96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b

Analysis

max time kernel
5s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
Size 5.4MB
Sample260822-c9sa9aen21
SHA256 96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b
MD5 c3329f6d372aede91887bbfe46cc276f
SHA1 01df7284aede5c5dddc782a08bb3f2a8171f04bb
SHA512 1e131bcc64b68fdf4d121dbddd67c992f3af783244c5df6aa0f253fac9ecce68f49ce5bdd49faec78714e426be2cf57c5349c40945e8f62facaae3f8f750d323
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUl:E+ICteErownP0oTcMsABqlUutvc
TLSH
T15A463308B3A80DE6E6B3D13D85565121E972B4254BB0D1CF03AC9A662F777E0AF3B750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p4rmwz.exe	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y3col8.exe	td9xdz66.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y3col8.exe	td9xdz66.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p4rmwz.exe	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe

Executes dropped EXE 2 IoCs

pid	Process
4480	td9xdz66.exe
3264	td9xdz66.exe

Loads dropped DLL 23 IoCs

pid	Process
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
3264	td9xdz66.exe
2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\deybz85j\\td9xdz66.exe"	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\lfb95fwf\\343iz6er.exe"	td9xdz66.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3510	ifconfig.me
3549	ifconfig.me
201	ifconfig.me
1351	ifconfig.me
2851	ifconfig.me
3090	ifconfig.me
4082	ifconfig.me
1754	ifconfig.me
1801	ifconfig.me
3536	ifconfig.me
87	ifconfig.me
580	ifconfig.me
1502	ifconfig.me
1975	ifconfig.me
476	ifconfig.me
515	ifconfig.me
548	ifconfig.me
754	ifconfig.me
521	ifconfig.me
543	ifconfig.me
936	ifconfig.me
2489	ifconfig.me
2634	ifconfig.me
4370	ifconfig.me
86	ifconfig.me
228	ifconfig.me
616	ifconfig.me
973	ifconfig.me
1848	ifconfig.me
2204	ifconfig.me
421	ifconfig.me
491	ifconfig.me
3638	ifconfig.me
3752	ifconfig.me
445	ifconfig.me
447	ifconfig.me
867	ifconfig.me
1715	ifconfig.me
1721	ifconfig.me
433	ifconfig.me
706	ifconfig.me
761	ifconfig.me
39	ifconfig.me
993	ifconfig.me
368	ifconfig.me
443	ifconfig.me
1361	ifconfig.me
1971	ifconfig.me
177	ifconfig.me
2272	ifconfig.me
2294	ifconfig.me
1243	ifconfig.me
3912	ifconfig.me
474	ifconfig.me
1072	ifconfig.me
1316	ifconfig.me
2015	ifconfig.me
2310	ifconfig.me
2380	ifconfig.me
2550	ifconfig.me
223	ifconfig.me
426	ifconfig.me
2353	ifconfig.me
3368	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6132	cmd.exe
7004	cmd.exe
2796	cmd.exe
7440	cmd.exe
9536	cmd.exe
736	cmd.exe
1156	cmd.exe
6172	cmd.exe
8068	cmd.exe
5828	cmd.exe
7636	cmd.exe
7588	cmd.exe
9108	cmd.exe
2580	cmd.exe
2112	cmd.exe
6900	cmd.exe
6288	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3232	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2724	1748	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	84
PID 2724 wrote to memory of 736	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	85
PID 736 wrote to memory of 5092	736	cmd.exe	87
PID 4480 wrote to memory of 3264	4480	td9xdz66.exe	91
PID 2724 wrote to memory of 2632	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	92
PID 3264 wrote to memory of 2580	3264	td9xdz66.exe	93
PID 2724 wrote to memory of 4220	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	130
PID 2632 wrote to memory of 4788	2632	msedge.exe	96
PID 2580 wrote to memory of 516	2580	cmd.exe	97
PID 2724 wrote to memory of 2444	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	98
PID 2632 wrote to memory of 3232	2632	msedge.exe	99
PID 2632 wrote to memory of 4384	2632	msedge.exe	100
PID 2632 wrote to memory of 4384	2632	msedge.exe	100
PID 2632 wrote to memory of 4384	2632	msedge.exe	100
PID 2632 wrote to memory of 2392	2632	msedge.exe	101
PID 2632 wrote to memory of 2392	2632	msedge.exe	101
PID 2632 wrote to memory of 920	2632	msedge.exe	102
PID 2632 wrote to memory of 920	2632	msedge.exe	102
PID 2632 wrote to memory of 1644	2632	msedge.exe	103
PID 2632 wrote to memory of 920	2632	msedge.exe	102
PID 2632 wrote to memory of 1644	2632	msedge.exe	103
PID 2632 wrote to memory of 1644	2632	msedge.exe	103
PID 2632 wrote to memory of 2808	2632	msedge.exe	104
PID 2632 wrote to memory of 2808	2632	msedge.exe	104
PID 2632 wrote to memory of 2808	2632	msedge.exe	104
PID 2632 wrote to memory of 4816	2632	msedge.exe	105
PID 2632 wrote to memory of 4816	2632	msedge.exe	105
PID 2632 wrote to memory of 4816	2632	msedge.exe	105
PID 2632 wrote to memory of 1540	2632	msedge.exe	106
PID 2632 wrote to memory of 1540	2632	msedge.exe	106
PID 2632 wrote to memory of 1540	2632	msedge.exe	106
PID 2632 wrote to memory of 4516	2632	msedge.exe	107
PID 2632 wrote to memory of 4516	2632	msedge.exe	107
PID 2632 wrote to memory of 4516	2632	msedge.exe	107
PID 2724 wrote to memory of 2684	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	109
PID 2632 wrote to memory of 4436	2632	msedge.exe	110
PID 2632 wrote to memory of 4436	2632	msedge.exe	110
PID 2632 wrote to memory of 4436	2632	msedge.exe	110
PID 2724 wrote to memory of 1848	2724	96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe	111
PID 2632 wrote to memory of 2692	2632	msedge.exe	112
PID 2632 wrote to memory of 2692	2632	msedge.exe	112
PID 2632 wrote to memory of 2692	2632	msedge.exe	112
PID 2632 wrote to memory of 5040	2632	msedge.exe	113
PID 2632 wrote to memory of 5040	2632	msedge.exe	113

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5092	attrib.exe
3256	attrib.exe
1708	attrib.exe
6976	attrib.exe
6456	attrib.exe
7508	attrib.exe
8524	attrib.exe
8832	attrib.exe
8132	attrib.exe
7848	attrib.exe
12068	attrib.exe
5196	attrib.exe
6488	attrib.exe
4236	attrib.exe
516	attrib.exe
6240	attrib.exe
2876	attrib.exe

C:\Users\Admin\AppData\Local\Temp\96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
"C:\Users\Admin\AppData\Local\Temp\96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe
  "C:\Users\Admin\AppData\Local\Temp\96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe"
      4⤵
      Views/modifies file attributes
      PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffb5334c188,0x7ffb5334c194,0x7ffb5334c1a0
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,7973565942378599155,2169260853908972683,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      System Time Discovery
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,3014121663188765701,11647994177373673635,262144 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,17634839706806689266,9987395556614941741,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9601814474723999652,17681888187866524835,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13805929172749686968,8112176288473061755,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,10883804926345697003,990274691348488437,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,14941224188953952937,10252998353486747870,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4548,i,10210097893208839904,6911425235819359784,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4700,i,495741068634956139,7571265938309286140,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3584,i,501145271122056119,10712304168478617456,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5436,i,10210925885626266893,1240935681630392271,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15796248782014220186,5589248232224348424,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,2591761556902892987,4929910267502073971,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6060,i,10900055890047636033,3369056800778501879,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6228,i,16101293627332855026,5914278913407297612,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6400,i,8929708800534086981,1978979002047665703,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6556,i,5476499046912601367,12309448750687758075,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6536,i,14243158631127287944,4517298144328130362,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,4959316617943902752,10505682473163423581,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,5333658958568005368,971944401363677883,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5448,i,12673248840865623794,13906678631381756521,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7492,i,5239755869208908407,2399687881557567647,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7644,i,6043785908322696237,18411632160842642204,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7800,i,11252174805208492178,4636460275516588306,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7968,i,11143874937206177198,883505098544308285,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8232,i,5422241139324552000,12247976930407199734,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7960,i,8234067397019414404,12981945992630293880,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6536,i,16471820797695000480,8517803376621791122,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
      4⤵
      PID:6764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9424,i,16229695014511456444,18316692126585051783,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=9468 /prefetch:8
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9424,i,16229695014511456444,18316692126585051783,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=9468 /prefetch:8
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7668,i,1787249879548444772,10258864084794389731,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10684 /prefetch:1
      4⤵
      PID:7124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8632,i,10762143815002032220,1697877405789514772,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10708 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8676,i,13337244280496790535,17280351126515893455,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8716,i,457873889157976315,12798977470811608693,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10716 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8696,i,4564894213386798061,16917354601064616700,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10736 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7232,i,12342567464118220092,8488987197135340018,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7316,i,6850394922526787552,9787263714101479545,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10744 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8768,i,15885218989193482739,9201801642927250528,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8800,i,7694630704114168740,11989095841485940492,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10792 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9044,i,16692525770736744391,3315026530134244567,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10904 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7444,i,13896483247956600564,15415714991547879832,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10900 /prefetch:1
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9056,i,4215268994592028847,679623758318758281,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10916 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9072,i,15078054932297536468,5729931505166605809,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11004 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9104,i,2358126527452936524,10531565904324741893,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11008 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9136,i,13837757650880740238,7372464834800299517,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:1
      4⤵
      PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9196,i,12319443208761774872,9564209623725908657,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9152,i,8064685529251389379,13790356049342317910,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11052 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9236,i,14485451092087659224,15040007037005128573,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11132 /prefetch:1
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9260,i,14907718423402446018,6811293792395570334,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11168 /prefetch:1
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9272,i,15177267638074806006,8378637018510411648,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11220 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9308,i,1827238726610733343,12823088520558880089,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11312 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7684,i,17033010219343819625,11674540508725910759,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7692,i,17941783013165160390,16304945220323735396,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7620,i,15021028683527425699,8173663211233148620,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11488 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=6796,i,15547273501294895860,7861279753367808631,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11500 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7532,i,1760718786144871457,16546725836970962753,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11516 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7712,i,8074339182374524736,6145974667142388236,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11576 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6684,i,7729197786290037144,17662853233296035137,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11548 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9408,i,1347098924053702804,8720872213210785363,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11556 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9444,i,9604338439825295842,1251365799806760846,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11612 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9576,i,9334845121423840592,11635263032052404905,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11748 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9516,i,2650106303770461549,5739678265854024649,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11752 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9632,i,3002227751337647621,15152283242088207287,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:1
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9684,i,2916173173316102080,17014979090373407058,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11816 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9740,i,3034447611669853977,2151427243439857488,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11916 /prefetch:1
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9672,i,6063709156542843751,12311843564569152108,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11776 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9788,i,14121783130453076059,7222813814009187821,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11920 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9700,i,4407062003729859339,17369200376399854878,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11796 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9764,i,9812959072103161333,5314782862760850938,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=11932 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9876,i,1341253547965519623,3529847520940775015,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=12000 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9844,i,15236005351554589898,14727828453504023700,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:9724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4232,i,16328440254633285769,14812849029492112251,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:9732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9832,i,9965295146835743070,11318961677949579995,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:9740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9912,i,4803345303067856612,14882369034672027044,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
      4⤵
      PID:9748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9752,i,5359451979314529013,6886264914116577589,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:9756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9952,i,14695036750339420662,13740400758433989922,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:9764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10524,i,8573679309917241455,14448088736856796374,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:9772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10616,i,8271521388524983194,957377313096145968,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:9780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10632,i,2350669821639783594,214986738950594656,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:9788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10648,i,1304948938172927653,13001823383453462395,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:9796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10688,i,10466983803544496944,11100105609602959118,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:9804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10588,i,3363008919028461185,9734276052348620397,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
      4⤵
      PID:9812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=12128,i,9734160201149543821,5421186462659183571,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16552 /prefetch:1
      4⤵
      PID:9964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=12148,i,3646848103611531255,16006930947810391581,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16584 /prefetch:1
      4⤵
      PID:9972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=12176,i,14099504314458043640,12417521966891007637,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16644 /prefetch:1
      4⤵
      PID:9980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12204,i,9486992574086437718,10966990008321101726,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16648 /prefetch:8
      4⤵
      PID:9988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=12264,i,15852731816190677393,804862476260179619,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16700 /prefetch:1
      4⤵
      PID:9996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=12340,i,2484833140634692747,6873879464175503291,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16692 /prefetch:1
      4⤵
      PID:10004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=12352,i,16082752918859354880,406290359419017365,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16764 /prefetch:1
      4⤵
      PID:10012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=12380,i,9601240925268590291,308978698741337831,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16800 /prefetch:1
      4⤵
      PID:10020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=12400,i,9359270872708000974,8695708619289451412,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16836 /prefetch:1
      4⤵
      PID:10028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=12424,i,5484232507094096086,10199033051376884618,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16884 /prefetch:1
      4⤵
      PID:10044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=12464,i,16344402303533464364,4206849733646085061,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16876 /prefetch:1
      4⤵
      PID:10052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=12488,i,8629438808030732744,553688246444771360,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16908 /prefetch:1
      4⤵
      PID:10060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=12616,i,9665876907056753826,2672916871740246490,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16920 /prefetch:1
      4⤵
      PID:10068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=12636,i,2983314621709125246,6679260369251116976,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16924 /prefetch:1
      4⤵
      PID:10076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=12656,i,12918484519655098500,14391069309623135225,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16964 /prefetch:1
      4⤵
      PID:10084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12684,i,6664576421718624395,9932675909512485998,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17020 /prefetch:1
      4⤵
      PID:10100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=12500,i,16306276956769835496,9873256772214706337,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=16984 /prefetch:1
      4⤵
      PID:10092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=12712,i,7674273329759873314,8388388223153668272,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17052 /prefetch:1
      4⤵
      PID:10108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=12740,i,17496459139457159942,8979775537236502056,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17188 /prefetch:1
      4⤵
      PID:10116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=12824,i,12070739312064461246,11605135930658446999,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17092 /prefetch:1
      4⤵
      PID:10124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12804,i,7584446524818306301,12350872722659740420,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17192 /prefetch:8
      4⤵
      PID:10132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=12888,i,4495964840937519286,17176265984963956164,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17224 /prefetch:1
      4⤵
      PID:10140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=12904,i,280559895921067411,14873541321950011416,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17336 /prefetch:1
      4⤵
      PID:10148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=12960,i,7245529163907911487,10487251294798245268,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17356 /prefetch:1
      4⤵
      PID:10164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=12924,i,17779352465321842870,9839234191670892976,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17364 /prefetch:1
      4⤵
      PID:10156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=12992,i,6022074937380594440,8804626586547538378,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17452 /prefetch:1
      4⤵
      PID:10172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=13020,i,1373245133029542673,7307537260176962919,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17372 /prefetch:1
      4⤵
      PID:10180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=13040,i,7606122475595230519,10681295477245303705,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17344 /prefetch:1
      4⤵
      PID:10188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=13064,i,5115887872015402097,5610213071938261320,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17500 /prefetch:1
      4⤵
      PID:10196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=7484,i,3953254108085900869,7080282511013113357,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17608 /prefetch:1
      4⤵
      PID:10204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=13160,i,2315490234715881029,13025955260782294324,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17612 /prefetch:1
      4⤵
      PID:10212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=8200,i,10892975844809862190,1472913863212722956,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17624 /prefetch:1
      4⤵
      PID:10220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=6760,i,4302258143680438581,7326475194604825847,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17680 /prefetch:1
      4⤵
      PID:10228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=13204,i,5284668018332474805,18141972640952860296,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17700 /prefetch:1
      4⤵
      PID:10236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=7584,i,5124979667450544095,11490125399781437013,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17740 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=13236,i,866167708938295577,18414884964186715252,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17780 /prefetch:1
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13308,i,13423476129359487313,13012037693006760743,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17880 /prefetch:8
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=13292,i,10429648833632624430,17557621236695383138,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17844 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=13232,i,12580034901282201221,10327234919989653363,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17724 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13272,i,15975709717643719789,6225517244520242567,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17960 /prefetch:8
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13256,i,16776719561678077775,15702520824980635898,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=17992 /prefetch:8
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=13320,i,9652589723545232323,6716308597088372248,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18036 /prefetch:1
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=13352,i,8600736294435375118,3535998438696275436,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18048 /prefetch:1
      4⤵
      PID:9420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=9352,i,13029493230051400889,2788372774244366966,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18064 /prefetch:1
      4⤵
      PID:9428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=6688,i,3412068683906497823,17265203474049237452,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18156 /prefetch:1
      4⤵
      PID:9444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=4320,i,3888024205773399652,16249330275624885532,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18176 /prefetch:1
      4⤵
      PID:9452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=4288,i,4713504537973715520,8246894773866436606,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18180 /prefetch:1
      4⤵
      PID:9460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,16657584910086077511,1596240812672612242,524288 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18232 /prefetch:8
      4⤵
      PID:9472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=4168,i,10730121152781277980,11746258533618450131,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18304 /prefetch:1
      4⤵
      PID:9488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=6692,i,16112463659296546663,2004225122039278395,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18308 /prefetch:1
      4⤵
      PID:9524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=5868,i,15080071081875175039,14836061831094676052,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18320 /prefetch:1
      4⤵
      PID:9532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=4944,i,9157225148524854897,17081735160152804560,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18332 /prefetch:1
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=5896,i,12710664616427087226,6423598866788046743,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18368 /prefetch:1
      4⤵
      PID:6768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=5920,i,10111814190422962954,3544712733940601718,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18512 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=4884,i,4259129671356003094,5761086160408808740,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18412 /prefetch:1
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=4840,i,11481488783227018547,10935634940926442238,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18508 /prefetch:1
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=4164,i,12100859876238676070,7096775686468451990,2097152 --field-trial-handle=2172,i,15772790869043543960,2667369335126284744,262144 --variations-seed-version --mojo-platform-channel-handle=18164 /prefetch:1
      4⤵
      PID:10792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1848

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe"
      4⤵
      Views/modifies file attributes
      PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe
1⤵
PID:3316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lfb95fwf\343iz6er.exe
  2⤵
  PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe"
      4⤵
      Views/modifies file attributes
      PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1204

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe
1⤵
PID:5796
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ot2avlf4\722uxck2.exe
  2⤵
  PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6132
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe"
      4⤵
      Views/modifies file attributes
      PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6176

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe
1⤵
PID:5352
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vawe1os\wyxph9h2.exe
  2⤵
  PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe"
      4⤵
      Views/modifies file attributes
      PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6636

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe
1⤵
PID:6772
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f46a86wj\mftivvkh.exe
  2⤵
  PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe"
      4⤵
      Views/modifies file attributes
      PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6440

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe
1⤵
PID:7076
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eqvv53i6\e39su1ck.exe
  2⤵
  PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6172
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe"
      4⤵
      Views/modifies file attributes
      PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5828

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe
1⤵
PID:5196
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9oype7u\o9st33lm.exe
  2⤵
  PID:6152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe"
      4⤵
      Views/modifies file attributes
      PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6904

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe
1⤵
PID:5224
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5nhabf8z\fnuj1p2o.exe
  2⤵
  PID:7092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5828
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe"
      4⤵
      Views/modifies file attributes
      PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5156

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe
1⤵
PID:5192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1y7ny4b\72i9crtd.exe
  2⤵
  PID:6800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7004
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe"
      4⤵
      Views/modifies file attributes
      PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6604

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe
1⤵
PID:5972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iszau9wk\07gp49xy.exe
  2⤵
  PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe"
      4⤵
      Views/modifies file attributes
      PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7304

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe
1⤵
PID:7252
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgs6kr8e\n6worghk.exe
  2⤵
  PID:7376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7440
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe"
      4⤵
      Views/modifies file attributes
      PID:7508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe
1⤵
PID:7916
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qkjdc745\pi19ul7b.exe
  2⤵
  PID:8040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe"
      4⤵
      Views/modifies file attributes
      PID:8132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7652

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe
1⤵
PID:7344
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk71wct9\lnlsbc9p.exe
  2⤵
  PID:7520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe"
      4⤵
      Views/modifies file attributes
      PID:7848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7672

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe
1⤵
PID:7208
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pxazg0zz\evklf7xu.exe
  2⤵
  PID:7640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7588
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe"
      4⤵
      Views/modifies file attributes
      PID:8524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe
1⤵
PID:8816
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gj5dmd\nkqj8cfz.exe
  2⤵
  PID:8900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe"
      4⤵
      Views/modifies file attributes
      PID:8832

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe
1⤵
PID:9400
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax0vp3bi\38uf04ro.exe
  2⤵
  PID:9496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\is4f0xds\4c47cbqw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\is4f0xds\4c47cbqw.exe"
      4⤵
      Views/modifies file attributes
      PID:12068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 281KB
SHA256 7193b069fab801675459c1176e775a0f235d13dc52766ab3110bd2b5c18cf821
MD5 a306e8d25be8cae5f88a50b3cfb9316b
SHA1 8491754c015a2ae2ac416331adf24e832740e0e6
SHA512 a7daa251172e1c6cccaefe77aa9efa91c0b6a97df4a4f70446ac1edf6f2fe1952e75eaa45b44a74b609fbead93befa57487415d8cd9345c620726f4bcfb11839
SSDEEP 6144:5pdyawde1brzMlDpOZPwwt7QPDYdXNn64PsIjuB/w31Va7i:5XrV22wuQPEd64low31VaG
TLSH
T1F55423AA0947F9E4DD12BF6728A1A5BF11C332BD60D7753C1CB222151A07145DAE3FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 214KB
SHA256 aee16d0ea306148a83c17886cad0422915a4453947483162d5faaf4020ac6aa2
MD5 f03377d604c5591c3a560a73108e9564
SHA1 a01a0771663f21d8652d00b99d0181c9dc6da885
SHA512 a9316f13eb0a20235e54a198d04ea3539803d0111b7ece68cf2c2c5a635c2c00d2899390ac9d40a210334647d6a50c17660668f651346f5f98c0a7102c7564c0
SSDEEP 6144:oSobZtyoq8Jd1ImfyY4ahX8T1s6eg2PRlM19xfehL:lgJd+mfX4cy17wwvxq
TLSH
T1C724234D68477D53FE417CE10DEAF402926AEB66234F97D5A613817D833703BA4BAE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 219KB
SHA256 38099a60ec09576e1831e11a065c1f6a53cc7a1da92ebe772769df4501a2ca42
MD5 dcf251d67b6af1709572c2c4fb77fb55
SHA1 9ae867d4ceff4df4af6ff958601752e3986e7c46
SHA512 0c1bdff76abcea9f73dc3b19c0353b64a134f5b710412613a74232ed99268ff4b2a696ec7d52d6f4383e7b180a6861fcb68cd9abc6859e6e29d9b9efcfdb719e
SSDEEP 3072:Lbzi/rNmHnBtA4Xb7fgyWuF08Pz3gywjM5OBZ5H3Lb8ABAs+iJ6b34:/zi/Bk1bgoxbgywjM5O5X0AB/+i6o
TLSH
T1412422E1821223BFD258433B8BA0BCD7673B18B5C7E7AF908B89D94FD61938114571C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 151KB
SHA256 53fe1f285c5dc21f7b82507e518d0d2586cecf30b6a8b69e9c73b9e6df248c6a
MD5 87f61144a9fbfad2d12dabd8d8f67318
SHA1 d9d70d37b4e26ce81f7793260d67980ab284f71c
SHA512 998e9b980dce3611a728c2cf46bd8f6241d84a2e8009cc9f1de274cb8f6ff002479fdc9d9f82222f7ec85291713938b48ef96b7b6d8a40398af5dd58fd0ac2b3
SSDEEP 3072:Z4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrAMrblUdKWt3LDK4abVcRa4Xw+u:Zg6JDk3ZgtDn2SMrxWKq3LlgWF6CM8Q
TLSH
T1C5E312238D6813DC26744EE14B143E2ED69DD934C7F301A886536EEC71EAA42F7C981D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 47KB
SHA256 53977bfb2ac015dea4764d0bc4e9083664e9f24891f9c980999f27c5f3aea8ae
MD5 1d983683a5ade8b330dfc9aca29a9369
SHA1 58f93d18f74734052664fe877382465e944678f0
SHA512 c95130abc0bcb06b8d3651eb7eafb76f0aa56928e6605754e27b3336166b4407877e41c20c3f2f3ba477c5d564fbd0392aa3c67dc953495bbf3eb08e30b5d613
SSDEEP 768:Fr8ZxwH4wUt9nRVyHgTUOjFnLVUNvSt8vPV7G+R8dbpPE69ScGW+Torv2u8:yxy69RVmYlBnqNDvPV7vR8XE69ScGRTH
TLSH
T1582301162C3977A25171BFC5D272024375EC888EB63ADD8F4C61EA442BE8CA361DC735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 89KB
SHA256 482c2742c4ae682848284132c8cc4d680953a1976499c5c3ecc48542cd52fa9e
MD5 34349e1a080127c6e375075e4f5bf25f
SHA1 324359e27adee588cb1a3e95fbebf6bb612108e6
SHA512 196bf7d546a3daef0aa02cab13e1809803268f9ae46150a44b3e1eb1da1dfbca5d5d387c3ce86e67ef2a38b3675cdf1ce58b56059c74c53e4dcafcc6635fe4e2
SSDEEP 1536:rv3crlAxGa4Or5ilLzT482AHA8jVxOhKgyzdKG0mVit+GotHVtEqSSd/3ulXjYFM:rvCmN4Or5Y1A8jV4YVBd0Xt+GQ4bC2jF
TLSH
T1AE93121CB2C8D09FF6C231019C61C6FFDD5388D4289F56C9F538A6A39A16C795D0689E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 67KB
SHA256 aeae0da73139a235146c7e1a5605a969b0bed0743c2c06a272ee818329f48cc6
MD5 1a3e207eb153670f2c2385982d8a51e8
SHA1 d3b43669f9a94159bd9b8bb3a84efb6f6a02443c
SHA512 9cf1048da74f382aa5e40c4ea9cc2e6db854603745820687bde686b8d0e4dff59620a48f4f8d4a7d7dc664b0ab9e35e0691af306f238601ec3220c9ffcbff33b
SSDEEP 1536:yWor/EUuvPCdgVVidBZm9sxZUezwC77Tl:sr/EUuvRoSsx3MC77Tl
TLSH
T1CC6302A501357053D84F5ABECAC71B5E0CCD9975B0A9C6CBA59D29A33C3887874EABC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 105KB
SHA256 e3682553e72b0094bbb8a1cd1a9ebfa74980fd92298f0b4fbd71a3f9226cef24
MD5 de930379269a0baf0d23d9abb7b4080c
SHA1 474fd3e1ea7b4fa7019cf469f55cfdf6a908cce6
SHA512 2fcc6cc96376a8f6fc2332304eab8d6f3263244e99fe615ff023a4b490f9115874651898e7f2f30f1e244e5d7480d720542aae72b39f505088ad99a7a33b1089
SSDEEP 3072:zLBT9FH0lj+H8Wth2rbV83O5tYF8gMuoZHH:zL9DJcwho88pPJH
TLSH
T137B312D0C940BAD67E448DE998EBB82E31DF7359C5EF128A13D8523219158773D8AF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cdc216e8-9056-4417-b916-82f7b8fd5ad7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cdc216e8-9056-4417-b916-82f7b8fd5ad7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a99325b3c25b37b3657f48623357d5b843932c70290d0c3d79a1c87ef25bcd02
MD5 f8af418f5ce8deee7ee2e91b338c76d9
SHA1 3834f24cfbc8ba371c603ffa85689f81711e8d0d
SHA512 7290a42b55dd0b55b005612d925a37e1562391fd00291d34fc7ac04e266677a9e6b463f468ebe3ec609003e0c866b847ebf9ef4f5cad57f4bd5ced96a6c1ecaf
SSDEEP 192:sxZtcRhVJyM/jK1Ml8Mj1/fTsf2dLEdpL3py9/lFU/W6+WNi4qF3tdgsZYB3I0ES:sxZtcrf71/fTsf2eLGcboT1ZbO
TLSH
T13152D85666345A778CDFE219F950BB67D2F90463D6A10E44EAFCC91C00EAAEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e0220f0f69c027b2d1bf9e38cf8e705660ab0054ccb61dbf13ab9bc08f3e9063
MD5 a8110294aa06a7ef3ed81507b70a6114
SHA1 b3950872245e363b7b59562b06e5ec906156bb18
SHA512 85ab861aa6b1b7ab37f92d922d1a5de5d3c6012635a32f08015471d5c58287a71edf30a33558ad16672f432a1c19e034c01bd654c08c5e484f92845283a8e028
SSDEEP 768:c9cv20wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+FLlwmWNtro46VeS:c9cv20wWvu+Z+u1jaBFLeRNG46J
TLSH
T176E20B2B280CCB7E0F841E9CDD2AAF966ED801CB57988D5447FA494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d18b34fbf64dd21f043549760e078e0bd309ad9946d6a293d369d03855986158
MD5 bc771c818ae1415df63af205dba04c5e
SHA1 314501fdbe3308a6a99390192f5ea5b4941b8993
SHA512 c3b6ffb45d72469fd88b1912002b8b1c96bd66f0e4aee0f9ba60516f0e710e47cb3e0e1f11bbdb45136417c9e0ec8c5180856d5e53e867018948523d307eabf6
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygha+IOKb5azq/WbKni/kbTgYbyqomJCK4:mTdBJVnT
TLSH
T150B1E336333B1252397D6948A29587374E8132637814E4AF7BBD00A24EB7E216DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 53cd5f47f6ad588a89a429d54cfbb3d02fd62e022a3bfa931a9b5ce52170da4d
MD5 7e38e6846f4837ac3e58cb062c9e4694
SHA1 7742cb32f11df5fe1e44bda207e193e3803abedc
SHA512 37e302a96783efe71e884b99899b7332e8f072420b6e306c274b255ce2275110b32d0bd640f25d9c8782381956f2d4164ca838731ccf05b17fe2ccd99f639f08
SSDEEP 192:uu5osNUYbQdI5K+YLeLSQmiU1AckSe+CGWOFmRetlxJiAqszLqyTdw:nysNUYb7gziqxje+CLOzt0mXhw
TLSH
T12B522971BC785C7759E6A545F5473A239FB820B7D9C52F84D9D9AF0C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6e0fee57975ba41aa9b743bade718ad4eb69569bfb0bf6b856234f2cc7711a7f
MD5 4864ddbb202918e493c24a6a3421b674
SHA1 961ee93f743516bc53fb6f07f337f4e363b55b1a
SHA512 1d02edfdc08dafce9ff2215c8814e9f65c5e020a8a7128ab623cf082e97e5d93f495f4a58173eb374c49d4b4fff55a5f81a4cdab6aeb5093b7014dcf5eb1c8e8
SSDEEP 192:uu5ZsNUYbQdI5K+YLeLzQmiU1Uc7Re+CGWOFmRetlxJiAqszLqyTdw:nnsNUYb7gzi5t9e+CLOzt0mXhw
TLSH
T1C5521871BC785C7759E6A545F5473A239FB820B7D9C22F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a7f10603f2e0d173ada46526fe5dc69eddc0bdc832dca33a9ef8ab427991b8b
MD5 8728210865d3f8099a038ff38f632998
SHA1 3388106cd9e4921693bec20f9bfe358a661dfb78
SHA512 dc7ae05216a9a776909d03ed020f9e8d45082ec2d85dee4f7283972c2c9e74673631a220b21562e74abed424c3882686ca55ac4fc57c01af4a601e627f1f2f25
SSDEEP 192:JONl6v+YLNQmiUyOnZh+CGWOFmRMusCrU6:JONl6vz/7Zh+CLORsU6
TLSH
T17202EA357D682C7B9EF2AE44F58737275FA8117BEA952F80D9D42A1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 45c6c5bb3eb78d631efac6d23434abfdbfa0e21fd36c7ba041f3d69267354e72
MD5 18b7d3be07790447d11b8e756f6f06c5
SHA1 1e8bf7042c0396fbd8b70b8e6411881fa685596f
SHA512 c5eedfb7a6e9df8275a7e58612d863c2b6c331b9dbb3fb0869ed4891cbd5beae063b280c4687324503b9d813c3485edda0425e841fed05d8eef5287db1233b65
SSDEEP 192:zesNUiQdI5K+YLeLuQmiU1XcZge+CGWOFmRetgCiAqszLqyTdw:zesNUi7gzi2iqe+CLOztYmXhw
TLSH
T126421870BC785C7759E6A545F5873A238FB820B7D9822F84D9D86F1C01CB28C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4360df4824d446bc72a12a050e66719a8499f02767e5bcb23abaaba0cd0509cc
MD5 3e48ef4f6e5efedccf84d1dc9c221908
SHA1 61a7f50b349f6b8bfc9f7e9c9aeb1ba1fdf0d69f
SHA512 5db51c2492e041993cd3b2a9fdb615d9084dd1808d7c9c12e7e1f26751103823e6e8f0aa0ec472ba7cea50aa57eee92e844a09a47f7321c40d8ec543383f2588
SSDEEP 192:zysNUtbQdI5K+YLeLlQmiU18dc21e+CGWOFmRetgCiAqszLqyTdw:zysNUtb7gzi3xOe+CLOztYmXhw
TLSH
T195422871BC785C7759E6A545F5873A638FB820B7D9862F84D9D86F1C01CB28C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 45cd9a2a701f1dbb233cb58e69445aff6381b10f911267e43dd13c80bfbb0f71
MD5 37fadb763795a0d828ecd988d630f0a6
SHA1 62d510830a76cd21f584b0266ab97f86eaaaafc9
SHA512 0c8b4c7e30879bb0bd9959c60be73f0f6685514905e92deb1c9838aa5f1fbf969a29f5094a691c403827356f8351da94538f1e8021780fcbefc43182c916b6df
SSDEEP 192:z8sNUtbQdI5K+YLeLyQmiU18acVye+CGWOFmRetgCiAqszLqyTdw:z8sNUtb7gziCeYe+CLOztYmXhw
TLSH
T1F4422871BC785C7759E6A545F5873A278FB820B7D9862F84D9C86F1C01CB28C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f7bfa7fcd614eecbe08ac39d07987e0bde1fcd5670deef3c45d6feb051530d6a
MD5 9b4f3389b9ac882885184abffd6a6cf1
SHA1 6d2b197d02be4e8633f5893d285bd2c54a089176
SHA512 e4a13cc63b2d085c87b81583182e393c5e7f1eb5b2d9bb0c3a580dbb0b0b38210dfb846690b1e822fa90276c5ed1ca7e40759bfdfdcbd045137ccd66dad4bcf0
SSDEEP 192:zGsNUtbQdI5K+YLeLGQmiU18Och2e+CGWOFmRetgCiAqszLqyTdw:zGsNUtb7gziG6Ae+CLOztYmXhw
TLSH
T1E9421871BC785C7759E6A545F5873A239FB820B7D9862F84D9D86F1C01CB28C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0412750865d47a1adfac28334b887190fda022c7eb6c3dd7416a0e1268529048
MD5 383bf5907d8bb267380622a2a21f33c8
SHA1 9341f9eb59f8d80472f685ee53d2618f2f116b4f
SHA512 19ec9ebfc24601b6a8649106b1dbd949d4a007b3395cd0575c502d4a82b7653bd4f58f6e91732e399f2ddddf632393300e35c4d125dd863f8c1db8b328afa515
SSDEEP 192:zGsNUtbQdI5K+YLeLlQmiU18bcE/e+CGWOFmRetgCiAqszLqyTdw:zGsNUtb7gzi3jae+CLOztYmXhw
TLSH
T1AA422871BC785C7759E7A545F5873A238FB820B7D9862F84D9C86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9a3bee315b857fe0736e6a668717817a1dc4205a360ca0b4a14ec43476259674
MD5 932811507d75c49557e0eba6bea70286
SHA1 437e841a92c6ddaefd995ea527005ae1b2c1a113
SHA512 d44aa15ef8ba2faa7a31f3941cf75ef36e7d630ade257782bba62a25e38ae705215583cb46de01b0ba5f95c5964f867ebcdfeaf1e631996ade6a07cd8dd8df54
SSDEEP 192:z55sNUtbQdI5K+YLeLlQmiU18AczBe+CGWOFmRetlxJiAqszLqyTdw:zPsNUtb7gzi3oVe+CLOzt0mXhw
TLSH
T165421871BC785C7659E6B545F5873A639FB820B7D9862F84D9D86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 84309e89906abf6b0d92c981df9b252f383edcb79babd5b66bf64ee1d6be1ff8
MD5 0af519f3befffa7f8140a7386b82b26e
SHA1 c81fcfd4f137772f0896439d9f8d4c6c6ef4765c
SHA512 809e2883b3c62406fd25ec9ffae275afe91537186d89b81ed7b6e743855a5c24d78ef25101e58484c2939acdb73daca349fb56a67a3c20238b6be904b708ba76
SSDEEP 192:z5GsNUtbQdI5K+YLeLDQmiU1Lceke+CGWOFmRetlxJiAqszLqyTdw:z0sNUtb7gzi5ure+CLOzt0mXhw
TLSH
T1F6421871BC785C7659E6B545F5863A639FB820B7D9862F84D9D86F1C01CB28C230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 755ed3889778cd1d9a41bef8e6c5479c6cb04ae801c86996ad0d6007f9efd54d
MD5 4b874d27ab90641f91805e7a6df789e1
SHA1 881d544bfab0e9113f74a841353faae87394f285
SHA512 7fd2a473c340c4855d793e4dfa954df462b575e710c6bde2d8ffc0f9c76739cd1edd9cc000af7073b7cd658031c7937c01e15aa05613fcf67bfe5d7d31838ae1
SSDEEP 192:z5GsNUtbQdI5K+YLeLsQmiU1DqcP9e+CGWOFmRetlxJiAqszLqyTdw:z0sNUtb7gziQ31e+CLOzt0mXhw
TLSH
T121421871BC785C7659E7A545F5863A639FB820B7D9862F84D9D86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3fc35956d1dddff701c6939f2eced88ada0fa1dcdc0324e4db5ef4a12945e8e4
MD5 21c3e4fc413f22e82afa8d0c6dcee592
SHA1 c8035d282c1edf058c1af15b66909b08624d7152
SHA512 d9a07d7560ac5bb96a8916a5b28df7ed44884d80ecab50793d8f775ad6ad551919782495e5f12c758d65ae97b1ab7130faf14c26fed6e679e93009417017902e
SSDEEP 192:z5sgsNUYbQdI5K+YLeLhdQmiU1ncAue+CGWOFmRetlxJiAqszLqyTdw:zqgsNUYb7gzi9bmXe+CLOzt0mXhw
TLSH
T160421971BC785C7659E6A145F5873A639FB820B7D9C52F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 04ec42f13f767ddb1009773ade77f1126065806301b5d4429f2cdec210f8c42f
MD5 9e6d3be0f59a746122a1ad72b9bec098
SHA1 c3d43d134e2171ac5f2b7bd593a1b04d785dc2e1
SHA512 894ee51b744f1d32a27c302a7b9ed687210f5bc96211e3b690c30abe25bb6ace117563a558a6d76f59911f0ba841733e08048cf7d65222080ed0024a1ea92172
SSDEEP 192:uu5FsNUYbQdI5K+YLeLhdQmiU1ucNLe+CGWOFmRetlxJiAqszLqyTdw:n3sNUYb7gzi9brJe+CLOzt0mXhw
TLSH
T182521871BC785C7759E6A545F5473A639FB820B7D9C22F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f984b6ca933902134aaf4f8cec09c19bf749489aeae6e7df27fec53cf70a810d
MD5 57adec1ddfa3cac516cb3da7a9b5bf45
SHA1 1dcb392dfd4f20878f9ee277481853614cc3b8ea
SHA512 cc618fd7f2be738f610e7779145e9e4741c8a3b65080b1089650a9e5089114ce394009e1174e0b835ccdf6e297cd794a87be58cc8dd1faee123c348e7ca382c2
SSDEEP 192:uu5ysNUYbQdI5K+YLeLOQmiU18coste+CGWOFmRetlxJiAqszLqyTdw:ncsNUYb7gzi2VoMe+CLOzt0mXhw
TLSH
T1E1522871BC785C7759E6A545F5473A239FB820B7D9C22F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9835501c38c8147fd35015b4ea879ffbd9e9e5a79b61296b1688ac15380a1386
MD5 b7b263bca6689d5206b6c5081ea48526
SHA1 f9678656dfd2935d9679f3aba9ae03f3421bf849
SHA512 731884e1a56e006b505ba51b6339cbbc1980ac47c3abf9fc7784bf14d4a555f1152f13e20edbafcdb6e29e7a52fa1d10da7a596ba346ba5586691b993ae54374
SSDEEP 192:uu5JsNUYbQdI5K+YLeL9QmiU1fcome+CGWOFmRetlxJiAqszLqyTdw:nLsNUYb7gziv+Xe+CLOzt0mXhw
TLSH
T136522871BC785C7719E6A545F5473A239FB820B7D9C22F84D9D8AF0C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 92bc8712677097b03932ece63dea51d14bb5bdd9d26734ec6bbaf5b9c68cef87
MD5 8c55cb0d6ecbd77743d75948420a5c51
SHA1 6a9df465f3aa41c3bafd5807f5fbed6853224b3d
SHA512 501c05133b36b9ad3165e509f746dc468efa721e2e321b4714cadaf53a29e7f6c7cfd45bc467ace8562c003e8c2cbfa140ec85d48b183fe4dbd57f012bddd4b2
SSDEEP 192:uu58sNUYbQdI5K+YLeLSQmiU1FcAue+CGWOFmRetlxJiAqszLqyTdw:nmsNUYb7gziqMDe+CLOzt0mXhw
TLSH
T13D522871BC785C7759E6A545F5473A239FB820B7D9C62F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3830e58cae87d0f691ca5591194aedb9cdf994e71515a6f4f43cd2929d6751d1
MD5 719f38b74ac7cedc7a9990fb592162ed
SHA1 da389d071cbb5b459020e06b4cd825b14fb53345
SHA512 f2d971d7d59ccfd442d4426c7834f2d42b01929c4a23a10c8667b3a89bd74b93b2004f71810545b1af716de1eda001f752dc18dca2022d7c2cfd4cab3e3691b1
SSDEEP 192:uu5ZsNUYbQdI5K+YLeLhQmiU1Zc+Ee+CGWOFmRetlxJiAqszLqyTdw:nnsNUYb7gzijcDe+CLOzt0mXhw
TLSH
T14C521871BC785C7759E6A545F5473A639FB820B7D9C22F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 afa8103288411546396d7e8ed52887bdb81e8a33123c222acf3af931b62a9c74
MD5 7037ce4542d2f3801fff5cea145b2307
SHA1 2721393a0f11a5e0671935589540676ac5a0dbf0
SHA512 9c0b765736307e7b50a02135eb10c832bca48884fc38a12aff1c8e16bba810aa30ac2bf5441e2053196d92f67a045b489de30b42675be3c92dd6dede1ea23d01
SSDEEP 384:nKZcIVsNUYb7gzikjVe+CLOzt0mivg+aEoy:oVcvsRETOzt0miolEp
TLSH
T11A827D706D785C7615F6E144F9863A279FBC2077D9C56F80D9C9AF2C01DA798230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 273b523f0388d1c1462707559aa86592f24a9aec04c50a9f0e8a9f4d04221226
MD5 9fddfaa6674e5bdd96ca641c959df5c9
SHA1 452be6221570416ae996b6f2b51128ecb0dccaac
SHA512 ed1c84c38b959d9f74f1c0625bd4cbcbe9faaaf2491fd14eb458ffa5985df1f4511faf8ea974b007634de916ff9abe34849e719a961757aa2f60bc48ca254c4e
SSDEEP 384:nKZcIcsNUYb7gzi/bRxe+CLOztSmivg+aEoy:occvsqoTOztSmiolEp
TLSH
T177828E706D785C7615FAE144F9863A275FBC1077D9C56F80D8C9AF1C01DA788230792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a5d4614578535c41c3607003c4480b333eb97f9234d5f7eccac6294e46981014
MD5 f5b47508dd4a82abf44c890714be4b55
SHA1 70d68387d47e2d19c3733dcc77738fb8a2c4b549
SHA512 efb952e1adb68f164ab6a8238c4b120196d42220673efb066236585d91074ef9ec64b889321dd756bf771726ef321758a8bba4c0acd35e08434c5a1a23d7aee0
SSDEEP 384:nKZcIHsNUYb7gzidaDe+CLOztSmivg+aEoy:oHcvsviTOztSmiolEp
TLSH
T1C3827E706D785C7615F6E144F9863A279FBC10B7D9C56F80D9C9AF2C01DA788230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0c2bc43249b21332eee5d01009b5a4129602c80cdf3519de784586f4b97c0f69
MD5 c75292e242b74f1170ee470fd59302a7
SHA1 91e68b2607f34934e0fbd8044a192073745c5008
SHA512 5fca0ba0dce20087e35765432447aa25f6386bd6ec74b4c41ef01e64dc4b289a7bc5195ab189e630fde79764a9619c4a2c314138753e99c1dbf51c54595d1325
SSDEEP 384:njZcIYsNU7b7gzidDde+CLOztSmivg+aEoy:7YXvsG8TOztSmiolEp
TLSH
T121827D706D785C7615FAE144F9863A279FBC2077D9D56F80D8D9AF1C00DA788230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cd5aa0af75263d7a23681116beed62695d5205e762e349b7503f2e0900fbb9b5
MD5 c824c3752c3a14fa112e414bcc80d93c
SHA1 38e1fc38b80c3a337df70f602c7494ab83ad3190
SHA512 0cd9759a40f9fe1dfbc9a0b40680b18b159fd5246b8cc8d38c36ef9a11d98d3095fcf484a1e54d81d4706056dc0715803dfd9bfd9a9ae500b54bf6d00a8249bd
SSDEEP 384:njZcIdsNU7b7gziJTLe+CLOztSmivg+aEoy:7dXvsyaTOztSmiolEp
TLSH
T1DF827D706D785C7615FAE144F9863A279FBC2077D9C56F80D9D9AF2C00DA788230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 095a5bbc76e8719ed08e51e70493a3aa0cfa3ee6ad4ad659bb990281a2153972
MD5 29c8fd61480ab4d8a12842b52bacdaf7
SHA1 de64ff9a05b57c5b9f7f4ceb2b3a57264f1b2135
SHA512 1bfb278b0a77c0a8e1679b9adecabe46ccdcb7a32dd31615beaed3c574c6afb6494c631ad7c66270e2e2b1ad9ab5e7010d65ca17ab44785c9e02d4ad28b28c59
SSDEEP 384:njZcI+sNU7b7gziZwve+CLOztSmivg+aEoy:7+XvsvWTOztSmiolEp
TLSH
T188928E716C785C7615FAE144F9863A279FBC6077DAC56F80D9D8AF2C00DA788230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4cde18e2bbfb58464ad101e8eb21d3d7bab3bde4ec070de392e338864b7bdcd4
MD5 86950d0427e37641c5efe90c612dfa8c
SHA1 8803f9bbd6ae4c132e3c8a28ac221338cc2acf56
SHA512 cdb3ec993423a08008a8606d01c36bac07d07f678e92664fa803e75dda00b56b5b24b8976aba1881d8c27295b4c7ecb12f3c6bf262e1d0594a68b3ba7d93fc27
SSDEEP 192:RONN6v+YLsQmiUyWnNh+CGWOFmRet5CHAqszU6:RONN6vzopNh+CLOzt+mU6
TLSH
T17A120931B9789C671AE2B544F4C736679FA820B7ED866F80D6D46E1C01CB78C374A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1da89d34bbfc6e63f97c47167a395e39b99233687af39bef7c0d0fcf2c9faae2
MD5 6961484adf4cce268e3176d604eeee53
SHA1 120583388a20d2a7afadc7e758431270a78eb3c8
SHA512 76714e77f678f99e5b9ec14bee5e82e54971747811bcec71a23b9f6a00b7b750713607cb2808421d663edbf0a4fec07a3c92d1c0c8e0b68c95bb839f3a0afeb3
SSDEEP 192:zesNUiQdI5K+YLeLlQmiU1kcqre+CGWOFmRetgCiAqszLqyTdw:zesNUi7gzi3x+e+CLOztYmXhw
TLSH
T18A421870BC785C7759E6A545F5873A279FBC20B7D9822F84D9D86F1C01CB68C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b6dd21f5622ba06a1da00cf7a813b1095457ee54c70ac257421c6c73c7f9216c
MD5 6ba3c3cdf67a7e7fbd0f2612ec688a15
SHA1 fe749f0de12caa77c77548801260f6e2de099ef4
SHA512 8949251451ca4d02e3bf4d33396fcf1cb706196e8e4a97e2221b2db1f1296c0564bea8946daa7a3273550816531939a5742860d962d9bf9310aceaf053045892
SSDEEP 192:zesNUtbQdI5K+YLeLlQmiU1pcnOe+CGWOFmRetgCiAqszLqyTdw:zesNUtb7gzi3gOe+CLOztYmXhw
TLSH
T1BD422870BC785C6759E6A545F5873A278FBC20B7D9822F84D9C86F1C01CB28C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a365c33878211baf675edbe0ed88438e73c09b059973820c1017a5db2a4f17e8
MD5 3596d81e95ad71ca7ddb625272d0cfda
SHA1 3cfbd11d03f8acdcdf5bcb8e1c45668606ba2b3b
SHA512 6529f95113fbf0ddb4acc59a606fe251f4ce3c06a7a515b888c63bb522e12db495af6ead8a19117c16e10269c38201aa4fe1fb52ebfad3c92b7d7811ea66c252
SSDEEP 192:z8sNUtbQdI5K+YLeLGQmiU18HcIre+CGWOFmRetgCiAqszLqyTdw:z8sNUtb7gziGnCe+CLOztYmXhw
TLSH
T14C422871BC785C7759E6A545F5873A279FB820B7D9862F84D9C86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ea708960877313a65c73a1775db1101b8d37d0f2df4342463a841a11224c9c27
MD5 bd9ddbb66f3562b0396b85a0630aedfa
SHA1 49627618d1117cb85a3602ca10d55a50ab679838
SHA512 809500e5d79f03b69208c30d32456a5695262c908cbb5f3b37a4b98143bd615f5efcca565e7ad36d831370b8c4aeceafae5d64b402ea48965c69fbb6813a6929
SSDEEP 192:z55sNUtbQdI5K+YLeLDQmiU18ukcOse+CGWOFmRetlxJiAqszLqyTdw:zPsNUtb7gzi5V/je+CLOzt0mXhw
TLSH
T1CE422871BC785C7759E6B545F5873A639FB820B7D9862F84D9D86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b4e5d695100e1b5ae358bbe78ce5a37f018af76b242914cad24c019693e39396
MD5 fc3b94397fbe31b6efe67af1a26ee7a7
SHA1 6ea68ff38546793fe1762c0554583445d03bd35e
SHA512 8f74107b5c2ebd3682f2646a2178379057363c94ad2ac5fc9aeaf5d14715a4572f17570a53ac65d0dcc9f3a8af2a8e5caef243f8df533711d0fa86c6be3f4d3b
SSDEEP 192:z5sgsNUtbQdI5K+YLeLsQmiU1lcwKe+CGWOFmRetlxJiAqszLqyTdw:zqgsNUtb7gziQ07e+CLOzt0mXhw
TLSH
T1DB422871BC785C7659E6B145F5873A239FB820B7D9862F84D9D86F1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5ce781b4f530d01103e893f6eb28524c25c49ce7e1b33491412feb54a5cabc1e
MD5 1699b8cc071602a0b27223c0c8d6673e
SHA1 2b26df449884d68afdb7eb8d6560f85cf2a34385
SHA512 ffc6ca250a4b7dec715ce1ecd0c6992a158025dcb41a1483b1b8cec3ccc20a9f90d5d71e6bd2c0b84e3b11bfc950e513543b24d52365faa6345e4dae5ee36ef1
SSDEEP 192:z5sgsNUtbQdI5K+YLeLhdQmiU1wcxTe+CGWOFmRetlxJiAqszLqyTdw:zqgsNUtb7gzi9bFRe+CLOzt0mXhw
TLSH
T1AD422871BC785C7759E6B545F5863A239FB820B7D9862F84D9D86F1C01CB28C330A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 223bfa0a16f713b2d3ebe19b238aa94adca7eab6168c220992087baf43ebbee1
MD5 9d4e4a77fe1bf61167d7491dd67b1b99
SHA1 f3a402d983a0721b78bfbb5dd96610caa0082341
SHA512 325e4cc7cf9b5fb75c2add257dde59251c481612548b0d8bdc5eae6b783a4194cf96a6dd83da44a05f8077021e443a2be958ee1c8c34bd4d9ff5da2cbc260fcb
SSDEEP 192:uu5JsNUYbQdI5K+YLeLOQmiU1yc5ne+CGWOFmRetlxJiAqszLqyTdw:nLsNUYb7gzi2HJe+CLOzt0mXhw
TLSH
T194522871BC785C7759E6A145F5473A239FB820B7D9C62F84D9D9AF0C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f22c52954fe9a1511c378190c1a6c0d6d0ed343417e09f8d7057fbd8f217cf72
MD5 d4952561b05b4e3b3c642c9e7684372c
SHA1 3721b5f0754a599b0db9f03ce6ae348a4c60034b
SHA512 cf1b158196fadd9c72c8b794ea8ac278bb7957e4b3c37029b94f29531d9531ab7bbc543d895544133fe9d17af655b80e22e9c74e43f6778b6ae2eb48f8152a72
SSDEEP 192:zLONU6v+YLeL7QmiU1ecgZe+CGWOFmRet5CiAqszU8:zLONU6vzi5v6e+CLOztvmU8
TLSH
T14F22E83479686C6749E6B544F5873A639FA810B7DD856F84D9D86E1C01CB38C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1b7045acf4afa33372b98ce5568174ac00e9988414fab699cd1e7bfdcacfaed1
MD5 a00c96d22d586fa0cbc099a08308e645
SHA1 a8943b51bdaeef0d32ff5c15b7a73913776c7d47
SHA512 4925424894f366c15b69136e084915a81a49e228751850503cc7c6727f567b4c3e9a73af8c07b989cf0b34555e9f42eaabdd0cffee1d6e06ad49c559f1f0cba0
SSDEEP 192:zLsNU/QdI5K+YLeLXQmiU1tcLye+CGWOFmRet5CiAqszU8:zLsNU/7gzidkWe+CLOztvmU8
TLSH
T10F32F830BD785C6759E6B548F5873A639FA82077DD816F84D9D86F1C01CB68C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2fc4373725d6870add0e9f3b2515b6b1c2957e619c3dbd5f6cf7f3871f233807
MD5 ed14e641cd2409b2a8a0f04696bff1b7
SHA1 e7abbecf44fb1facdcf5608d08e1c18b1f4fb4ef
SHA512 fbff802c63059cece4298b0f0b02baaef4647c8d281ffd1710f8c7e2294027b4368aeb947ebb2f1a59b25f875ec2fdd83b90203b729d04a672ba9471baf72a94
SSDEEP 192:uu5FsNUYbQdI5K+YLeLMQmiU17c86e+CGWOFmRetlxJiAqszLqyTdw:n3sNUYb7gziQCPe+CLOzt0mXhw
TLSH
T1C8521871BC785C7659E6A545F5473A639FB820B7D9C22F84D9D9AF0C01CB38C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b04210d598ab6a8d84ed083364d48c4a36122a7e795cdade32ce26978232e398
MD5 d44ec718e35cf8c837349987f0dda642
SHA1 3b97da649ef5937be33364098296f9b31c3beaa3
SHA512 520f7faff71dcbdd7ac9a21a352d59648e31c0c6acf6cefac79bdbed02ead47d39886581f078b107d4e877eba132996ba1f77ffe0c873fb6df671d578bcd9f86
SSDEEP 192:uu51sNUYbQdI5K+YLeL2QmiU12crte+CGWOFmRetlxJiAqszLqyTdw:nbsNUYb7gziOXZe+CLOzt0mXhw
TLSH
T1AA521871BC785C7759E6A145F5473A239FB820B7D9C22F84D9D9AF1C01CB29C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b398ebc65e47fd683855d34c25bed76463258b29ef580a1a5c34ae9fc6c2a6ca
MD5 102f9c0934826930149ace4fa8a4a05d
SHA1 b0b702e460aa15c94557e8075ec51e8adb3ab666
SHA512 ba055cbbe97ca6f813338dacbe7ab810c0f4a92a668d1066fdee1fe9896f8e97b498bfcfa6b371b47a62dda9bc4c66c047828334968f7ad96ab11102866a5768
SSDEEP 192:zLsNUVv+YLeL7QmiU1YcO/e+CGWOFmRet5CiAqszU8:zLsNUVvzi51Ge+CLOztvmU8
TLSH
T10122F83479689C6749E6B544F5873A639FA810B7DD816F80D9D86E1C01CB39C334B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6d4b397e2aa31430d6097f4a570e87f51a2da8db268622c190bcb870ee449d89
MD5 7f5541579cdf71099ea62dd813f8a77f
SHA1 6b434098ee77ea7bdea455cb9e21b90bd8bad969
SHA512 d1fe2f2cf568bf90e23e2c1f35b0218b72588f8a6723471e765d0b860afe66d14c84745e0928bcd3220295aa654e8110642bb22ed4a776874c0678acc925f3f4
SSDEEP 192:zwsNUgQdI5K+YLeLXQmiU1qcc1e+CGWOFmRetgCiAqszLqyT6w:zwsNUg7gzidL6e+CLOztYmXew
TLSH
T131421770BC785C7749A6B545F5873A678FA820B7D9822F84D9D86F0C01CB28C234B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 51a0f5a35900fedf013e32e6c6722496dd158482482fca3f8fdbc5c4a76ad0a9
MD5 695a5206589b4698cfe4bb21655a2421
SHA1 2c1f0864708500b25a1eb16d80a753cff417acb7
SHA512 8238b9b8c34fa6494037484178dea993b1ad11f6ecf3447146e522508baa33ca163ab20c827031ad13bf128b1edecbd42a6e7500692a27235595333612a29174
SSDEEP 192:uu5BsNUYbQdI5K+YLeLzQmiU11caIe+CGWOFmRetlxJiAqszLqyTdw:nTsNUYb7gzi5gDe+CLOzt0mXhw
TLSH
T1E4522871BC785C7759E6A545F5473A239FB820B7D9C22F84D9D9AF1C01CB28C230A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 29c0a87a5d7211a8a1c34f76ec512eeda1ffd8e6b5471b3a0936b76e78e6e6ee
MD5 2c014a0085fc3926561a76358e623365
SHA1 4ef58b6ee0b80e5a1dbea35c22a6aeaa0522e51d
SHA512 4f42d6c5c212090b2abbb4703f1a22553a207f2293a4d20ad2d0ee81e6dd338a85ae664f10ce0740e1400b6c516da381593cce7832ac92978752b3b4870ef7b3
SSDEEP 192:zLONU6v+YLeL7QmiU1rcQ8Ue+CGWOFmRet5CiAqszU8:zLONU6vzi5GQHe+CLOztvmU8
TLSH
T13222F83479786C6749E6B544F5873A639FA820B7DD856F80D9D86F1C01CB38C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfdbac1f-784f-4c81-8c65-0448892e9722.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cfdbac1f-784f-4c81-8c65-0448892e9722.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

62a50147-6e20-4a7d-bee8-f6ca91ab97b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\62a50147-6e20-4a7d-bee8-f6ca91ab97b3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\base_library.zip
Size 711KB
SHA256 8a83ecc21cee6f9af303b2e03eb3b88cc86663455a6636ab288381ddc8afef2d
MD5 0440f4aa9429ce96e9dfe534a3bd4e2f
SHA1 523c84203b2889008830a00d813c1276cbb5835f
SHA512 f418b2d04b1f0f2b78da1a387ed6dc6bd46a2cff9a38dd27792fa44dbdfb559aa5464f9b41862db2d7d0801528d641c2e7c1961986cd214c5351cff6401e0a23
SSDEEP 12288:tHV0cfk10axJkldphcfyEFPl2osQNRs54PK4I1OoQDSDS:pV0cfjsJkldMfyEL2osQNRs54PK4I1Or
TLSH
T1F8F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI17482\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8b0ce07-7e71-4f75-afc9-9177ab14916f.tmp

Path C:\Users\Admin\AppData\Local\Temp\b8b0ce07-7e71-4f75-afc9-9177ab14916f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

31c64570-84d0-411d-b1a6-83905c5c4690.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2632_514953224\31c64570-84d0-411d-b1a6-83905c5c4690.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

td9xdz66.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\deybz85j\td9xdz66.exe
Size 5.4MB
SHA256 96875ccd017f87734617f7a2b7d028563a1951610e1a27681818e89019a66b9b
MD5 c3329f6d372aede91887bbfe46cc276f
SHA1 01df7284aede5c5dddc782a08bb3f2a8171f04bb
SHA512 1e131bcc64b68fdf4d121dbddd67c992f3af783244c5df6aa0f253fac9ecce68f49ce5bdd49faec78714e426be2cf57c5349c40945e8f62facaae3f8f750d323
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUl:E+ICteErownP0oTcMsABqlUutvc
TLSH
T15A463308B3A80DE6E6B3D13D85565121E972B4254BB0D1CF03AC9A662F777E0AF3B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-673-0x000001F3375B0000-0x000001F3378FD000-memory.dmp

Download

memory/6844-995-0x000001CDA7BF0000-0x000001CDA7BFA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads