b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4

Analysis

max time kernel
7s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
Size 5.4MB
Sample260822-1ephwage49
SHA256 b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4
MD5 3594f87ed84019249f61b56b120343c0
SHA1 ee7dc43fa799dfe9babb42768a0e94b4f99605e4
SHA512 8c086606152115c9dfbc63b0ebdb86b3b6d13bf3293dc4194fdefa2be9e5e4ea40363f93c96d1e666ab37d378352cacb9e732e155aaee76be3a740332dc90b5f
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRi:OrICteErownP0oTcMsABqlaOzM
TLSH
T1FF463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8014
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9068
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9318
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6455
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3268
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7014
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2023
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7161
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2220
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3714
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1944
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2822
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3536
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1306
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1403
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7736
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4642
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6298
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3948
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3798
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4124
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1759
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4659
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9210
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5236
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4773
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5677
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5279
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9785
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8385
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9871
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3339
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2721
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1536
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7013
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6777
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5179
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7094
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9357
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7797
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jxbwjw.exe	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jxbwjw.exe	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jj23d4.exe	rhbiyklz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jj23d4.exe	rhbiyklz.exe

Executes dropped EXE 4 IoCs

pid	Process
4408	rhbiyklz.exe
3584	rhbiyklz.exe
1584	6v1jqqr2.exe
1044	6v1jqqr2.exe

Loads dropped DLL 34 IoCs

pid	Process
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
3584	rhbiyklz.exe
2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe
1044	6v1jqqr2.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\6rd4yyd4\\rhbiyklz.exe"	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\0dcpo8uh\\6v1jqqr2.exe"	rhbiyklz.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2780	ifconfig.me
3193	ifconfig.me
12	ifconfig.me
161	ifconfig.me
489	ifconfig.me
1258	ifconfig.me
1334	ifconfig.me
1619	ifconfig.me
2039	ifconfig.me
3892	ifconfig.me
106	ifconfig.me
343	ifconfig.me
496	ifconfig.me
1454	ifconfig.me
1868	ifconfig.me
2143	ifconfig.me
2152	ifconfig.me
2644	ifconfig.me
194	ifconfig.me
491	ifconfig.me
531	ifconfig.me
541	ifconfig.me
1090	ifconfig.me
1400	ifconfig.me
1655	ifconfig.me
3136	ifconfig.me
74	ifconfig.me
1346	ifconfig.me
1796	ifconfig.me
223	ifconfig.me
305	ifconfig.me
359	ifconfig.me
519	ifconfig.me
600	ifconfig.me
960	ifconfig.me
894	ifconfig.me
1995	ifconfig.me
437	ifconfig.me
528	ifconfig.me
569	ifconfig.me
604	ifconfig.me
1159	ifconfig.me
117	ifconfig.me
460	ifconfig.me
467	ifconfig.me
2236	ifconfig.me
2281	ifconfig.me
222	ifconfig.me
828	ifconfig.me
952	ifconfig.me
1923	ifconfig.me
2101	ifconfig.me
11	ifconfig.me
313	ifconfig.me
730	ifconfig.me
1050	ifconfig.me
1245	ifconfig.me
2303	ifconfig.me
93	ifconfig.me
351	ifconfig.me
1456	ifconfig.me
1559	ifconfig.me
1878	ifconfig.me
215	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
9068	cmd.exe
9472	cmd.exe
984	cmd.exe
7616	cmd.exe
10508	cmd.exe
3212	cmd.exe
4156	cmd.exe
11076	cmd.exe
4120	cmd.exe
1728	cmd.exe
2780	cmd.exe
5516	cmd.exe
6548	cmd.exe
8372	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4868	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2720	4360	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	85
PID 2720 wrote to memory of 4120	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	86
PID 4120 wrote to memory of 1360	4120	cmd.exe	88
PID 4408 wrote to memory of 3584	4408	rhbiyklz.exe	91
PID 3584 wrote to memory of 1728	3584	rhbiyklz.exe	92
PID 2720 wrote to memory of 2100	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	94
PID 1728 wrote to memory of 3836	1728	cmd.exe	95
PID 2720 wrote to memory of 3768	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	96
PID 2100 wrote to memory of 4768	2100	msedge.exe	97
PID 2720 wrote to memory of 4008	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	98
PID 2720 wrote to memory of 2828	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	99
PID 2720 wrote to memory of 4508	2720	b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe	100
PID 2100 wrote to memory of 4644	2100	msedge.exe	101
PID 2100 wrote to memory of 4868	2100	msedge.exe	102
PID 2100 wrote to memory of 4644	2100	msedge.exe	101
PID 2100 wrote to memory of 4644	2100	msedge.exe	101
PID 2100 wrote to memory of 4036	2100	msedge.exe	104
PID 2100 wrote to memory of 4036	2100	msedge.exe	104
PID 2100 wrote to memory of 4880	2100	msedge.exe	106
PID 2100 wrote to memory of 4880	2100	msedge.exe	106
PID 2100 wrote to memory of 4880	2100	msedge.exe	106
PID 2100 wrote to memory of 1744	2100	msedge.exe	105
PID 2100 wrote to memory of 1744	2100	msedge.exe	105
PID 2100 wrote to memory of 1744	2100	msedge.exe	105
PID 2100 wrote to memory of 744	2100	msedge.exe	109
PID 2100 wrote to memory of 744	2100	msedge.exe	109
PID 2100 wrote to memory of 744	2100	msedge.exe	109
PID 2100 wrote to memory of 1920	2100	msedge.exe	108
PID 2100 wrote to memory of 1920	2100	msedge.exe	108
PID 2100 wrote to memory of 1920	2100	msedge.exe	108
PID 2100 wrote to memory of 4504	2100	msedge.exe	110
PID 2100 wrote to memory of 4504	2100	msedge.exe	110
PID 2100 wrote to memory of 4504	2100	msedge.exe	110
PID 2100 wrote to memory of 1252	2100	msedge.exe	111
PID 2100 wrote to memory of 1252	2100	msedge.exe	111
PID 2100 wrote to memory of 1252	2100	msedge.exe	111
PID 2100 wrote to memory of 436	2100	msedge.exe	112
PID 2100 wrote to memory of 436	2100	msedge.exe	112
PID 2100 wrote to memory of 436	2100	msedge.exe	112
PID 2100 wrote to memory of 3408	2100	msedge.exe	113
PID 2100 wrote to memory of 3408	2100	msedge.exe	113
PID 2100 wrote to memory of 3408	2100	msedge.exe	113
PID 3584 wrote to memory of 1012	3584	rhbiyklz.exe	114
PID 2100 wrote to memory of 4712	2100	msedge.exe	115
PID 2100 wrote to memory of 4712	2100	msedge.exe	115
PID 2100 wrote to memory of 4712	2100	msedge.exe	115
PID 2100 wrote to memory of 5016	2100	msedge.exe	116
PID 2100 wrote to memory of 5016	2100	msedge.exe	116
PID 2100 wrote to memory of 1916	2100	msedge.exe	119
PID 2100 wrote to memory of 1916	2100	msedge.exe	119
PID 2100 wrote to memory of 640	2100	msedge.exe	120
PID 2100 wrote to memory of 640	2100	msedge.exe	120
PID 2100 wrote to memory of 640	2100	msedge.exe	120
PID 1584 wrote to memory of 1044	1584	6v1jqqr2.exe	121
PID 3584 wrote to memory of 1892	3584	rhbiyklz.exe	137
PID 2100 wrote to memory of 2104	2100	msedge.exe	124
PID 2100 wrote to memory of 2104	2100	msedge.exe	124
PID 2100 wrote to memory of 2104	2100	msedge.exe	124

