv3lCLVOk31
TLSH
T177420931A439AC2389FBB505F48B36938FF450B7D9856F84D9EC5F1C00866AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 baeeb1ac625a6ab88ccae218cb6fec7df30ae527ba4325199b126349fb389fdb
MD5 7f084b4e0e40acc0d84778c837ba6a48
SHA1 659e9c360be14fbe0c8230164d9f9bfbf703dcf9
SHA512 8c0b78c12cc7a017197405b8afbbbe712b18d23c5effb7c5697ec99726fde4d385d1a987e0ef0e5163697dab9944b222b376683588cc673c9efd236240fedd80
SSDEEP 384:zRsNxMzHMPqQzX5od+2d6/Id+2CLVOk31:FTbYOv3lCLVOk31
TLSH
T1BC420831A839AC2389FBB505F44B36939FF450B7D9856F84D9EC6F1C00862AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 39c0115b924e6352443d1c593af40442aa3c32d5b54557827c2d6c31b294cb82
MD5 85e49f5d104fa7d7032d78b38bd006dc
SHA1 cdcb222035d9528b9205ea1936b7684bda475425
SHA512 88d2f5952d4313bf81d18dd2e1695a1b317ae9b69e91a4d265109c76ae6f49adad7797708d8b9706d27f19b9e84ec46be2fc906065eca2cb52eab98387975b26
SSDEEP 384:zYsNxMzHMvbl7zX5od+2d6/Id+2CLcOk31:kTAfOv3lCLcOk31
TLSH
T15B420831A839AC2389FBB505F44B36939FF450B799856FC4D9EC5B1C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5f0b9ba2220b079ed1ea0a7d665ffe6a7c5fa34fbf770552589787634ae2e3da
MD5 41307435709e8dc7d82182f15128ee81
SHA1 64dfd2936365a74381b54c9def4631b382fbfd08
SHA512 04dfa13dba820caf5aba04b205ea7eabf9107504d3dac4d7e518d4570401a02eb577e3f48bcd1fed0a98da551ba6797876a26a4a959705f647d33ae10d3c703a
SSDEEP 384:zpsNxMzHM7bNZzX5od+2d6/Id+2CLcOk31:VTghOv3lCLcOk31
TLSH
T112420831A839AC2389FBB645F44B36939FF450B799856FC4D9EC5B1C00862AC275BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7d05adb4435ac8d41d055d2c7ac45a16c315dcb74c9f5352a70c4be8427b30af
MD5 912cec1a167b06f8a1901b7129f2a5bb
SHA1 b29ceb4a6a4aea19065f2e33f024063c69bd5f82
SHA512 804f2a6596676727896400b9d33b4e1313a245c2609b6511fe6405cfcd7d6f55deee3bd20a21c564d514eafc26c1ee4e75dd6ea458c4e1d93258d10e3ad38e08
SSDEEP 384:zpsNxMzHM2CDzX5od+2d6/Id+2CLcOk31:VT4HOv3lCLcOk31
TLSH
T174420831A839AC2389FBB545F44B36939FF450B799846FC4D9EC5B1D00862AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b0e48fbc1371de56b22a165344ea154d6c75c51161889b41af28850a1747f4e
MD5 d3f0ad087b3bf5fd84e5ab41f2243749
SHA1 2c5f1748cc402650d2835d661f64f15d4bfe091b
SHA512 566943c905cb10035f3cabcc77e17d89192cb459e8961486c8e05db963f905615b0f45835feb763f05694ed4af790d3b1a8b156c5287b67e8ddb373c8bc9ef10
SSDEEP 384:nYsNxZzHM2rpzX5od+2d6/Id+2CLcOk31:Y0VROv3lCLcOk31
TLSH
T1FC421831A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 24e1ce1e1ddad7e4b3d1255df9adc8b831eb739fb771b10d5f4a3f625188678b
MD5 5dab99831630843437c5cbe57b58d293
SHA1 8c739f29798435e73c3a4160d28936c5e7b4ea2e
SHA512 4bf2ff34d2729669453e691d065d9af151e9f1472ba470e14301585197588b109cca698225b92f851103f3d3539d47a07ef4f675eef0afec2907b108d17173c1
SSDEEP 384:nYsNxZzHMESjzX5od+2d6/Id+2CLcOk31:Y0KnOv3lCLcOk31
TLSH
T13E420731A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC271BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 78d41b18047bd781f31e645d5f915d9b7daece2029326fc933bb343486bb3f26
MD5 13c4d62f61e14f12c1aaea6e0f941d9a
SHA1 85a7a42c11e7a2180880cf7ce9244fcd46716f0d
SHA512 96d633853bebcfbd81ada88d7964916e144f9072d81e1ac598ce66149c758a79e0d18ca090ba7aefb2b0d54efdb9f48257b1f1c7c45b20b2d9b7c7b26f6b78db
SSDEEP 384:nIsNxZzHMsb2TzX5od+2d6/Id+2CLcOk31:I0Q3Ov3lCLcOk31
TLSH
T13D421931A439AC3389FBB545F44B36939FF450B799856FC4D9EC9B2C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8b47cf4f123028ecaa1e9612bfbfe1875e0904be4150e2726da68a4b4b0a7c77
MD5 1802ec04cc2cc3f5ebb77ceb432047e5
SHA1 e0fbc9fd9c04f5d256be6829faae3356803eacd3
SHA512 100cda768b4528dcf7217b3400c28d5461c371830d14818cdbc59b72c1d75f78b9b89f960d7840ca50291d8bce2c4e5ed7f17c674d0705248cc53b75e110b95d
SSDEEP 384:n6sNxZzHMsbGTzX5od+2d6/Id+2CLcOk31:6003Ov3lCLcOk31
TLSH
T122420731A439AC3389FBB645F44B36939FF450B799856FD4D9EC9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6ce67d4e46ed07fcb617fe47be47c1370183cc1b7645d489a43306a09846b028
MD5 2cc9ba7b4a642a835a1b14d1ccfe7aa1
SHA1 f045ab755fc8076099dc7108a695d6605d9413ef
SHA512 757836efeee52a5a5d1cf0bf86268df6d1b48e40fb726bb8e866344bbc017adb452b1c576e3e350b8f59f625d5a3ce6b2f7b65bf06e7d0d15667b30733dc9cea
SSDEEP 384:nFsNxZzHM3iTzX5od+2d6/Id+2CLcOk31:F0v3Ov3lCLcOk31
TLSH
T183420731A839AC3389FBB645F44B36939FF450B799856FD4D9EC9B1C00862AC271BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c7da4b2b17fe18bd8a0faed0e07cdfac55f08bcb141c9dfa19e9b873028315ac
MD5 c4e7ddce2487f9fcdb0b01abfd329156
SHA1 5960a14b4c7e16f1122a7af83b788ed5a93085fe
SHA512 9aeaed621b778e84f7efc68b7a06c9e79d519475f7b21342969eff3bc7be634c6cec2982e7c1adb6af0a54a0afa89eec9194e0f2cfb4d1b36e0962432f7b947d
SSDEEP 384:ncsNxZzHMsDE3zX5od+2d6/Id+2CLcOk31:c0RoLOv3lCLcOk31
TLSH
T1A0420831A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 98187e047eef6eb18caa3d8611b7675d977ae9735e36a5dd24c19a2ed9c13a7c
MD5 53b3f125c225dab7abd3370f3b2cde49
SHA1 330aae61d844f884ab69866349050ba0a83cfcd8
SHA512 7c4deb32abc553354ed8921e39710be23c83ae081bbf12b56e05f7dd7643e04c7142bc287a4025f952dec795de07128921ceab4fc5b6196688324a5296526ca5
SSDEEP 384:nLsNxZzHMvFBzX5od+2d6/Id+2CLcOk31:L0IJOv3lCLcOk31
TLSH
T195421931A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d43300904bd32ccf9c6dc2ba86e9cc36b1e54116f66754d75a5370959452336b
MD5 55d4ef8814c9f601eb7149f3b9418810
SHA1 4b0ae06f20e3f8b3ebb09698a6a65f54385a13df
SHA512 d2530a6d235f2fe3214c121b6183c4a61b1ee898d6aef870635eebd4322aff991d94dec40620105dfd888818362d1fdd20f3f18db5546b45293456247ecacb57
SSDEEP 384:ngsNxZzHMBcbzX5od+2d6/Id+2CLcOk31:g0r/Ov3lCLcOk31
TLSH
T144421831A839AC3389FBB645F44B36939FF450B799856FD4D9ED9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 09c0094cccd097f19b36b1eef4728f5594006fbdb2a4cc2c61611fcf8a575ee8
MD5 6038ee2654ebf57af8aced3f08cc53c7
SHA1 e7595aff16c695f577eb76480e18584f1cd1771b
SHA512 40e3ea880bdd02dee486cc9d29f7cdbc4f173a0f0be27d5b9d69b8193cc628ac34abe52d964ceddeec40162af7b279cb41b49d4a8eb94fa308051054f5233454
SSDEEP 384:ngsNxZzHMLTdzX5od+2d6/Id+2CLcOk31:g02VOv3lCLcOk31
TLSH
T1B8421831A839AC3389FBB645F44B36939FF450B799856FD4D9ED9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 79111c43909f4fa1fde126026c7d89964c1049591c7a4f3414115e34f0efce4f
MD5 53f953f69c453bcfebe158477176fbde
SHA1 9b1de19f78181f586832b9bd622e92de8cb7712e
SHA512 fe77a66b35b7113bcb27bb71622d0fdf29d10b02d8c34073bf76402054aec01ca77663eca3cae5c3c6a13e6f0403d4af2e7749828728a1666c9b431b70989717
SSDEEP 384:nGsNxZzHMnATzX5od+2d6/Id+2CLcOk31:G0p3Ov3lCLcOk31
TLSH
T10E420831A439AC3389FBB645F44B36939FF450B799856FD4D9ED9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bfa0dbb3696cc810ea874bdffcfd2fd6298cb0b275b28480246cf93d57843389
MD5 3a8554d7a1cd6873e641bed5edf8af03
SHA1 2d913e88abb21f7ac9586837841de8b00a17639d
SHA512 00a8c67b6aaef540694d311e096de5953a79633d8537704d85089e714c669177b36b4bbb63bfb7b76f71170e195951c06905a2deb726d6f863a81ed27e48b526
SSDEEP 384:nIsNxczHMAQ/zX5od+2d6/Id+2CLcOk31:I/4TOv3lCLcOk31
TLSH
T1B3420831A439AC3389FBB645F44B36939FF450B799855FD4D9EC9B2D00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 edadcef05fb0a661ce9b03d2fa73b304840eaea35076c99044ae19346ba8bd47
MD5 1663018980f3e02849912bf3f571469a
SHA1 6e358447e7c227bd00cbe6be2a547483e8f6f23e
SHA512 231b2bba042a4e3638978f0ca0a6ed975a50d90941f34d7f7138c6c45f9fec1da6166e87a8e2c3c862a12a29b3f5cbc580e1271f29b5e385a7ca77f581b4e95c
SSDEEP 384:nIsNxczHMhJJzX5od+2d6/Id+2CLcOk31:I/mxOv3lCLcOk31
TLSH
T1D5420831A439AC3389FBB645F44B36939FF450B799856FD4D9EC9B1D008A2AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee4ea1a2fd7dcf91055524bf9b193c431ed20d0ddce9355972b0d75fcbda8c70
MD5 d4b17410d501cb360e7867ba4fede2d6
SHA1 c097bdc7978ebaf9e0a55a0169e6bfb69498b664
SHA512 1bd2ea7b43fc4bb08876226f0a4b331944d35be8405c18a2806fc5cd01fdec89a2fc86bee4194be72a4315b35b66425682dd2e134bdd490bbb8248ae948c1196
SSDEEP 384:n+sNxczHMhXBzX5od+2d6/Id+2CLcOk31:+/IJOv3lCLcOk31
TLSH
T1E0420831A439AC3389FBB645F44B36939FF450B799856FD4D9EC9B1D00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b322599f2911991f1978f937c3bc80b49cefcfe47c8318490813b5644217a247
MD5 7c96b8c4803291c7365699bb7ac8957d
SHA1 fccd659fa47385ef1eecde9a5c13736b9a5ea372
SHA512 13b0b8653a2b9367accb6eda7f40f381fd60c97eb1ca4fe3bf63ab4fb3cdafd73e87e523b64c2f91aa1d024a9e0d3fb97dd0fc978943c500c89da0098bace0d1
SSDEEP 384:n+sNxczHMhsXzX5od+2d6/Id+2CLcOk31:+/3rOv3lCLcOk31
TLSH
T19D420831A439AC3389FBB645F44B36939FF460B799856FD4D9ED9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4d45540b6d0c8edc2e07b58ffbcd11d9f82e54fb59ea215d9790b866a28242d0
MD5 a09659a71156693db10f284270f5b819
SHA1 ae2b793ba467f67eb0bf72ecadebc1fb44b30215
SHA512 fe6c92d7043ccd94cd71aabc896690189c2ece6170dbb87ad177c061200e562d0f702f8b80c508603031d6a0a280361363fc019aff29f24595ffcdfabef87e5f
SSDEEP 384:nusNxczHMhVZzX5od+2d6/Id+2CLcOk31:u/OhOv3lCLcOk31
TLSH
T1B4520831A839AC3389FBB545F44B36939FF450B799851FD4D9ED9B1C00862AC271BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3dec8e20859ba889438070f396d7b1cbb313a7e93f50f7c2f253d3c5339a4611
MD5 e26bebf59ad84e254753e6e845c3eee1
SHA1 e2bd58603dbf1a79b34597ee088b73985c1d529b
SHA512 aaa3fc2ae8bccf92d4c5bbcb5553015542331d14ed776db022ad9c5fc4b41ca9041058fd5d01b5a6607e371f8163f475ea07b8ffc22ed3540aefc498dad97d45
SSDEEP 384:zlxsNxMzHMPgBzX5od+2d6/Id+2CLcOk31:fTlJOv3lCLcOk31
TLSH
T1FC420831A839AC2389FBB545F44B36939FF450B799856F84D9EC5F1C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fc3e4c5a6658dab55b94cc1158e05b7ac57bac34c39ec6d890afd5594ac2147b
MD5 49d9fb824b1468a41a012bb8e44883ae
SHA1 c95b07fe7ccd72afd0022898dac656229742e114
SHA512 e201e2f2a12b7c7ad882994073927239191053f49771c13c22f437245ffae0716e6eb291f5b2cc52ede541243c5bcc19e070d2757071a9359321af7d40f64f78
SSDEEP 384:zlxsNxMzHMIZTzX5od+2d6/Id+2CLcOk31:fTx3Ov3lCLcOk31
TLSH
T184420831A839AC2389FBB545F44B36939FF450B7A9856F84D9EC5F1C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 744f548d380fd14114a388d8925f5adcef6e3592d9bc253e7b6bd54ff6770e89
MD5 6bdb8b682279a1a13cea1f0eb1e084f8
SHA1 5d4d1dc435781a14ee0b1a2aaad9e6655f2e464c
SHA512 c55255e91625781dae09cb91e0feb8fc992b375d53f5d2e51f6ca9a481f84927aeba4f26cbdda26939cbb44842b622bc5837cc569b62913ecc84166a1a58f001
SSDEEP 384:nnsNxZzHMvODzX5od+2d6/Id+2CLcOk31:n0nHOv3lCLcOk31
TLSH
T14F420831A439AC3389FBB645F44B36939FF450B799856FD4D9EDAB1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 99cf0f815c1822f089dfba468236c17076072eeb456f9efacec1025ae38a7173
MD5 879c4f0045b347fb9415d2e742004ee9
SHA1 f0dcb17a767a155fd20ee3b8c6213853fbda69ed
SHA512 ffd9d08de81f5a6156a97fece510ae027c3e8f4608d124ccd61ea956720f22f7421825366b8821ad08ed62e3bd0c98b825f6c0e9b01c640b47fceaf724bed4ae
SSDEEP 384:nJsNxczHMAebzX5od+2d6/Id+2CLcOk31:J/G/Ov3lCLcOk31
TLSH
T185421830A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B2D00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ae395c7e52a7284d6b0d081f8749737d601520b017759f4d4fd9eb6501b4fbed
MD5 9f233f718e0e8fee12b20f2be508be90
SHA1 23ebd7e60aac2b817264b100389298434b3a7476
SHA512 6af7d2bbe91fedf4c0d6309706fbc8b3c1f7e76b0fd851cc4072b986ff54d9accf746e476eeec192e148c119334d3bd90db76e2b15f9de1667d9778589b7912d
SSDEEP 384:nssNxczHMIKDzX5od+2d6/Id+2CLfOk31:s/WHOv3lCLfOk31
TLSH
T1E352F731A839AC3389FBB545F44B36939FF450B799856FD4D9EC9B1D00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2cdbe7c9ae8a26d46fbd05121b463ee4595ce26b6684ae67b8820a01badc80a3
MD5 aa8f1f2f97c5a7b7bf943c00cd5b9c88
SHA1 2048d023dc07115576d8d2f6abaf37f916fe3eef
SHA512 f6e23c4d15375b8c46277903de57f1adcf8e9b1660bc16f38f17ba2ed61c8d2c3da1e7250c4701e4d877156870290c97c109c1032526df722687ebdcb3b4ef6f
SSDEEP 192:uONM61UWQmiUyci9GX5Obd+j1+FdgX/oxFd+2CLbjJQQqw6U6:uONM6Ri9GX5od+2d6/Id+2CLpOU6
TLSH
T19712F830A428AC278DE6B515F48B36939FE42077ED896FC4D5EC5B1C00D769C275BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b882747d6058fe72a9cbf9f5bd701aed48c7a8ecbb810f5cbaf9b086eccb57f7
MD5 56b9029cfe28e17e31d4129f4bbc4507
SHA1 4bae6de471d12a47fdbc9e08f6214e25dac0e8c8
SHA512 cd60aab40ee03811c64f1251f2c6a6e95fb1b4f29594ad7dd71e6a2f20ddd0220ed79b926dde867778c2e85b83a8f4aa4c0d0f15ec2e3fe331fdd9fdfb0a42de
SSDEEP 384:z8sNxMzHMI85zX5od+2d6/Id+2CLcOk31:ATUBOv3lCLcOk31
TLSH
T1B6420831A439AC3389FBB545F44B36939FF450B7A9856FC4D9EC6B1C00962AC274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 acd5f8711d2c77e90f2cd628198e1e6773cfe857ebf527f7b5b38b7b7b99cea0
MD5 5cb87eb2d12991c7d12708dad64dc1fc
SHA1 d2c4a65a941a957acea3d03dcf0d0134c59a5230
SHA512 12d8c75fa086177a75f73dd9dacf7d36398c9bb84d25df0a386c034b9c8dc8ac03359eeafb4bd79b25f142d22d178c938527bfc8018ffd5bf27945c865efcc5f
SSDEEP 384:zpsNxZzHM2B4MzX5od+2d6/Id+2CLcOk31:V0LBOv3lCLcOk31
TLSH
T1A6420731A439AC2389FBB645F44B36939FF450B799852FD4D9EC9B1C00862AC275BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ba7d16c3278c1f5e10ba3de0b3d60a77e62cec0481f227568d363ab5d38cfcfd
MD5 431e0fe366dd25393ab78b1ca13d51a2
SHA1 3c651186d9b55d496e340a7bd09204a424064e5b
SHA512 65d0f5eb437071156322998b9394da3ef8dc25c56379879252c6f96c0e800d2b355899c7860413b905cd550b8ed398b6a43496f812072d0e84bdd11ab49d0294
SSDEEP 384:nMsNxZzHME/ZzX5od+2d6/Id+2CLcOk31:M0XhOv3lCLcOk31
TLSH
T141420731A439AC3389FBB645F44B36939FF450B799856FC4D9EC9B1C00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 534d034893495a6e846a19800f1bca1440079593f64403e1bb4286be930d0954
MD5 4d5d8bf6ab64290db8fb192409529267
SHA1 48f3baed556cb369847098a3213c45be37f2ac04
SHA512 b08a8cec26b480fa6b915852959f30bf6aa18b66f179b47588a228b9297628bd3a3dffc51150d722f42161a09f3be821fc12a2e5c571eb65b8089289ee4d969c
SSDEEP 384:nJsNxczHMnHtzX5od+2d6/Id+2CLcOk31:J/OFOv3lCLcOk31
TLSH
T139421830A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1D00862AC270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c66c2de4fa2c5562893eb96989d2911a1d0f3712fc4490fc8057225b9f46d72f
MD5 b735434dcffa3e643cf3c19bb090f29e
SHA1 69a60d4a4b1e0daf7ee0218e728792413e3d00be
SHA512 1492cd992d7ab2c2bdf4abfa981f22dee92c6f23f8d7e2bb37d259eb8caff01a33da29bc592ae48bca35ab8b9fa4c85c465ab976bcd4d73c7ae27b97e87ab504
SSDEEP 384:n6sNxZzHMPP9zX5od+2d6/Id+2CLcOk31:6021Ov3lCLcOk31
TLSH
T1A4420831A439AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2b138c3d9ae91c76d2b710478c9cbc04f803775914df2979959af83974e9173c
MD5 d41ddfdd3ee2610c0e535bcd8a6926fa
SHA1 3fe4e35b203d11c83c51b91aa3b181d1f5141966
SHA512 c48897568a26217e8300189fca2cf4cb9a8b651d32b966b0e3cbd2e4518d749d7491604f8278294745309fba6ec6801dd55cc311ed420045e5528ebaeb7dd9d9
SSDEEP 192:ziONx61t24/QmiU1pW7yzX5Obd+j1+FdgX/oxFd+2CLbjQQQqw6U9:ziONx67xKmzX5od+2d6/Id+2CLwOU9
TLSH
T15322F6316828AC278DE6B519F48B36939FA42077ED896FC4E5EC5F1C009369C274B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fa2d7fe2a6ad7171317f7c667f25661bc79133e7557e09c927f67466fad05d1c
MD5 720e9ad41ad9ac22f968897f7d231332
SHA1 3882667fbf5f95e772b2d7e9ba3b57a309eb2929
SHA512 ab60d8a59b5f2e85c7ebf76c9d1500285334f2a01febe4b6531d177f0c58918e49bb1b0c5ea01126cd09404c5715003aeb88b7f9f4e0774947222837a8bade15
SSDEEP 192:ziONx61t24/QmiU1PWg8UzX5Obd+j1+FdgX/oxFd+2CLbjQQQqw6U9:ziONx67xQgHzX5od+2d6/Id+2CLwOU9
TLSH
T1F922F6316828AC278DE6B519F48B36939FA42077ED896F84D5EC5F1C009769C274B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 10f2d211f2c68c17ab31e544e53f15130e111bce1b7b66c7b08be736f716ddad
MD5 f75ad06313333d36e3e63f4e615f6130
SHA1 0d7b2856863679c910f86c8c7ce2e564692f8b67
SHA512 37b33f53003a3f3ddc4c62c6720bf4b516d54a2b43c61b21968d3703a280861ee897dc1cc6910ac6f72f34c15443629d247dcdc6a15d317562062a49349f0ab4
SSDEEP 384:z0sNxMzHMvbknzX5od+2d6/Id+2CLcOk31:YTVbOv3lCLcOk31
TLSH
T1EE420831A839AC2389FBB505F48B36939FF450B799856FC4D9EC5F1C00862AC275BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b361be9f74284b899c4bffac883446edf365d9d4084cf121ce8f8a73852bc61a
MD5 842f79bacf31e404ec5b986479f64e3d
SHA1 5c39ad50b13542cc633226de6e91046d484613e7
SHA512 995ff3ddba1b577f74bd05c48dc239796aa2f2402fa5ef6ae08b3eb3c2ad971a250a903aa882c5d7643251a6af55b7690edef6267b658afa6e0980936e3ffff5
SSDEEP 192:ziONx61t24/QmiU1QWQZzX5Obd+j1+FdgX/oxFd+2CLbjQQQqw6U9:ziONx67xXKzX5od+2d6/Id+2CLwOU9
TLSH
T1B522F6316828AC278DE6B519F48B36939FA42077ED896FC4D6EC5F1C009769C274BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8c2805a5f2f3574af540299ce49c88365a494369d823182224e45ba1c53a133b
MD5 4b8fd420aa38caa3874ac5573dd3d723
SHA1 bbc2a52aa112adfec06f1d0e3dcf675ae3683797
SHA512 ef45075e2fe3e0bad5ec58cd3044cfd29a4fb004d5eae2a940769d91f819c9131248e82d6e3ae0d636b1eb75b55c7b0c3a3a248b32e831d7ebe0a00e8c27efa1
SSDEEP 384:nFsNxZzHMPhNzX5od+2d6/Id+2CLcOk31:F0YlOv3lCLcOk31
TLSH
T1EC420731A839AC3389FBB645F44B36939FF450B799856FC4D9ED9B1C00862AC271BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9a5705b7e6322e8f18df554c7cdfd14ddd22495e481c4e9a1cc07a9c44dbe423
MD5 64551c67220af27b4beab39756f6bfb2
SHA1 0fe7eaac822b1c73cff05a7a507825602882b1a6
SHA512 e15e247ed8ea6971f44992f3ba7964e922441df017ef45004aefc25614c1f6cf75fb4c70a1bb051e522f93e1d8ab0edcfb464baa591c823a1bd66c1935ac03ce
SSDEEP 192:zesNxTQolet24LQmiU1PWJgzX5Obd+j1+FdgX/oxFd+2CLQjQQQqw6k35z4:zesNxTHMts6zX5od+2d6/Id+2CLVOk3a
TLSH
T1F942F831A439AC2389FBB545F48B36538FB450B799855FC4D9EC5F1C00962AC275BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da7957b52fd2b05f4384056e2badaf1f3d4c19ea284fb1ab19817a9bb711fcbe
MD5 221ef28d5b35bb784fc5c107663569d3
SHA1 b3baef94e142b46e826cbc3363a40de93ce1bb4f
SHA512 71e96a13c803fc16d37320452ce867da190446326a849789c77c912a7866cf5e21c9fab34771132fc689a1324d2fa592556e4ad0eaa16ac7fba6c2069d84889b
SSDEEP 384:npsNxZzHM2VJzX5od+2d6/Id+2CLcOk31:p0HxOv3lCLcOk31
TLSH
T1A3421831A839AC3389FBB645F44B36939FF450B799856FC4D9EC9B1C00862AC274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 998533b53032da6d475b128d0b03e13b0e2a05863a458e2fa8b1e37f7365fff6
MD5 bea1b2f8fa1fe1b19141fa36ce8639e9
SHA1 83396162395273fd276acbbb4288f6a4e9f92360
SHA512 e1491bd2ee382fd39754c9546a276b1e51fd5bd5c9f9bdc109ebea354ff7e1e77f923603a09e693a897926d11350a05807f75040e9e11cab9bd8a0402d2476cb
SSDEEP 192:ziONx61t24/QmiU1iW+/zX5Obd+j1+FdgX/oxFd+2CLbjQQQqw6U9:ziONx67xJWzX5od+2d6/Id+2CLwOU9
TLSH
T17C22F6316828AC278DE6B519F48B36A39FA42077ED896FC4D5EC5F1C009369C275BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf29951b-f512-4dd5-9ad2-8a038d6905ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf29951b-f512-4dd5-9ad2-8a038d6905ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abbfe2a2-5b18-4083-8d7f-b76a1571c189.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4540_1174591484\abbfe2a2-5b18-4083-8d7f-b76a1571c189.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w8o9jtbk.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0h2va4g\w8o9jtbk.exe
Size 5.4MB
SHA256 800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45
MD5 82fc0353c96e92e365feb73677672ea0
SHA1 0dbaa722e8a4dcb8aac114c6213754f721640fc6
SHA512 0aba4d9f154ef5e3774093af3c18040ed99cdcb091744335379b2056b3c86f3c8cfff8fcb6197ea12df28b23949adc5b7e22ff6d92e293d45a9d7e69fd7d5061
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRQ:OrICteErownP0oTcMsABqlaOz6
TLSH
T1D3463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3220-735-0x000002AFF46F0000-0x000002AFF4A3D000-memory.dmp

Download

memory/5720-900-0x0000023A2A2A0000-0x0000023A2A3B4000-memory.dmp

Download

memory/5924-1022-0x00000298D0BB0000-0x00000298D0BC8000-memory.dmp

Download