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
9464	attrib.exe
11076	attrib.exe
3836	attrib.exe
4572	attrib.exe
10220	attrib.exe
10812	attrib.exe
11092	attrib.exe
11236	attrib.exe
1360	attrib.exe
1476	attrib.exe
6336	attrib.exe
6760	attrib.exe
7720	attrib.exe
8700	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
"C:\Users\Admin\AppData\Local\Temp\b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe
  "C:\Users\Admin\AppData\Local\Temp\b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe"
      4⤵
      Views/modifies file attributes
      PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x328,0x7ffa3698c188,0x7ffa3698c194,0x7ffa3698c1a0
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,14595634027132998224,16215288513455060009,262144 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,3074194948236082529,14849067191751949106,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
      4⤵
      System Time Discovery
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,4858533640939424260,672262495812660218,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12274586598371929290,8775836208507380712,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,16291342963660249953,5821802128649767063,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,5748450854994082507,13929538861471160791,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,978406337890924275,3924677002150633759,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
      4⤵
      PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4332,i,17423648870334856486,1431541807472040300,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4896,i,15179900969394407709,9617875319691287661,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5028,i,15182305215160548023,17141599145474882269,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5204,i,1516781892479011233,8045050334634488617,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5720,i,1509123575451205403,8228882113439013938,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16769157358154252551,10207636347360069857,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,7781831569927716856,10892431004746784987,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6216,i,2839272166739842369,18336416994471352419,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6440,i,11232871874630936874,15624783384851742979,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6624,i,15013199434086851266,7702010846582259168,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6588,i,4582247905976979632,18066641649202898024,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6788,i,17028870571066443499,3968637807649767215,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,6622528184277350351,15784764471273684614,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:8
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,2988899191683038269,2600846365811521265,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7552,i,1152174865254218266,9445934288174295520,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5624,i,2822162135626483151,8204478494980238605,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7844,i,11907167776673291005,13358622754942448160,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7884,i,15875119460185909807,1887520256291376040,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5668,i,9768477941168739338,9680312634596035203,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8296,i,28385556078012973,14809242438470824509,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8180,i,6797720110867219112,12667331620680553565,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4332,i,8463618031291456049,104646618879022363,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8752,i,11557315492150371868,6486407229535375918,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8964,i,10336218162538971789,2948709121086809064,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9092,i,923509448045182513,8257643873827977758,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8652,i,429771564856441494,13803869748271940826,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9296 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9452,i,6540862380061219822,17016650575172107342,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9672,i,3127904845134205845,3335685415726443798,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9964,i,18273862136539854766,4959921934128534725,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:1
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10116,i,16389628651740046961,12201281584896507088,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10284,i,18286990863123302321,13876751571664595678,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10308 /prefetch:1
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10488,i,6517582174653779719,5159006888865967135,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=9992 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10632,i,16112265155794812682,7473463878707822132,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:1
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10824,i,15053654779824583407,4218780910806178733,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10768 /prefetch:1
      4⤵
      PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10976,i,13470563978354080250,13307771077511008224,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10948 /prefetch:1
      4⤵
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11140,i,8666583891389343579,16978281480532208683,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10852 /prefetch:1
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5852,i,120982463265750984,757405100299164748,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11480,i,10078857063392241217,1329965064403956027,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11496,i,8947728726262848395,3949668167010850035,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11644,i,8566675959876035345,5729426622771731576,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=11648 /prefetch:1
      4⤵
      PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11828,i,10663689947370173990,1546114379527378657,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=11796 /prefetch:1
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11940,i,15484364971704805767,11466173399874847644,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=11948 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=12108,i,6963868370258717288,957437435766873769,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=12124 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12264,i,3946561565400262298,18200901656080960586,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=12280 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12464,i,7365173695996316446,2928566905127877845,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=11932 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8656,i,8912543822550394249,14963790473118718102,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12448,i,17265281786455209043,17686868930213416139,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=8992 /prefetch:1
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12772,i,9876346168104344669,8949071198366547369,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=12888 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9592,i,12130475585265364084,9638328565313989225,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=13064 /prefetch:1
      4⤵
      PID:7696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10112,i,15095336734142536371,9470064452531296871,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=13076 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13280,i,1362278863668334947,7879458641441135453,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:8
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13280,i,1362278863668334947,7879458641441135453,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:8
      4⤵
      PID:7904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13364,i,11057828072511437056,560959096452369687,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:1
      4⤵
      PID:7928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13684,i,17126628170411077669,12740019095448418992,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=13660 /prefetch:1
      4⤵
      PID:7604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6016,i,16931718705617705647,15350999459166687578,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13876,i,2266425884922195529,8261948281904548301,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=13924,i,15285959048707759804,2950916292396014754,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:8352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14012,i,18239991419460281124,6585741485691387798,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=14024 /prefetch:1
      4⤵
      PID:8456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14236,i,16643951538798159483,526206958508323513,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=14244 /prefetch:1
      4⤵
      PID:8528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=14268,i,16177214645087079182,5698603728849908397,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=14224 /prefetch:1
      4⤵
      PID:8564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=13780,i,15736331819109937359,15324710258779532098,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=14900 /prefetch:1
      4⤵
      PID:8824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15060,i,3506897957596742577,13777592233220728657,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15068 /prefetch:1
      4⤵
      PID:8864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=15112,i,9000476641530829020,17654334478230922020,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15224 /prefetch:1
      4⤵
      PID:9020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=15356,i,196100792248470666,7175436429901807095,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15352 /prefetch:1
      4⤵
      PID:9128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=15548,i,14959623433704620312,14615399458261120388,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15552 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14496,i,3613767882500509948,17110952324953880151,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=14520 /prefetch:1
      4⤵
      PID:8360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=15820,i,3624025868571168067,9530378802946016341,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15844 /prefetch:1
      4⤵
      PID:8700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=15368,i,12825327213498675153,9822170770584040986,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=15356 /prefetch:1
      4⤵
      PID:8408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=16548,i,13401171408398875972,10741299648964613509,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=16556 /prefetch:1
      4⤵
      PID:8204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16680,i,12677916068830450557,2423357907861942245,524288 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=16728 /prefetch:8
      4⤵
      PID:9532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=16848,i,11532279794053827753,1915897163506853804,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=16876 /prefetch:1
      4⤵
      PID:9688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=17028,i,3823337911140094299,8088659532445759534,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17012 /prefetch:1
      4⤵
      PID:9808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=17164,i,6378672356947629437,3472258906278087304,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17208 /prefetch:1
      4⤵
      PID:9912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=17360,i,14000516723309369293,9325834731093516232,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17392 /prefetch:1
      4⤵
      PID:10024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=17532,i,14462826338478746987,10506978327190555346,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17552 /prefetch:1
      4⤵
      PID:10064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=17368,i,6975742008748593840,7601307512729430547,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17732 /prefetch:1
      4⤵
      PID:10184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=17848,i,3115960555873449728,5706010920490837841,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17852 /prefetch:1
      4⤵
      PID:10232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=17200,i,3702578546256894854,10468681755183967135,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=17868 /prefetch:1
      4⤵
      PID:9264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=18260,i,8270214151225053244,12785283103901868587,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18280 /prefetch:1
      4⤵
      PID:9664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=18312,i,252613153780787799,16884702453571067770,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18392 /prefetch:1
      4⤵
      PID:9876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=18576,i,10984361401126660347,2784117385602291675,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18524 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=18720,i,6627350205790446274,10951273957237854617,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18756 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=18888,i,18424369481388648165,5534710332061455257,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18900 /prefetch:1
      4⤵
      PID:9548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=19052,i,17052945926705505936,11366937262546643586,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=19084 /prefetch:1
      4⤵
      PID:9908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=5116,i,8544997753853340155,8571862946291898675,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=18580,i,9790965576238122659,10820590938829836012,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=18436 /prefetch:1
      4⤵
      PID:10516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=19496,i,15730268478215718222,8341982246816064691,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=19504 /prefetch:1
      4⤵
      PID:11056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=19624,i,2092949402955992910,1817127474496714435,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=19664 /prefetch:1
      4⤵
      PID:11192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=19824,i,2734804092581233480,8657101483207494284,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=19856 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=20020,i,1433387957742657034,10888297821926205765,2097152 --field-trial-handle=2260,i,17511319337606527702,7296942948320603986,262144 --variations-seed-version --mojo-platform-channel-handle=19972 /prefetch:1
      4⤵
      PID:10620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4508

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe"
      4⤵
      Views/modifies file attributes
      PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3264

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0dcpo8uh\6v1jqqr2.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe"
      4⤵
      Views/modifies file attributes
      PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6116

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe
1⤵
PID:5932
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ddka8oh\aqofkyh5.exe
  2⤵
  PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe"
      4⤵
      Views/modifies file attributes
      PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6096

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe
1⤵
PID:5364
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7riutzk2\2vrflmxt.exe
  2⤵
  PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe"
      4⤵
      Views/modifies file attributes
      PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7012

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe
1⤵
PID:7160
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\upkf9397\pxblyowa.exe
  2⤵
  PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6548
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe"
      4⤵
      Views/modifies file attributes
      PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6604

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe
1⤵
PID:7376
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4x2wlgw\xnj17s7l.exe
  2⤵
  PID:7508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7616
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe"
      4⤵
      Views/modifies file attributes
      PID:7720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8536

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe
1⤵
PID:7720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kuuscx54\m2zburmw.exe
  2⤵
  PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8372
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe"
      4⤵
      Views/modifies file attributes
      PID:8700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8584

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe
1⤵
PID:8968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiyt40eq\vq9gb8jm.exe
  2⤵
  PID:8208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe"
      4⤵
      Views/modifies file attributes
      PID:9464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10176

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe
1⤵
PID:9296
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1eriwxii\ugufwc0t.exe
  2⤵
  PID:9392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe"
      4⤵
      Views/modifies file attributes
      PID:10220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3432

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe
1⤵
PID:10396
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o55sgh63\i98a9z38.exe
  2⤵
  PID:10480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe"
      4⤵
      Views/modifies file attributes
      PID:10812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10696

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe
1⤵
PID:10840
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iuosjus\5fyb6tw3.exe
  2⤵
  PID:10956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe"
      4⤵
      Views/modifies file attributes
      PID:11076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5060

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe
1⤵
PID:10604
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\90frvtac\oi6wecmx.exe
  2⤵
  PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe"
      4⤵
      Views/modifies file attributes
      PID:11092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10988

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe
1⤵
PID:10740
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s5cina2y\51dveknr.exe
  2⤵
  PID:11172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81qsw5ty\wa10qu63.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11076
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81qsw5ty\wa10qu63.exe"
      4⤵
      Views/modifies file attributes
      PID:11236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11708

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 281KB
SHA256 38fc7a53fe5553b741b4eb08b3480d57adb1912eaac73ab7bb4b8b8c85af966d
MD5 c61a4457f8f071fc497e0aaed382d416
SHA1 8f30af17fd2495cfa617c9c5c058d5565de96f0c
SHA512 a1a1dee4dd96debbafdfbd19761aa8e922d6463c07882e78ce5dce3474b8a582a5ff7f0fab328b035c2de02445429e4e8f595710f4c3992b167621c8e14ef2bb
SSDEEP 6144:8PXR9dhPGJWp7xIrQCumRSUM837ZGZrKavj5hL:EbeJWRivrM83yXL
TLSH
T15A5422DDCC0401059ABE00589D9ED509DE2DF2BAFBCA29D7B0896B6E87016F317B3748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 37KB
SHA256 6e5cb713bd8e426c8c4bcbaeb68f921842c968eb78a569f8e13e301ce714c1a8
MD5 95d8e2c6f815501936ab45e4ce733f8f
SHA1 e1cfd1bdd30e7765d9781a72be2e9920ceb9405c
SHA512 03d82fa7d5294c93052bb2cf13d044ac66a729ca669da3c8fbbe9ae06aa54243f3ef588060793ea8d64b9a5ef39ac3117b2e30a4daa9ab566cd7cd636ff4116c
SSDEEP 768:naaeCsPsgjJIl2s83klYHNmySEC1FzR901HoptNK9uljFv+jCIevJgKu:n7msgGD83mYYRWIptNKsjFv+jCIevJzu
TLSH
T15D03F15E7254F018964B0532C41F8B8D5528FE84BBDE043E2C4972E6ED96DFD8A86C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 100KB
SHA256 a165e5ef1939c256b2ca8f2cdd5b3d2ffee5f25f9a4d81ad8529cd6ae219942b
MD5 b332202de15e3ef140ec56c4323123dc
SHA1 a540aa405d3368628179b903309168a3c767d187
SHA512 a4bfadb5a2e728c3ae08f2ac161d18aeb612a02bd1d682968af7204e8bc62a480fce7f61e00bd361eefaa7d149ce181f4a9ddb3e2e738b3db0a3c86fa2868187
SSDEEP 3072:PB2dojqhL7dTSCve1KV5o770t/NmY3HbF+UmjBi:cd4G4ce1uaS/ItPli
TLSH
T1FCA312448884CF1CEBE0D3809F1610A43D3E61B46ED36A9E16277ACFF0466D69BA43D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 204KB
SHA256 fe430c6d63b02c7f262b8c47abf6367f229f0e7cbf1941c7287a8ef89b404562
MD5 461f60671c92135b4dd4163ef782097a
SHA1 63ea35fd3ec3fff026529281f4193fb3208d4afc
SHA512 36e867e82fec1817aa05c3e89aefddaf7a620e711c98031d9f89c137a00f3c1f126599cc56b6caecfb613c88a0fbdee720f38d6000974b8fcec664b85d08dab1
SSDEEP 6144:Oj8NBNT44jE6ZCWsesNXXPSWnBYZqS0pVyWp:OANB544/JWvSHv02C
TLSH
T1B82413368125862BC1D4EFFC04D8A57837FBCD5B750252D6A7B192FA102F3C66A32D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 219KB
SHA256 38099a60ec09576e1831e11a065c1f6a53cc7a1da92ebe772769df4501a2ca42
MD5 dcf251d67b6af1709572c2c4fb77fb55
SHA1 9ae867d4ceff4df4af6ff958601752e3986e7c46
SHA512 0c1bdff76abcea9f73dc3b19c0353b64a134f5b710412613a74232ed99268ff4b2a696ec7d52d6f4383e7b180a6861fcb68cd9abc6859e6e29d9b9efcfdb719e
SSDEEP 3072:Lbzi/rNmHnBtA4Xb7fgyWuF08Pz3gywjM5OBZ5H3Lb8ABAs+iJ6b34:/zi/Bk1bgoxbgywjM5O5X0AB/+i6o
TLSH
T1412422E1821223BFD258433B8BA0BCD7673B18B5C7E7AF908B89D94FD61938114571C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 93KB
SHA256 1fb85147bc3e20d7d904479bf80268297b9a8e6d83703f159669d4106c739e49
MD5 857b205879311ee9b174d600919f98d3
SHA1 786293fca88655f2dc03ba7278d34c3c9a3f2baf
SHA512 bc3a26297a04d06bf8a656886981f8d6bf0c79743ae091b0065e90a6402ac2bc853ee67e5951004ca173606922c682b28b4cfada8ebcd54e86d521513003f312
SSDEEP 1536:IGzW3idsmMUowl8CcBS3L5OHp2fwiTqxUigO627QngblC+aQ0E5l5SpX1svcuxLF:IKMidjMTpPB0bXqxVgUG+lzP3MJ6WrY
TLSH
T188930268F1A5149B444A32F116F62459EF11AB91F241FE8C2C6BB8F0EA764D31DF78B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 43KB
SHA256 6e99b810ad4dcbaf34328873b99a6cbe465c7cb3fb324711d026e066edfe0496
MD5 1445302f1b96e71a00517027b95d3788
SHA1 87be7bb86e7474dbacbdec3cb680f43e16fa75c1
SHA512 c1d995df45f3601f7eff11c7436e5218bcdeb08e2a2da0f2776db6e0affb54e2c9a8e2424d42baea748c84d60ebb55fa7b4f99138d0d511f560934b4d306f277
SSDEEP 768:IBKXDmVlq2aQmGAvzE6OI15Um0DvfwA8qwJklj4UT9tQ/SZYKh9:IB6DmVlpaQm9vzE6fKvjCqYKj4G9tQOh
TLSH
T10A13F2D7D18CC8FCA62D01B9EA15FB847F17211BDD99CB1615B0FAB9648BA62310F5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 160KB
SHA256 be5a967d51ac263ccdb691505da56e748126920bec3283681318ae6e69897da9
MD5 dbdda61077e6fea442136d6fe60ed5d2
SHA1 301edef721032a4dd9b0a9be7c321e905f43beee
SHA512 cbaadc00a251033bf8d66e19a3f3e0da9ab5e6608bfd0c8ff9c1205901a41326f61250e77d7f0aa81435e10387986524833d27a6b3e7633fc152ce023673570d
SSDEEP 3072:y4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrWNoho5xtSfrIt1xJ9zLLoewpp2:yg6JDk3ZgtDn2po5xtSfrIBJ9zfZIoVL
TLSH
T190F31361E94C67DC53B8FDF20B2B2B149E69D0F846E0403865D3A5DCB8B44DA93ADD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 67KB
SHA256 aeae0da73139a235146c7e1a5605a969b0bed0743c2c06a272ee818329f48cc6
MD5 1a3e207eb153670f2c2385982d8a51e8
SHA1 d3b43669f9a94159bd9b8bb3a84efb6f6a02443c
SHA512 9cf1048da74f382aa5e40c4ea9cc2e6db854603745820687bde686b8d0e4dff59620a48f4f8d4a7d7dc664b0ab9e35e0691af306f238601ec3220c9ffcbff33b
SSDEEP 1536:yWor/EUuvPCdgVVidBZm9sxZUezwC77Tl:sr/EUuvRoSsx3MC77Tl
TLSH
T1CC6302A501357053D84F5ABECAC71B5E0CCD9975B0A9C6CBA59D29A33C3887874EABC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 105KB
SHA256 ceac3b0378fdb764f9e846c863701cb2f885c0e90aa7d5fcdaaba43e02e82e7a
MD5 58df8a94a629faef8722cdebb1b41967
SHA1 8a680ec10d596630e92dc1fbca20a7e84d7c3816
SHA512 57041c596317d5b657b9a24c461e8161c2cf4f2e04037a77e0d44ca0e8f7ced9d9897f72518619f84af02e7b2e620bcea4a101c51f07c36495d1d159c94fa6f4
SSDEEP 3072:WLBT9FH0lj+H8Wth2rbV83O5tYF8gqwRWU75Jw:WL9DJcwho881eLw
TLSH
T1A2B312A440C0B5B3BE65D9F1985FB01934EB730DEAEF91C626D4217B981083F3D4AE24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 21KB
SHA256 d87ee0accef9bf0955a0e85e7e458b19c2bcab2b0ad53f350d3d2b3b6f740f99
MD5 dade4f80440fada5643fbb9b1d5336cf
SHA1 fd6dc9e3ff445614f6627cfbf5418677e8d866f7
SHA512 9fe25a4981983059989e094370016a6b87700eab8feaeb0a6453a8f12bb5a32fa5b00809db98008bc2a7365db6287c786d19ad533c7ad7dc9fe9ab0eb8501b4a
SSDEEP 384:9iRzNDSyRnxox0WG8AC/qxc4ktq4JydBD0HKkW4hFbNW57tG0YO0IGRdtP99WzG8:9SRZnxU095xcZ4nWHKklVY5ZGbO9gTA
TLSH
T1C0A2E1A2F94FF5817E4A90322483C8F44CE5658A9F85ACDD8695CC81E11FA927BCD7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 92KB
SHA256 de8b043363106f77b0fb50cdc5c8b511736374767fb5e73746805556d246dca7
MD5 e3d1554c1148a311d92570741ad0d4b8
SHA1 9e690e1f8aadb69779f9b65db3c41565717b3e58
SHA512 dfe81aef983097e55bcc31322625120bc75aed0fa7f2bb78e09758eed3ad4ddfc992b10d072ca3df0ac410989178b8a48d467bd88e1f6a35640d9e21e4ddf6f3
SSDEEP 1536:ArB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwtkvLHC02U:M+dCdU1UKok0HaFA9wRw0YuoqsmGeqDe
TLSH
T1DE9302BDD72DBB4C403A9728678C91E704FB06FCE514D7860B98D3C6A13941B58764A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 20KB
SHA256 a7bd1795e8eb400156283bc7398894ef8d3ab9fc305022961fda0ee89e6487cd
MD5 0be2fb62bb46f54419d26b4aae9b1f70
SHA1 a016a084834212e02b7e22d680270b3950fe4eff
SHA512 178872f6c7977b9d48ec14ff925e58f22660c0865503f56af63f834a78f5774ec63c9ecd4a8bd9f1b8e0b47ef62289fa0f6e119bfe720e0eefe0b52c695d68be
SSDEEP 384:AaOmH6Erde3AT39qM9khYkQ6HlcMXrGAUAPvKjw+6ONILcsAXTAfr7Gt1YWq0E:ZOJz3AT9FkekQMCAUXcXdcszx
TLSH
T18892D07F514A7893C2F2CB52C8F257C42645F19B3EB41E134F0F246D99F64664C5543A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155c9e653a65a409_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\155c9e653a65a409_0
Size 196B
SHA256 7cd6cdd4eba39ea7d4798e05b6e32cdb7ffa8fa5f0fd0785745ec2bcc9c5a17b
MD5 212a3755862f4b8e867243d00f47381d
SHA1 12651ef468e1bccf5ab663d33257394512cd1e34
SHA512 4f0c5c9a3725668ea71200b66f56f4faaa7033b8e7e6f420f153ca84ccf22338a8b9a7bb6f8817399fd2f89d446c01a4db0d4cd4807dbc7d9def17c295a479ea
TLSH
T131D0C06BD21C0801C11DC1F1C00F709C93737050295DC32284C190F3EF00AB0B00380A
MD5 SHA1 SHA512 TLSH

Submit Download

1fbf88f9ee717c81_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1fbf88f9ee717c81_0
Size 485KB
SHA256 fe0d6efdd6d3044a1df874e65ba500339ddb658236108afa26b472ece0cd75d5
MD5 e4080ec4fa316b2b78bffba8c933e787
SHA1 a3688b3328de56c1d5e545149bbc0f4f2480df9c
SHA512 953c25876214cefacdda4192038363f69eab7d101e2fa0148c7f293fc99fb721adf7bf9c8ef645330cc792870d9f7d5ef2daedd2502503279d5885f946aaed8f
SSDEEP 6144:mV6FsaOYGu4u43/pXLxxTV9PkJNHdTr2Pv7vOuu1xEsV2kQ7ZWN:mV6FpOYmLmF1aPvTse7Zm
TLSH
T106B4A4495790F9A5CB7623F445A2C953A73144882EC3E72371F8F7392C4A2E55F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4208ab622bcea0a0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4208ab622bcea0a0_0
Size 288KB
SHA256 2095887f6a9f7531a43186e7faf411a79a643ba0f94481877213808f25d3e51d
MD5 5dff63f11da111ccef239e84a7688bef
SHA1 4733fe06c07d8b86f303c0dbadfc799b6113e7f2
SHA512 95bd00108dcbdc613f9dcf3e9357a3c171e9fab199e92b87b2c9169b92e7d1b9f7ae033aa3faa48b380786e78d6c535d95a5cf450433d005a12650dd7c2847fe
SSDEEP 6144:8WQYcFEkiFSEN7bzkFViVvjfqXOSVTyaf2p:pcaXFxFgFViVvj8Xf
TLSH
T15054C7591B90DE25CE3663F542A2C953A73594483FD7E71331E4A33A3C1A2E25F4A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ddab8225c42b7ce_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7ddab8225c42b7ce_0
Size 283B
SHA256 0be2ef1f7314970a62f8256e3f9934e1deeb4fd5be914057565924027bc2799e
MD5 dbd04e234c3a67e9c763ede685afaa54
SHA1 ccf3ba74d61e698a169e419f2206ce7456286f93
SHA512 b0c019013326ece83215dac9ba80ec9dcf1902d0c860468d06a7f93eea087538ac870b04570ebdb08cbc34367a1b41cdb091a1a1706cdaca8746dc8af5907dbf
TLSH
T101D02B5E141C8138E41EF9F0D3EDB346C223C05844EDE6D08026556173E20B4E25C213
MD5 SHA1 SHA512 TLSH

Submit Download

a8a630c2eefb539b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8a630c2eefb539b_0
Size 270B
SHA256 9fd1f7dc3850b0dc7e5b3b00f339484b0d6d0359aec0d95b66464020ba5a8b94
MD5 1d80cb98c9948719ddb1660b49ad4e68
SHA1 ec04a7cac23d7002d2b859768db81ca428e43292
SHA512 1c328f4e45e24139a2a75633dc184f993cafb9e5f581f45318ad62f3f5920b4745dfc3fc06c364564a8ea468ef9865190e6f6fd9c35914b04c6efffb0f606a89
TLSH
T114D02B6B1438A424D6189AF887BEB20584A3C5781D4B50D1410D45B5A542836E5DC715
MD5 SHA1 SHA512 TLSH

Submit Download

ce0df90b75c5c389_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce0df90b75c5c389_0
Size 309B
SHA256 d3b0ecd07ab4fbc1c78f0fd6d29d718b356c1ce2f6bc1b775bce6572b550cff9
MD5 e3dbe2694d298f6ed56ff7e9c03e5034
SHA1 f9ad5aef5a3e932418df533a1c05311599bec9bd
SHA512 48e7ce5531aca26e9aa40adc384d0c89fd408dd885300cb22b733ef6bbc9001b81a41038b9166db6b5d08304381b97f00177a5d043926679965480059b8237a4
TLSH
T10AE0E703FD55010ACD95CCF0F66F69C55F74125DACACC7930040C35F494553575C8272
MD5 SHA1 SHA512 TLSH

Submit Download

e93c99eafdcdc8e6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e93c99eafdcdc8e6_0
Size 602B
SHA256 a649623ad0f0aa82178a1bfda5531f327ded1f935fb10dd354817f6f7f9b889b
MD5 14a2f823c0639f4ce8f35b59eb2bee73
SHA1 b2f6fbc503b3104aadcf5f216eb4edfe11bc71c3
SHA512 58236d57107b304a5a6c1a5ae7128057c95970e1a5ee8e061da0883467f5f7d008757272967a48e64c0d17bb3a3370f7d59f692b6f9692492b57aa9634abec73
TLSH
T1B4F047D35108B55AEA3D0F71DBD4E159475194964FAF8095C01520F333474396D08088
MD5 SHA1 SHA512 TLSH

Submit Download

ede3b93476a2c020_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ede3b93476a2c020_0
Size 584KB
SHA256 0373a17276fec254f274e351f4396fd967bf50e77608e7606d934947b877af82
MD5 3b61f0a67ac4646b418f9c0dd332ae78
SHA1 2a3dcf5e91b7a9afc8fee4c254404194d12a7edb
SHA512 d7048795939267de62eaba419c2f846ca88fbfd168ef882e76795ea714d39c3d69b3416ffa83f8fab3525e4149c5d2fcff9a42e1606a3b3e8764ebfd75854480
SSDEEP 6144:aYx5pa1vm1jw3xJmJS7RkZ4WPswQyrRY+Kn4L92zhViWQun2blf:Ppah13WHZ4WPf7Y+Kq2zhwOnglf
TLSH
T1BED4F8445790EA59CF7623F401A3C913A73581482EC7E727A1E5B7363C892E25E9BC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1dc00a660895e019a90fd90abb6f8495f5dc238390dccdcdd2f96d8c80d6d226
MD5 28d4a67e7cba7020a0c7781aeaeae5ab
SHA1 5deb8d89b372d6e40f5b73567f048b729e8d3d0b
SHA512 ec452c9cb6633146939879547645c4641984616aadba40bfaf4266e9260489058dc1cf38d1e2ff1b9b148b7a6e5a35b0fb588f9f10a4a2df3b399cb926df6277
SSDEEP 192:sxZYRAyM/jK1Ml8Mj7/fSsZqvxlEdpL0UY4FC/W6+WNiTUrB3sdWdx3sZYBGkGmR:sxZYC77/fSsZq5OJibbr2emZzO
TLSH
T1AB52E952B63859778DDBD219F911BF27D7F54462A1900E489AFCDE1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1c3aa3e4ea5e31e0160afa77121a6b9ba84cc8d045f591bf434ea6b9788a63a4
MD5 0d6ca907699535a94619e8e3efb44ba7
SHA1 9ca2651ead67d098e9c424d19fee7cffd7dad9fc
SHA512 f7d154d6448a2a84d83885a0fa33edef7f57b0b6d502322eea5914a7a4ff3702e52b2c6a8a905b03ddb0508cb5e73bfd4c67123d4cd672231cd4748f5699e31c
SSDEEP 192:sxZYRAyM/jK1Ml8Mj7/fSsSqvDmEdpLg3oEFC/W6+WNzM2lJfdreuzumJ2UrbYBb:sxZYq77/fSsSqL5sibbr3zrbsr
TLSH
T13562D756A63819B78CEBE219F501BB57D3F55462D1D00E48AEFC9E1C00E6BED2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e877782ad64b4ce8b4b4466b06f4553cb692a976471626e9a20f89d1bea7c0a4
MD5 b61cc1dc7a1088630ef16427dec30625
SHA1 461953c22ffc95eb99caacfdd2e822a4761f2687
SHA512 945097f75bbf4600632e8502a1f3ad13b215e98e67b783cf7a2de813ea8023faa8a6b4902519919aacf87d9593823cb0c1845f8f31da4b6d53c49f422e59697f
SSDEEP 768:JEUZYGMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoeLlPZ4R2roVb0J:JEUZYGMWvg0Pou1jaHeLZmRNaJ
TLSH
T1F4E20A3F280CCB7E4F844E9DEC2A6F967ED801CB5A584D5447EA894C02CB2EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c96718ed57af41758279c655221e40baa36c40b4c79aa412dca0027f27c6cd91
MD5 eba148725788e6e05d6659c9864287a8
SHA1 935f59953defab1aed6c80fb3f0c09373e154765
SHA512 1a0994b9053bf4c3b0c6c0530fdc8c59c9d3b92e96ef8cf3cf095a07af783512f932c0e7425c6c3e363d81c5ed0776d641545ffe6d8359b8156fdcdc02a9aa1f
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU08:ES3D2rZZ
TLSH
T1B8D1130232BB02033C3D6918A2AA97764F45F1E33454E82B7BA854B64E66E741CFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5af468ecd7fb20556f7894f5f4bc392d4cc9515e978bf1c2df75b490c0210dcc
MD5 fbc82c461a2c27d822c5961506a5cec8
SHA1 ce8b6a4b90e16124a516dea5ec38b5e6f2bd7a01
SHA512 8b6992001c51f9418acb93ccca98cfe0c0f9f9494eba84e0db50b76093dfe0dbad8086b0e755ff9cc6c01e4b265648e0d4ae0190d902b13cea9ea5d1db529f4a
SSDEEP 192:yON061VWQmiUyOXgGX5Obd+jKOImm/a13GFU6:yON06WvgGX5od+2OTAFU6
TLSH
T1E502D73579286C678EB2BE49F58737135FA8206BEA546F84D6E81B1C01D769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3789b1332cc43c0fcc11547d805ed43ec23c7f1843b5e78e37c23fcf95cdc5a
MD5 3864ac1c6d76971257f337b6b3b50f57
SHA1 782ba9f0fe69fce7cac6954e8f49e2e722753fcc
SHA512 37141209e9b12e12b7414c4ed06d6453eaacd83c5e76ecc3501ba25a641ae229c917dfe3c8d7c84dafeccbe52b72d9a10a314dddfbc9895a42953aa38f0899e9
SSDEEP 192:qONY61XWQmiUygXrGX5Obd+jKOImy9TjJpqwaU6:qONY6gfrGX5od+2OU9h0U6
TLSH
T11A12F871B929AC635DE2B548F48737939FA820B7DD40AFC4D5D82B2C00D669C370BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 01c053742ad606123221d8afd0e0a1442a77c82f11873b8acb0807386aca3423
MD5 b3c15a5331e5d44ad898a6cb605376fd
SHA1 38f926ce172e23e6eace9a01bd83363abafadbb8
SHA512 145d238e43cef06c49838fba5ff935f783af7ba2be731433247e867715e3f1abd6fe91d608183bab2bbf25e5012bb2a85cb70f0488d0ab6ced5e395ed8fbc8c0
SSDEEP 192:zjsN14lQHG6tUD7oQmiU1DzDgzX5Obd+jKOImy9z+jQpqwaLqy3:zjsN14lZAMIlszX5od+2OU9zD0X3
TLSH
T1FE422A72BC69AC3349E7B119F54B3B639FA860B7D9806FC4D5D86B1C00D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0308d906a5e33c8690093d224ce1251ce15f71529867d7c88031863cad2946ed
MD5 5db7a3e54d7db9d7f0d7284fd5fd79b3
SHA1 d3d276ba73114a132c27e3567741334227adf1c7
SHA512 8792ea6e3de66e052fb95be8d9bb7c33990e2315157b5acbc8c8b9c7a2baa0ec6f882e9f88fafe817c8077e74937445490efb8feab1e85de42f8c056141192ea
SSDEEP 192:zdsN14lQHG6tUD7oQmiU12zUrzX5Obd+jKOImy9z+jQpqwaLqy3:zdsN14lZAMI8gzX5od+2OU9zD0X3
TLSH
T1A4422A71BC69AC3349E7B119F44B3B639FA860B7D9806FC4D5D86B1C00C629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6b3970c3df394e7ddbb063e56b4634b394bf2e51fab1c0ae40c33a4e54f9e245
MD5 239ececcc5e74da0d0f42fbcbaf808f6
SHA1 cd699518e71a760cf1aceaaa001ad6763986508e
SHA512 448343d39e7dd5aa487be213fbb3a67ba47e9c363233d8579233ca31f426a5e6de04d701eec8b95ad08126ac393422445910448a18452fe1e01c8ef608eb76e3
SSDEEP 192:zdsN1GlQHG6tUDeQmiU1tz9OzX5Obd+jKOImy9z+jQpqwaLqyG:zdsN1GlZAzTAzX5od+2OU9zD0XG
TLSH
T116422971BC69AC3359E7B109F44B3B639FA860B7D9806FC4D5D86B2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1484b730791643e9d18a8b6370bdf441784b7f329222e0d9ac548791ee3ba42b
MD5 f5e2c65dbd8489f9e756688c5018c2a2
SHA1 0d25c7c58f596705f7974ffe09a16197ba954ad5
SHA512 e2e91c3066d48657cf26ec1d3823c4e8061e5e2199c5fc8a7e12ccfe530b0652c0a7fad16e7943746a2f045a54fb215d2b7cacedbeb95398b92b803b1632accc
SSDEEP 192:zdsN1lQHG6tUDeQmiU1YzexzX5Obd+jKOImy9z+jQpqwaLqyG:zdsN1lZAzKszX5od+2OU9zD0XG
TLSH
T15A421975BC29AC3359E7B109F44B3B539FA860B7D9806FC4D5D86B2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 53052def8a91d23bcae1a0b5bc420915d7be95b2f34372df24a5d2b66246245e
MD5 93467be524c84fa4df8370e7c78afc77
SHA1 3fcc9465a5be6171de2279a82f1f8a4c8e66f8b5
SHA512 fdfe84bdf393d33dd6b24fa67c17df6cf9780e2577f9e97429091779ba7aff400843b32daaab6bd057c61971df298b4920d4b092c686ef8980395d191cac01d6
SSDEEP 192:zdsN1jQHG6tUDbQmiU1jzT2zX5Obd+jKOImy9z+jQpqwaLqyJ:zdsN1jZA4BazX5od+2OU9zD0XJ
TLSH
T1D7421971B825AC3359E7F109F44B3B639FA860B7D9846FC4D5D8AB2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 88cdee732194cb66e4ccd07f9d082ed027e7db6e45e1023578ad4c06b64eb101
MD5 36237e8f0b49cad7179a8533b7211a30
SHA1 73bbbd26e443accfdb868d2f95188dbfe90ba6df
SHA512 e4d3e43a81861cb721812abafc13cd176c9dd06da902cfa817c9ed9f08ee2153f1e4d25fcb543f9178f85d22c8f03b3256c6db39981c0ce24b75dd83a232143a
SSDEEP 192:zdsN1jQHG6tUD0QmiU1Ezy/zX5Obd+jKOImy9z+jQpqwaLqyJ:zdsN1jZAhyczX5od+2OU9zD0XJ
TLSH
T11A421971B825AC3359E7B109F44B3B639FA860B7D9846FC4D5D8AB2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 31d56e2411bc42b970ed6ae49a258e0d6db4b55f2f87c07bc62c63ea1b93d6b6
MD5 ff3671275f100c6653fedfe4b728b68d
SHA1 48631871047dc59faecf5b30903379a3f8b29695
SHA512 d900fa1da6eec36a8a297d1c384f0f825e6ec7b2810795edcac7cdfb013302069e0388219e29efa8fb8e26c2614f42c45e858d2ede89f41f0eca378952d4aa23
SSDEEP 192:zBVsN1jQHG6tUD0QmiU1KzAtzX5Obd+jKOImy9z+jQpqwaLqyJ:zHsN1jZAhUgzX5od+2OU9zD0XJ
TLSH
T1DC422A71BC29AC3359E7B109F44B37539FA860B7D9846FC4D5D8AB2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0adbbc5aafb7f9b53c6d41bd057992e7c4628ed9e0ac1da624a108544492a1e6
MD5 c77cf21c870c90c93e2c1fefee11a27d
SHA1 c3bf7eb8d51fcf63efc1050d4c19aecff21b3e0b
SHA512 706581b0c7801577d8fb4f19a524d5ec55e4dbc8e2bab4b58809230c1b54442b68a2467e507ce09a12f21a05084defcc3ccdf3ea0e2df9ca6ad09a402147f8d5
SSDEEP 192:zBVsN1jQHG6tUD0QmiU13zfqzX5Obd+jKOImy9z+jQpqwaLqyJ:zfsN1jZAhdizX5od+2OU9zD0XJ
TLSH
T1B1422A75BC29AC3359E7B109F44B37639FA860B7D9846FC4D5D86B2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d4f6b7d021a87294e29875d31445528ca39dc37cdda1d03e7c70538f7115a749
MD5 abfd8f52a26a1a3b184dedf71c041efd
SHA1 38dd63cc4ffcff4004a150da8e1680c7b321a909
SHA512 39640ff3fd1a894fddedc69a1b6a9b3ef1f2a0ce5c54e05b33b2303f836758cddfea9f9aa998e7ca176d5a687c4df5b584ec5142181cda6a88a7f593968dd860
SSDEEP 192:zBVsN1jQHG6tUDGQmiU11zfmzX5Obd+jKOImy9z+jQpqwaLqyJ:zfsN1jZAfDuzX5od+2OU9zD0XJ
TLSH
T182421A71BC29AC3359E7B109F54B37539FA860B7D9846FC4D5D86B1C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2c4f185afdb8e8eb757c97733e44542f3a6f20969f816561f8848a2a7e7ce8d0
MD5 a75ee8b9e558aafb76cd0cf9eb2917d3
SHA1 f2d4827350939d29c2e7878212a14597ade2ead3
SHA512 3af14311bab68949a4f924d20e41110bf077085b33c58bb9383b4aee9086684a25dd3478e2c9bdecc32e86f4361f4e5728bedc475d458381b88e66ed34ec223c
SSDEEP 192:zBNsN1jQHG6tUDGQmiU1ZzrizX5Obd+jKOImy9z+jQpqwaLqyJ:z/sN1jZAfHOzX5od+2OU9zD0XJ
TLSH
T192421A71B839AC3359E7B109F54B37639FA860B7D9846FC4D5D86B1C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6ad0cd510d4d8af17ff65bd2dd3a569ff3600719bbfc0940c2595726da138e3f
MD5 6a9a00cb397e330d61f0e7966db31016
SHA1 9dc775b57993016aa678f6294d9a5902e3ae1458
SHA512 8b3239e1cd5140fe778176e95c93afa1a1bdf054b13b4341ec31a1847b1d3fd6a8a72fd9ad00b5b955a57af3cf93d88058a199e5130f8e934bd9ea67e90dfae0
SSDEEP 192:zBcsN1jQHG6tUDQdQmiU1Uz8kzX5Obd+jKOImy9A+4QpqwaLqyJ:zasN1jZA/b+FzX5od+2OU9AC0XJ
TLSH
T136422A71B829AC3359E7B109F44B3B639FA860B7D9846FC4D5D86B2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ae8572c84f8416d6ba98319de3314700628cc8c39823a8f47aaa6c4c896a0cff
MD5 b60e8fdb7a4f8df506ede23c36f44d78
SHA1 10ee017cf4e5cff0f4df373edb06a32e7bab46ee
SHA512 73c28c7de9ac13b6104e7f699299792b8df7b6f4e5b5db7cb5aacd06c670e5540f7a2b2e66ea331a15783948c4ae1d96bb81f545b17f3fb45b4b23c4347a0bf2
SSDEEP 192:zBmsN1jQHG6tUDYQmiU1xz+uzX5Obd+jKOImy9A+4QpqwaLqyJ:zcsN1jZART5zX5od+2OU9AC0XJ
TLSH
T10B421971B829AC3359E7B109F54B3B539FA860B7D9846FC4D5D8AB2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c11bcd78f55ca028628f0e51c59a69f199c1fb0c540468ffb6119b9543cb225e
MD5 2f1a7362d41fa2d3ccf09414b750907c
SHA1 1685e765a7bbf5b4583821b08127ca0cfe804ae3
SHA512 bfb08aee6c9833fb961485e11cd281b5b2f30c8e35cf2c8868b02ad19a9b5a1efaf34dd746e9dbbf119e8851b20dcdabf581302cff72cf05b7f62cec8f7c9299
SSDEEP 192:zBXsN1jQHG6tUDYQmiU1szdhzX5Obd+jKOImy9A+4QpqwaLqyJ:zhsN1jZARKjzX5od+2OU9AC0XJ
TLSH
T1BC421A71BC29AC3359E7B109F54B3B539FA860B7D9846FC4D5D86B2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0ab8833070d09b1e0c1197bed56f9b9af2092f1e32e382879e78c9f0d2042a0e
MD5 dde9bb723d25c43d1bf8b2c2fa783f46
SHA1 3819ec4f505400d8f8667948ca5bce67a59b1ad2
SHA512 b898beca24a938881a2c9642b8aa890ad32229579b17ab4dbcbc8f74cba76b1a4bca2759010a3a8d9018d3e73ee17c120cf9429a4b7f8826faa9fe123d1272c8
SSDEEP 192:zBusN1jQHG6tUD0QmiU1tza6zX5Obd+jKOImy9A+4QpqwaLqyJ:z0sN1jZAxXJzX5od+2OU9AC0XJ
TLSH
T135422A71BC29AC3359E7B109F54B3B539FA860B7D9846FC4D5D8AB2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8786046bea4a1b43ca82b54277090ca7d5881674f73333e32d996e408b6d7fae
MD5 4de727d27181634ab58cf4d98cf38739
SHA1 3f4f48aca2fc7de09380cf9c2fdb86f863ef8403
SHA512 c118420fb6090536a79d879762a5f7a903a1dcef1a99d9476f0878a5dd358d39670152918387907f15245f832dfc5a4702bafb19d6f1c61122d4885d9f09e65c
SSDEEP 192:zBusN1WQHG6tUDjQmiU1LkzestzX5Obd+jKOImy9A+4QpqwaLqyJ:z0sN1WZAIOeMzX5od+2OU9AC0XJ
TLSH
T12F421A71B839AC3359E7B109F54B37539FA860B7D9846FC8D5D8AB2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0c01474152f41c9b59397d9fef402a6cae28d9de0576b85a73bf756ef56f0437
MD5 86e7e0ea9acf5b9eac46b128ff6b52ea
SHA1 40c400affc92c2b5a3886b9a2abc801d4c136a58
SHA512 cdd0aacfe48f2b5485d6a25a8d56381d7ca833079a9286aea9b14f7c7616b9af2c9c43d7cfed789ecce518d59e0fe1e03ddb53449ec89b549d8ea398e750e3c8
SSDEEP 192:uuBusN1WQHG6tUDjQmiU1XzMUzX5Obd+jKOImy9A+4QpqwaLqyJ:n0sN1WZAIdFzX5od+2OU9AC0XJ
TLSH
T1F9420971B879AC3359E7B109F54B3B539FA460B7D9806FC4D5E8AB2C01C629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 00a05e03fb5fb19064febe92c5c187d42cdaa025f7bdf5dc5967843ea6d1fae5
MD5 5e9450ffbcd1b1eb9f681b8373dd6094
SHA1 22d26cbb1a0ba49b8345144c6cd01df978cbbe94
SHA512 746217af0a1c15798c9898b7adc77167954a4bbefe791155709ec46afde0006ebf67e464418ad20cb275b28600ec07016c93c68082760300fe29de54f8586f56
SSDEEP 192:uuBZsN1WQHG6tUDjQmiU1kzFZzX5Obd+jKOImy9A+4QpqwaLqyJ:n3sN1WZAIyzzX5od+2OU9AC0XJ
TLSH
T13B420971B839AC3359E7B109F54B3B539FA460B7D9806FC4D5E8AB1C01D629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c3bc4c26ee90b6ba4a313837795e3e173d03914354b7afad7f4127d436c0c75b
MD5 7b9df55909e75d3955b5088d56689010
SHA1 0b1e84e3ab432d5ad5fa5798f39d976d95e72175
SHA512 b2aa899d6ebb980456621c3cd7df3c9b3409cca0a84075d1b6762cf66423a7f470ed5723381fdf3249dbaf3a30497e2308ac5eb6162ae19cda99da6537922a35
SSDEEP 192:uuB9sN1WQHG6tUDbQmiU1OzVtzX5Obd+jKOImy9A+4QpqwaLqyJ:nrsN1WZAEMLzX5od+2OU9AC0XJ
TLSH
T1F2421971B839AC3359E7B109F44B3B539FA560B7D9806FC4D5E8AB2C01C629C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 58e4ce4ee6c4c53b63179f69c8a85e6c83a490991cc19ed4514c917a5d9acd3f
MD5 1270d4ff3ba5ad852e0e7a2ea947df43
SHA1 6a2413d37e8ade98eb21cedee5e473cfc92cdd3f
SHA512 1c2894a9b2e4549d1babdba518f411c1bd90e2a70d968483dc20f135a2c868c57091318c91be623eb44cd5f7485e728c8ff118dd381f771d566fe6a7e5467e7a
SSDEEP 192:uuBusN1WQHG6tUDZQmiU1HzSuzX5Obd+jKOImy9A+4QpqwaLqyJ:nosN1WZAOR9zX5od+2OU9AC0XJ
TLSH
T11A420971B879AC3359E7B109F54B3B539FA460B7D9806FC4D5E8AB2C01C629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 910f4580e64f14d4bf88f5cd2687d7ac89d52551862d1ea36d7b87a835f13c97
MD5 761a4dcb2c679091faf5c4b963d39758
SHA1 21648e87e65c2fa557f4b864ac61be07cf3065ed
SHA512 6c0e3fcf0b14feefb2bee9b14bfcdeddffcb7b69d67b7031c1dcbc2d58acedd350c0473a1a0cde9b3b4ece9df53c1c80ca9cf3e1544f0e6a32371c93cceb53f3
SSDEEP 192:uuBVsN1WQHG6tUDZQmiU1dzEYzX5Obd+jKOImy9A+4QpqwaLqyJ:nfsN1WZAOrtzX5od+2OU9AC0XJ
TLSH
T150421971B879AC3359E7B109F54B3B539FA460B7D9806FC4D5E8AB1C01C629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1de2dfef8593ac7d3f7f86105bf4fa26a4a4b4588bbfa82587ad8739d241eb25
MD5 aa142d6d899defb5e364cb5294abf6b3
SHA1 30920eba76b2e5f7d46e02a614d1f21dc6fa9f4a
SHA512 4f74da09d787edb31a0589bd370d148a559bfc4ef5f18e7f10e0c4f14a14d0206b98fed1dd5b7cb167102873359caefe163e92633ecf6cd3c3a47fc45dcd9934
SSDEEP 192:uuBesN1WQHG6tUDMQmiU13zsIzX5Obd+jKOImy9A+4QpqwaLqyJ:nQsN1WZA19VzX5od+2OU9AC0XJ
TLSH
T197421971B869AC3359E7B149F44B3B539FA460B7D9806FC8D5E8AB2C01D629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a4382fc890385c312589950f23b50f76fb83d837d07c139a5adaa8ec99926814
MD5 85d38158ef2394df78f9c8301a43371e
SHA1 9013a9c612012e9bc4ffbedd9a00700e2a4fefed
SHA512 e2782d0c5c99170d62aab3f22331f1247c837ef0a6ba2fcf2da25caf4916b3d6d628a2c7253082fe5a64f67b62823d6623d1cb2d721ed46278881efa87df8c78
SSDEEP 192:uuk2sN11QHG6tUDqQmiU1QzL/zX5Obd+jKOImy9A+4QpqwaLqyJ:nrsN11ZAfe7zX5od+2OU9AC0XJ
TLSH
T1FB522A71B829AC3359E7B109F54B37639FE460B7D9806FC4D5E8AB2C00C669C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b1c655a1182088822ea0daa9d6c96447bcf6c275cca2f9064d1fbf8f242e1f3f
MD5 709bb728e052e0ef62cde7912f4ef9c6
SHA1 b665c57931d005465ec854427566ac2d4757089a
SHA512 489a63d376fdaffab2f254441d114e1476ca0124652502e4a560f19e675b4161e135363ecc1297957e2c95cc08361f07619f5ec63cb8e441237fc03da946ab9a
SSDEEP 192:uukIsN11QHG6tUD9QmiU1pxzcszX5Obd+jKOImy9A+4QpqwaLqyJ:nZsN11ZAWttzX5od+2OU9AC0XJ
TLSH
T18A522A71B869AC3359E7B149F54B3B639FE460B7D9806FC4D5E8AB2C00C629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1e4253164026fed0f331ae6f34ec40427f120df83721e988a41530d128bce919
MD5 287e680ef3a4abb03b98b9dad3ca81aa
SHA1 323e35c3bacb2e240f2b598e38dcb9b63c185367
SHA512 b33586855043ea85d84dd888e5864b5f7d11af221395598f4bc94039c90ba758957133696879ec1d0d4cca3ff5712d9639366c10ff9c920c4a6c760fe463aed8
SSDEEP 192:zjON161tUDRoQmiU1QzGZzX5Obd+jKOImy9TjQpqwaU9:zjON167AIy8zX5od+2OU940U9
TLSH
T13322D771B929AC635DE6F148F48737939FA820B7DD446F84D5D86B2C019729C270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da14f7942a109aaf62ff5f44e74931e8dcebd8f622363fc09efc76039a72c8af
MD5 a291ab9a9c4a0617fa29ca9cbfc7a42a
SHA1 cc62f170173c1343dd589cefb8f908ad278dc813
SHA512 e257c4bd302bff9d12a6280c1a3250ad7c1256e6a23562f9cab82a3fd35ff87df71c0b35361a23bf93b957b9154ab9dd883baec29a14079edefa83c3da3b3c4e
SSDEEP 192:zmsN1jQHG6tUDvQmiU1lz1gzX5Obd+jKOImy9z+jQpqwaLqyJ:zmsN1jZAOfqzX5od+2OU9zD0XJ
TLSH
T110421971BC25AC3359E7B109F44B3B639FA860B7D9846FC4D5D8AB2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 62865d16b736bb09c71a60541e8948025c0c633b1c749b0d3e502032c993491a
MD5 ffdcd4d386c28228192322ea231db67f
SHA1 75a36904c25dc0ae07ca44ef46fed7fa2df3d54d
SHA512 b4b21c3856e8d9dbf29a34073a271ce35c9436a168a64a4773a64ae612bfffbf88f8a434a3109321bb5306ecd03320c8c2808435b1394c3546e98d3dd5f041cb
SSDEEP 192:zmsN1jQHG6tUDeQmiU1wzWrzX5Obd+jKOImy9z+jQpqwaLqyJ:zmsN1jZAzWMzX5od+2OU9zD0XJ
TLSH
T100421971B825AC3359E7B109F44B3B639FA860B7D9846FC4D5D8AB2C01D669C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f3471e91e1865a2a25353932a4959c1bb7c86d14ca1abed5ef0d8ea51c8379c6
MD5 13262eeda2aff683def19ffa4d5644f5
SHA1 6e334b71f138df70147fdb2aff20f8ad4f445b3b
SHA512 7b7520f9b6ea976719643546120f4062feecef22d94e9981b10c061fcdca2829e13269c34467f1d39625377b8dc7213cada41366e36fbcc0f293ed750d85c299
SSDEEP 192:uukqsN11QHG6tUDMQmiU1yznXzX5Obd+jKOImy9A+4QpqwaLqyJ:nfsN11ZA1QXzX5od+2OU9AC0XJ
TLSH
T1A4521B71B825AC3359E7B149F54B37539FE560B7D9846FC8D5D8AB2C00C629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d22cc7d5fc5bcddc9b3a848a482e211afb78682c27487bc618fb6a8a561e2a32
MD5 9917e6904338c86c3bc29a92ee777aaa
SHA1 43653b2cbbf342a4c98b74d1a4eeaf690425947a
SHA512 2f0fd0bed60d908b614cb29ee301d88077b2fd33a8355b51f0ca0b02a2d7bb60d0ef59d11f2d67543328313a0640947679664eb2cb7565f281857d0f4ee48073
SSDEEP 192:uuBvsN1WQHG6tUDbQmiU1azhhzX5Obd+jKOImy9A+4QpqwaLqyJ:nZsN1WZAEYjzX5od+2OU9AC0XJ
TLSH
T118421A71B839AC3359E7B149F44B3B539FA460B7D9806FC4D5D8AB2C01C629C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 350bf68208e8264ba7808b4d29d3842afa278e4e93f43686d7d952e7dd448d45
MD5 71f702b092596696d0b81af6b5f47043
SHA1 f0dd6414ab97dc18be6857ec248647508113677e
SHA512 11d86e684d08902e4cf5c3b051ada575788c7bfa5f6844c7f4574e544b55b6109cdf8f5c99c7c37f012d2283e544d4c5bc623e47abd0f2d352207faa9df277af
SSDEEP 192:uuBVsN1WQHG6tUDeQmiU1mztlzX5Obd+jKOImy9A+4QpqwaLqyJ:nfsN1WZAfk7zX5od+2OU9AC0XJ
TLSH
T192420971B869AC3359E7B109F54B3B539FA460B7D9806FC4D5E8AB2C01D629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e8949b86378dc05259c2260cd8560d090b75adfd2998186811c145d0dfb3c73e
MD5 467e601a6df3621226c3357b2ac7aca4
SHA1 5f2e8b4dfff16a2b4760aa9b71a0e7a2ed03a3ec
SHA512 c4c577ffabd6404c2825d410ebf23b4772d5ecbd0f653a41c5c1b3d309a5bc8e576c649599a8eadbab038857acc79c31993e3f6483f7de4aab7c3752ca4fb5b6
SSDEEP 192:uukIsN11QHG6tUDwQmiU1/zRFzX5Obd+jKOImy9A+4QpqwaLqyJ:nZsN11ZAtZ3zX5od+2OU9AC0XJ
TLSH
T191521A71B869AC3359E7B109F54B3B539FE860B7D9846FC4D5E8AB2C00C669C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 98f3dff14fddafd1ca762fc7fbf02dfac0236f0831c40ac4de60942ada425ccc
MD5 eff69a76c66800eeb6684cb558e7e2cb
SHA1 1d9f5b36db54dc2771b6c837170cb13f6a5c15c5
SHA512 ca5865b8a0eef4bb6410c38c213082d1e7115ff2fe01e2b32bf20fa530e003c50ca7034e396a509027a4c831a57a7eb52e73ad491aee1350f2dbf9d488459469
SSDEEP 192:uukrsN11QHG6tUD/QmiU1mz4QzX5Obd+jKOImy9A+4QpqwaLqyJ:nmsN11ZAM0tzX5od+2OU9AC0XJ
TLSH
T1D2521A71B829AC3359E7B105F54B37539FE460B7D9846FC4D5D8AB2C00D629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6f40c85b6be8271779cc25b2f0d57c142e5175a3026f6737cac843bc508c8e95
MD5 cdb14d2a9b3b27a51e7e0d541a21b40e
SHA1 dbc51ef847c81b5ac7c46d8f82fe3aa5f4937ceb
SHA512 c589707bfa0aeb5c7c0b9cf997a0247277ae706b2a11840f34a6df7b6c53e0373fd81c83b4ac54f94f3ac5d89bf82e78e0b669156862b004ff1af829b213a43d
SSDEEP 192:zjON161tUDRoQmiU1pzxyzX5Obd+jKOImy9TjQpqwaU9:zjON167AIfQzX5od+2OU940U9
TLSH
T16222D671B929AC635DE6B148F48737A39FA820B7DD446F84D5D86B2C019729C270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0738771040086ecb4be79bcfb902cf49d55cf0cfe2cfea274f71e5aa07be730c
MD5 8d34259b28401b6929efd33f74503eb9
SHA1 421947966778b0dd44ceacb35a62fb34a7d6c22a
SHA512 0c13c3b260f5c2ddab7ac9bae526bd58e10257c465be18e104c8059a77056e77e9665ad224d0ed73c350f36a533b788a182196b7cfdd0a2b544c870937045b01
SSDEEP 192:uukqsN11QHG6tUDFQmiU1fz2qzX5Obd+jKOImy9A+4QpqwaLqyJ:nfsN11ZAepBzX5od+2OU9AC0XJ
TLSH
T1B4521A71B829AC3359E7B149F54B37639FE560B7D9846FC4D5E8AB2C00C629C270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c0af849706468167924c2be3ca9333846162c3b1d724141035642a4a9f9378be
MD5 09353f24c7d431efe8bcd717ae21d0a4
SHA1 f37b7d44cdc0af30885cf71df9f7a427d366c124
SHA512 f90d8c4c01de9eef42d9dcc1bd49c4a6bf4c15b69cf15ecdf6388dc50ddb52950784d1fade3769123177b64bfa5244725364e1aea99dceadd6d693af377c8a3f
SSDEEP 192:zjON161tUDRoQmiU1izY/zX5Obd+jKOImy9TjQpqwaU9:zjON167AIIAzX5od+2OU940U9
TLSH
T18222D671B929AC635DE6B148F48737A39FA820B7DD446FC4D5D86B2C019729C270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7f2fb118a1901b0b9200e2833a19882f35aa1090c233f20b4b0c69d57fc80918
MD5 e8d83a820b4c15225be34e5b2c3c4f0e
SHA1 81fcbdfeaf59dc654c595453d470d8b7a69c2054
SHA512 73ffc639707db5c6ec7bf01b06a1f38d6295aaf42f33f5e33d3cdb773030576d3085d60f2e3d5fac3b5525862eacd9a30c76362fd874df215f7fdd295df4f11f
SSDEEP 192:zjON161tUDRoQmiU1PzS8UzX5Obd+jKOImy9TjQpqwaU9:zjON167AIBSHzX5od+2OU940U9
TLSH
T1AF22E671B929AC635DE6B148F48737A39FA820B7DD446F84D5D86B2C019729C370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c1ab1085a3b8481f27277d67bb526f6fc9f22fa04fcd81da00fbeb3994571e40
MD5 639946a32900f7d60d5d02ff3ddf0f8f
SHA1 d2d1922240ab66240884f348e6bc2413f2032933
SHA512 06fe4c0bd4753b73cc1c6f2ce5dacf20e8182ffec130fc62b8da69b5d1193b089bed188d1f00805b5aec1c56fe8a3170b0bed82590e95e5446b478d1c3ee85dc
SSDEEP 192:zjsN1VQHG6tUD7oQmiU1kzi1zX5Obd+jKOImy9z+jQpqwaU8:zjsN1VZAMIWUzX5od+2OU9zD0U8
TLSH
T1C432F8717968AC2389E7B158F48B37A39FA860B7DD406FC4D5D86B2C01D769C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daede90d-c229-43d7-95d7-16cd4a5168fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\daede90d-c229-43d7-95d7-16cd4a5168fe.tmp
Size 12KB
SHA256 edc34eb103376f5fb21dd16553d53b0bd86a32bd100f75cf96c65256c99f97f9
MD5 803042407485b45dad2de7f2fcf37a56
SHA1 39f201f5032189d32c0cf565f2fd959a35c51dfc
SHA512 87e64833cf44a9ebda5887748b809d6b4292946b3ff3fb89b886510e99f025262498cd2403f9c2aaf5ca995c546b6bd7b91350460af9d4fc4c5b897d969ec7d0
SSDEEP 192:zBXsN1jQHG6tUD0QmiU1rzQYzX5Obd+jKOImy9A+4QpqwaLqyJ:zhsN1jZAx5NzX5od+2OU9AC0XJ
TLSH
T169421971B829AC3359E7B109F54B3B539FA860B7D9846FC4D5D8AB2C01D629C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3230b2a1-7a05-4f24-8e5e-fa8ed17d12a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3230b2a1-7a05-4f24-8e5e-fa8ed17d12a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d1e17aa6c549c1065837cd9c3e6c5340ee32401d3475583cd7211d6736f33b2
MD5 ba52b27f0246411239e76b7b1a7e3f7f
SHA1 9696959f6dc9336272d5e974ae8ec0bbff53e45a
SHA512 ead219f4c8111e29a5cd75489e6ab995d49f9c445e6a807e7184c2e2efaf2a0d2f979ff36f944919fc1ebfc06a271e3c91676e8fdc3e5a3e1588db33b3551cb7
TLSH
T1AA411A89A6E91109B3776F5AABF2A96D487FB9372F16D46D00110E4F0726A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43602\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rhbiyklz.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6rd4yyd4\rhbiyklz.exe
Size 5.4MB
SHA256 b9b7c3ff4bef2804db513456ee437033feec6f8a66f30a1f33321fbe0e9c51d4
MD5 3594f87ed84019249f61b56b120343c0
SHA1 ee7dc43fa799dfe9babb42768a0e94b4f99605e4
SHA512 8c086606152115c9dfbc63b0ebdb86b3b6d13bf3293dc4194fdefa2be9e5e4ea40363f93c96d1e666ab37d378352cacb9e732e155aaee76be3a740332dc90b5f
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRi:OrICteErownP0oTcMsABqlaOzM
TLSH
T1FF463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6104-1284-0x0000016A21B70000-0x0000016A21C84000-memory.dmp

Download

memory/7508-1408-0x000002AC66280000-0x000002AC6632D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads