e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6

Analysis

max time kernel
2s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
Size 5.4MB
Sample260822-dsty7azhng
SHA256 e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6
MD5 03acbd59f9a0b131d078a8509919cfba
SHA1 605b523f0f8048d428c5abe1af4b7718dff05ea2
SHA512 ff7a1680c3d374f8888221eaf1c884b165a2d5ebeb8693740177305b25dc645413babab40acfb34bcc70e526e1aebce98140cf87224a3070c24748726fc94dd9
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zry:k7ICteErownP0oTcMsABqlkgcz2
TLSH
T1E7463308B3A809D6E6B3D53D81565211E872B4264BB0D2CF43AC9B662F777D0AE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjpqah.exe	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjpqah.exe	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe

Loads dropped DLL 11 IoCs

pid	Process
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe

Unexpected DNS network traffic destination 41 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\e2dc4wgn\\fuf625tb.exe"	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2418	ifconfig.me
2872	ifconfig.me
137	ifconfig.me
368	ifconfig.me
1824	ifconfig.me
406	ifconfig.me
848	ifconfig.me
1355	ifconfig.me
1818	ifconfig.me
2806	ifconfig.me
3204	ifconfig.me
305	ifconfig.me
372	ifconfig.me
384	ifconfig.me
503	ifconfig.me
726	ifconfig.me
1506	ifconfig.me
597	ifconfig.me
687	ifconfig.me
818	ifconfig.me
1907	ifconfig.me
2866	ifconfig.me
187	ifconfig.me
481	ifconfig.me
1584	ifconfig.me
1679	ifconfig.me
2660	ifconfig.me
3045	ifconfig.me
3308	ifconfig.me
207	ifconfig.me
450	ifconfig.me
1393	ifconfig.me
212	ifconfig.me
320	ifconfig.me
475	ifconfig.me
1181	ifconfig.me
1343	ifconfig.me
1066	ifconfig.me
1509	ifconfig.me
1585	ifconfig.me
1940	ifconfig.me
2098	ifconfig.me
665	ifconfig.me
1607	ifconfig.me
2423	ifconfig.me
2764	ifconfig.me
434	ifconfig.me
1433	ifconfig.me
1656	ifconfig.me
622	ifconfig.me
1777	ifconfig.me
2401	ifconfig.me
184	ifconfig.me
374	ifconfig.me
1051	ifconfig.me
2466	ifconfig.me
512	ifconfig.me
702	ifconfig.me
1438	ifconfig.me
1780	ifconfig.me
2162	ifconfig.me
2783	ifconfig.me
165	ifconfig.me
310	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7448	cmd.exe
120	cmd.exe
2832	cmd.exe
6676	cmd.exe
6820	cmd.exe
6760	cmd.exe
6840	cmd.exe
8128	cmd.exe
3632	cmd.exe
1508	cmd.exe
4860	cmd.exe
6232	cmd.exe
6928	cmd.exe
6372	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4728	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
252	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3104	4528	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	89
PID 3104 wrote to memory of 120	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	90
PID 120 wrote to memory of 5916	120	cmd.exe	92
PID 3104 wrote to memory of 3252	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	93
PID 3104 wrote to memory of 252	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	94
PID 252 wrote to memory of 3596	252	msedge.exe	95
PID 3104 wrote to memory of 5416	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	96
PID 3104 wrote to memory of 4416	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	97
PID 3104 wrote to memory of 1568	3104	e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe	98
PID 252 wrote to memory of 4728	252	msedge.exe	99
PID 252 wrote to memory of 4100	252	msedge.exe	100
PID 252 wrote to memory of 4100	252	msedge.exe	100
PID 252 wrote to memory of 4100	252	msedge.exe	100
PID 252 wrote to memory of 3168	252	msedge.exe	101
PID 252 wrote to memory of 3168	252	msedge.exe	101
PID 252 wrote to memory of 5524	252	msedge.exe	103
PID 252 wrote to memory of 5524	252	msedge.exe	103
PID 252 wrote to memory of 5524	252	msedge.exe	103
PID 252 wrote to memory of 5180	252	msedge.exe	104
PID 252 wrote to memory of 5180	252	msedge.exe	104
PID 252 wrote to memory of 5180	252	msedge.exe	104
PID 252 wrote to memory of 4956	252	msedge.exe	105
PID 252 wrote to memory of 5964	252	msedge.exe	106
PID 252 wrote to memory of 4680	252	msedge.exe	107
PID 252 wrote to memory of 4956	252	msedge.exe	105
PID 252 wrote to memory of 4956	252	msedge.exe	105
PID 252 wrote to memory of 5964	252	msedge.exe	106
PID 252 wrote to memory of 5964	252	msedge.exe	106
PID 252 wrote to memory of 4680	252	msedge.exe	107
PID 252 wrote to memory of 4680	252	msedge.exe	107
PID 252 wrote to memory of 2752	252	msedge.exe	108
PID 252 wrote to memory of 2980	252	msedge.exe	225
PID 252 wrote to memory of 2752	252	msedge.exe	108
PID 252 wrote to memory of 2752	252	msedge.exe	108
PID 252 wrote to memory of 2980	252	msedge.exe	225
PID 252 wrote to memory of 2980	252	msedge.exe	225
PID 252 wrote to memory of 4240	252	msedge.exe	110
PID 252 wrote to memory of 4240	252	msedge.exe	110
PID 252 wrote to memory of 4240	252	msedge.exe	110

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6984	attrib.exe
6840	attrib.exe
5916	attrib.exe
4500	attrib.exe
6896	attrib.exe
6908	attrib.exe
7532	attrib.exe
7192	attrib.exe
2512	attrib.exe
6140	attrib.exe
5396	attrib.exe
6172	attrib.exe
6728	attrib.exe
6284	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
"C:\Users\Admin\AppData\Local\Temp\e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe
  "C:\Users\Admin\AppData\Local\Temp\e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe"
      4⤵
      Views/modifies file attributes
      PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff8e63cc188,0x7ff8e63cc194,0x7ff8e63cc1a0
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,941395465155537776,99323380782625336,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,11114804628954234632,2769633785899810059,262144 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,956372046600940071,13578120057233095371,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,12088249394404550598,3255887326873641810,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,7454256193204999514,15590299938320467358,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,16535624922519460763,12180553816471736764,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,14844007804675166185,8757224055769118730,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4432,i,12010126564219211115,14216581051409110269,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4776,i,15015240016468453817,9230206994175360158,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3900,i,15862002404566153310,15483772799837036042,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4872,i,3890866229979834826,18358184416272668383,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3181411071416053313,10890107064917144478,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6108,i,15397316939955090837,12781999304174245923,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6140,i,4159822777213680379,17060124634487877199,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6408,i,4170235863441716153,13159061936830233577,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6540,i,12986974069429696574,8534437886605334870,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,1173846041801202940,16766779555264204009,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,1173846041801202940,16766779555264204009,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,117249967763796068,754753276882010424,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6528,i,3402984012437853636,4556261359965154463,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,8521313628251420916,14194710053049713518,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:12
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6024,i,12187076679982673554,2155100993031413009,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6028,i,16967904625844438570,3619273197044465650,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7268,i,12124013481455626657,11901460871193759576,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7208,i,16805379846865217291,2777875649973801879,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7384,i,18066983822923393421,4790492100358174722,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,18276894565713565440,11804142563410447253,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7412,i,15701332406040669964,6582904308298575951,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7596,i,5151341052807192870,3129172382387824806,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6048,i,7424633218609532237,12033488125397678213,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7624,i,7341196722095147871,10526731805882976805,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7664,i,17341185396184712195,3057660765002732689,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7636,i,13627712370659075339,17578959880469415793,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9484 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8052,i,17569044263458759623,16828060452643731009,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7808,i,11044455445322672446,4210272983504760343,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8088,i,16649444789498500163,2019345518542439991,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8320,i,9420129638230518715,14680488856162857740,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8348,i,2740347243910820725,2674656857341805644,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8228,i,3007349799923819548,3914501115195058778,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:1
      4⤵
      PID:6660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7720,i,2737672812864291372,10273420149054372251,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7716,i,4119084329054811950,9376834352835106701,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8364,i,4360421458831633320,10823545332048975266,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8060,i,7356428123782014288,2057029580617809189,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,14873669308766619019,5939986040885843671,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7740,i,7207108984935674792,17082301873200902033,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:1
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8140,i,15126004807339148823,156397072537364694,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8072,i,10062986636031357728,14888757582364940468,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9568 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8172,i,12990512921811727144,2523105001947316434,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8008,i,16010377238310163885,5624727061452362081,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8416,i,1474185798793293171,11293238734658621172,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8460,i,4928788387262663995,11340057659423802375,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8400,i,16782129278008137430,14415454325329955682,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8624,i,10246679006551607145,2764850877495339407,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9968 /prefetch:1
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,778335811656808810,3949419896037922659,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8560,i,11664587281965587612,18158475633090130618,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
      4⤵
      PID:6692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8528,i,1586338025788023969,13184555719524312539,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=4416,i,12156641819274511990,7917489965962108905,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9764 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8616,i,13028508873977642702,11131213448739585677,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9948 /prefetch:1
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=3524,i,8720113739094670701,8888361264549460319,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9692 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8340,i,15137496593103169920,4823123042997160527,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8500,i,2741739730377693335,10370897989221515249,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8488,i,12161073196627832674,7788932962800691086,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9868 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8436,i,3915347072234884489,8783392713102208450,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:1
      4⤵
      PID:6784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8588,i,4926768806289440534,7511875335701950236,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
      4⤵
      PID:7384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5788,i,13708926484054404347,1757464023424347855,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:1
      4⤵
      PID:7392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=4964,i,1731082574016902007,123691806456926213,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5152,i,18312246816138243911,16735634011199680400,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11172 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5128,i,5064943790763329852,8261244913768502318,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8776,i,14613174102695696890,13135067092531797366,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8688,i,11187589491325145726,16315831642731928271,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11208 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8728,i,14449899777046894214,5523372967638086130,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11108 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8788,i,6954834503976583242,10377649088867382018,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8836,i,6526859574228786217,15718392279652278876,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11300 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8744,i,7292888020699621881,5655924006095620760,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11320 /prefetch:1
      4⤵
      PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8860,i,15203319604995720803,1466416199364450003,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:1
      4⤵
      PID:7444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=5780,i,6759949634676971664,12108039518186001285,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8868,i,5700661339969943454,14181415625453555909,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8912,i,3686216621023355345,17273915719473118727,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
      4⤵
      PID:7464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5168,i,15356273970295765596,17157320454386660720,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
      4⤵
      PID:7516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8892,i,18317193274999229490,833593238969389974,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:1
      4⤵
      PID:7504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8820,i,1415201333401591724,17509366115349133093,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:1
      4⤵
      PID:7400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=9000,i,2948722564662320085,4846722281777993480,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11504 /prefetch:1
      4⤵
      PID:7536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8968,i,2484056180133448603,10023803199906153660,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11484 /prefetch:1
      4⤵
      PID:7540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8668,i,5592309827696536554,2243104844900714190,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11384 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=9012,i,545150037996505695,13142719581460450761,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11676 /prefetch:1
      4⤵
      PID:7528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=4480,i,16403703495984510322,12592663678605256336,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11820 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9124,i,16152695083635135151,14091415898681398459,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11816 /prefetch:1
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9088,i,18107307173867366012,13827197839322224523,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:1
      4⤵
      PID:7496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9116,i,13779968952612201130,5817174649293528383,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11812 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=9192,i,14502384878565535411,10437607178622009242,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11828 /prefetch:1
      4⤵
      PID:7552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=9148,i,15172779430373968200,12086260596971440957,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11800 /prefetch:1
      4⤵
      PID:7560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=9004,i,11721071975973560191,1222684695946391074,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11664 /prefetch:1
      4⤵
      PID:7548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=9072,i,4400783843231698097,12450293340567298604,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11868 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8964,i,16116736217012835981,12016438920120969709,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11464 /prefetch:1
      4⤵
      PID:7500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=9212,i,981291686754220309,12435325991631703767,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10652,i,7846469516102447816,17975027772339385861,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
      4⤵
      PID:7676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10684,i,13897368357309640629,2490962652878468858,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16260 /prefetch:1
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10692,i,4530185169281460158,2269776009072202175,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16264 /prefetch:1
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10668,i,1288677003029491630,1231535400945384759,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16072 /prefetch:1
      4⤵
      PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10568,i,10408860066003169573,4789124458362840462,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16284 /prefetch:1
      4⤵
      PID:7732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10592,i,4340175577539393570,16352389527939221418,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16336 /prefetch:1
      4⤵
      PID:7700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10804,i,13183122413943455526,5762391652329498310,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16356 /prefetch:1
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10812,i,12661425283952228631,78064933371524674,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16376 /prefetch:1
      4⤵
      PID:7752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10876,i,14141370150711650435,16717883157805218728,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16420 /prefetch:1
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10600,i,7816376479011532696,10827511448211206109,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:1
      4⤵
      PID:7740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10736,i,6972570685538136826,10531601907634703206,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16316 /prefetch:1
      4⤵
      PID:7720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10916,i,6950957204345854985,16885539579346518830,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16440 /prefetch:1
      4⤵
      PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10832,i,4697996862348153435,11200005321292884988,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16400 /prefetch:1
      4⤵
      PID:7836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11068,i,11584747342313432976,249780713686976039,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16656 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,7555959400670113421,921583919936547637,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16752 /prefetch:14
      4⤵
      PID:7844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=7480,i,12339489010688757482,6340569596358167372,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16608 /prefetch:1
      4⤵
      PID:7868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=11084,i,2701333328577299589,4511977636150527171,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16644 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=7488,i,18349870088022874928,8419869690729740845,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16600 /prefetch:1
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11140,i,1057455235299795495,6365186902758942481,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16680 /prefetch:1
      4⤵
      PID:7820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=11116,i,6446230477765104823,1506749814662361126,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16716 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10896,i,2666159479664854775,11365613370224698885,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16460 /prefetch:1
      4⤵
      PID:7812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=10964,i,6451700907075106446,1995024451317754210,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16480 /prefetch:1
      4⤵
      PID:7788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=7460,i,15502603621910277306,2239026551149770656,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16604 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=10988,i,7175132847976142916,16519697463235918050,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16500 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11036,i,14052125503141394165,6501872071965156962,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=16548 /prefetch:1
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,11875884668856937340,1348668539583742790,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=17048 /prefetch:14
      4⤵
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,10005362760781102117,7764095313853547747,524288 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=17056 /prefetch:14
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=14800,i,5872539357620601366,13694233742342080662,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
      4⤵
      PID:7920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=9092,i,10998678513597208912,16439314175030911057,2097152 --field-trial-handle=2312,i,15354661839402281948,6057657911135709558,262144 --variations-seed-version --mojo-platform-channel-handle=22788 /prefetch:1
      4⤵
      PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1172

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe
1⤵
PID:3592
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe
  2⤵
  PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe"
      4⤵
      Views/modifies file attributes
      PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3048

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe
1⤵
PID:1928
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0x0wxzj\0q45fhz5.exe
  2⤵
  PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2832
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe"
      4⤵
      Views/modifies file attributes
      PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3860

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe
1⤵
PID:1564
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u0nsvalq\ealke2xx.exe
  2⤵
  PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe"
      4⤵
      Views/modifies file attributes
      PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe
1⤵
PID:1504
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qtig21lb\qt9fxmc3.exe
  2⤵
  PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4860
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe"
      4⤵
      Views/modifies file attributes
      PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1412

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe
1⤵
PID:6548
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9zcokbpv\aqnnelq7.exe
  2⤵
  PID:6628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe"
      4⤵
      Views/modifies file attributes
      PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6956

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe
1⤵
PID:7156
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xav4zze\9nzswxao.exe
  2⤵
  PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe"
      4⤵
      Views/modifies file attributes
      PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6792

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe
1⤵
PID:6704
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b638fk57\un9cpy0e.exe
  2⤵
  PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6928
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe"
      4⤵
      Views/modifies file attributes
      PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6296

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe
1⤵
PID:6612
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qyagk9dn\v14h9hww.exe
  2⤵
  PID:6712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe"
      4⤵
      Views/modifies file attributes
      PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2512

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe
1⤵
PID:4564
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewsni97x\oajhfvzq.exe
  2⤵
  PID:6324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6372
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe"
      4⤵
      Views/modifies file attributes
      PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7100

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe
1⤵
PID:6880
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js804ivf\a3s375i1.exe
  2⤵
  PID:6980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6760
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe"
      4⤵
      Views/modifies file attributes
      PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6908

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe
1⤵
PID:7012
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kxk279bt\88gic3qd.exe
  2⤵
  PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6840
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe"
      4⤵
      Views/modifies file attributes
      PID:6908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7260

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe
1⤵
PID:7336
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zxvh9tb3\f0s48cin.exe
  2⤵
  PID:7408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe"
      4⤵
      Views/modifies file attributes
      PID:7532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7844

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe
1⤵
PID:7904
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ffah74x\aum9729u.exe
  2⤵
  PID:7976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6du4arw7\z7y0vw5q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6du4arw7\z7y0vw5q.exe"
      4⤵
      Views/modifies file attributes
      PID:7192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 281KB
SHA256 7193b069fab801675459c1176e775a0f235d13dc52766ab3110bd2b5c18cf821
MD5 a306e8d25be8cae5f88a50b3cfb9316b
SHA1 8491754c015a2ae2ac416331adf24e832740e0e6
SHA512 a7daa251172e1c6cccaefe77aa9efa91c0b6a97df4a4f70446ac1edf6f2fe1952e75eaa45b44a74b609fbead93befa57487415d8cd9345c620726f4bcfb11839
SSDEEP 6144:5pdyawde1brzMlDpOZPwwt7QPDYdXNn64PsIjuB/w31Va7i:5XrV22wuQPEd64low31VaG
TLSH
T1F55423AA0947F9E4DD12BF6728A1A5BF11C332BD60D7753C1CB222151A07145DAE3FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac839917fce7191adf13846c235c13fe7b673f639af2e74c5c2988546c495746
MD5 af775df8f57770842bc0a716b7acec99
SHA1 19c4bf2dac2fe2eeb8bb6eb85467202a375b0ee0
SHA512 c2788862cb423c28364bbc759b7012b10bfe43937dd3e1e7969b2ff2417087d28ecc100446d72b43f7fd9daba6c89dfc4eefb8ab34c0506866e0f0d8613671ac
TLSH
T1CC819841735F0790DB27AABA17E1E4C5B2F8AC96A14B3E11CD843D74A486F063EE9453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4519.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4519.TMP
Size 3KB
SHA256 c916a3acab99f87ff687a661ae6a92da01a318b6631a4bb8ffd8db61a27f7720
MD5 0e11b9322dd8675962376aca52af7a96
SHA1 4201365fb0493387137be00c09650ab28c7741b5
SHA512 6d0da75bd84767f6fdfca000ebfb0b453ee20005cf24d23885eea93335f70bd7be1846a99632e97ac44d76e0994ae215d9d0f74e5aa00581de127e19feeba2a7
TLSH
T119614291732F0791DB27EEBA17D1E4C5B1F86856A20B6A00CC843D74E486F163EE8467
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4267d355d217b92eacca95b22dcb75a1c61a025ab6d4131de73002e92027b106
MD5 0b71f1eb58adbe964ed6eb6fbe4f5b2d
SHA1 eac6aabf093aa6fd44288d937e9d1c18c37f33c1
SHA512 8eeb05b4746aa7ebd9b674d3df0b7bdbdcf99785297cba2f217c4107d36231e608fd3c838a17e3c9cd5c73b6b334bece8bf5283eb9451d92e4d4e95cf8f7f205
SSDEEP 192:sxRURrCe/fTsNlHYCb1SzoA8pKblzFRHg6+WNsnM97wfYBT1O3nGqRIgVHJ:sxRU0e/fTszHPhQz5HqfR9T
TLSH
T19042C8165A68A93B5CDBE258FA15BF17E3F9102360911E48EBFC8A1C04EF6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fc6b0f59762a5d1f9eadfeda6f669429364307b0d490f93cf92d5ccb14cd4779
MD5 e8ef0b756295eee3c520fc7a5c715d69
SHA1 343481f78d467339590ae2ff7271ddef67a14062
SHA512 e57df31c8b7367bc46014d222e9ce081da36af81feef680240632e0edcd3dde61d3f37f69ef06172d3035668ab59d9df037476754cf73f599c746f9b72809344
SSDEEP 192:sxR7RrCe/fTsVlcYCb1XzoA8pKQGzFRHg6+WNsnMlg6d7wfYBTI43nGqRIgDHHJ:sxR70e/fTsrcPMcz5HDKfk9l
TLSH
T14A52C8165968B93B4CDBE258FA15BB16E3F9106361911E48BBFC8A1C04EF6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5cb52a1390a3c5294ee7048eb583faa677d233da1aeddc94912e00bb6f2103d3
MD5 a24569ebaba7b281004c8a911d93a411
SHA1 cf584662c4d74fa5a5043963b5e27b35b6738ef6
SHA512 61e29c5908659d2b3f42777167c05de64511187d6a58e58b8e37ff5ad24ac77ff9a50e17e647fef33b37d5304fe50b777db9938ba61b5bd151fa88218cd59e0b
SSDEEP 192:sxRjRrCe/fTsVlcYCb16zoA8pKQGPtFRHg6+WNsJ6Lu9zo9hYBTB43nGqRIgDFHJ:sxRj0e/fTsrcPVmz5VkUhh9v
TLSH
T1C052C8169968B97B5CDBE219F615BF26F3F9106360911E48AAFC8A1C00EF6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4682999a70e70ce3a3b68792ce42855b2acf375db98d584d955049228d451118
MD5 69d79ce2ca430eb0b0012bebde2903af
SHA1 465bde575256672b32904418228054889fc2c6bc
SHA512 b88dbb15af3962cd4868dda5e627169c4a9921abee346727ded227204f4e06c732be192af047e00789978c84bb933152b6ac853d9e005f72c3e118f91483232b
SSDEEP 192:sxR7RrCe/fTsVlHYCb1dzoA8pK4ezFRHg6+WNsnMlg6d7wfYBT/O3nGqRIgDHHJ:sxR70e/fTsrHPKAz5HDKf39l
TLSH
T18B52C8166A68B93B4CDBE258FA15BB57E3F9106360911E48ABFC8A1C04EF6DD610740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e93b4e59022d0c7841ab1be18ec7d71b8938ec111fc4745c1c9d27dc2252715b
MD5 b2b6b1a1493b608f7ccef7d0321ad65d
SHA1 9695c57d326770657b8a4ca2df5c6d709d91dbf7
SHA512 80197170d8a202d38cfef11de8f56a9866e0af8d72059a3ef708baa525e527c4df2f34194cd6a14ff7cbfe71f0cfa4dc5113f78fab528cc1c88192890cf1ceb0
SSDEEP 768:40Dk6DJQD8AF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3:40Dk6DJQD8ATE7N0DbWgQ6DjfIQDFu1D
TLSH
T1D4C2E97B640CCB7F4F804ADDAD197A8A6DA802CB56D8CD8047FE991C02C7BEE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b980ab185bbe3a202d6490852439bd329cace914c165b8037bccd5d592d254d5
MD5 1b838a4d1376cd4969d79ad0f83085f4
SHA1 ea451d6320544ce62cc03ae25e01f3a9ea5a2e37
SHA512 ec07ffc0be1a1df38ff9c96e0a3468ad35ebb4eebbfd615c744f5966ad7fd4a9cfe0eaca8170c69fe0721eb66cc9dfc98cce7871f38df25d45bdd804638f93d7
SSDEEP 768:prv+4UNbdG31jXqDTd+ZgtYeX6+qTko0u229a4vsDoeVH1SdW:pbsbU3F0vVTVKa4VEH1h
TLSH
T17B03CF32E8648D778CE79784714B75472FB95163DBC80B80D8EE6B0D069B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 546a0fda329405da9254a0b9d54977c17333f4db78f9d6c829abff1327157481
MD5 5fc493983898d9f0efe65f69df88a3d0
SHA1 295bf4dfc96337a72a74e3e164dea78865f640fa
SHA512 c1d9ff9584453bd957f8a0c247d548529679862edfa940ee1a944eba98ec6f656615b7e6a9df78b0a39952731ef42e05408e4c28de84f70742297c1fa23f91bd
SSDEEP 768:RT3SucLl+kDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:RT3iS5vVTVKa49IfA1e
TLSH
T139F2BF71EC719C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3ba27b3faff961f61a95ef40a3cec013a07ea4100d54135d5796d5556729f84b
MD5 f3cd319feeebb34ae15daa00c18de978
SHA1 941c3ec9e155b186d9ac742ed807f95b4fbab1ad
SHA512 aafdc36dbb76224d56d2cc7630312866c46f5de5b825dd6219c408c802875a7141e6812ff7ba28e8d85263869e7307870ded6b742f58bf7a40878d56c1097d0d
SSDEEP 768:Rn3SucLHWkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:Rn3iA5vVTVKa49IfA1e
TLSH
T199F2BF71EC719C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1ac2b179d1737606a2f7ab85da42834f834da58ead81e4f3edbe8f9e09f343c5
MD5 2d045e6d133c09101c09ca50e09ee814
SHA1 d7d415e95c5d838fc295bf51dad07bd2ffaf80c1
SHA512 4ce9daab86d52bb19de88ee479b686e0ad8950413c33a98bcb67569617d158dcb1f00cb5f68fbc3a667b751ab063adf147697def3f76737c4179981f7cb8b1b8
SSDEEP 768:RN3SucLAkkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:RN3iP5vVTVKa49IfA1e
TLSH
T1C1F2BF71EC619C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2ea6df63ebd0ee902ab6b5067eea4801327226c1d4e01f3be8c5b8a8f3dac07f
MD5 07ddb81d3bafcc39cfeb79ca75dc9b41
SHA1 7da78957cff75c7ad9db3e3fb902687b8fcb023e
SHA512 c54933477524e00e471e09b23e93994f10df04404c7f81083fe7d44a907e18a3a6a25dab418513a3e784f392d17884e3c6454e14a0f35f46d69a0e358fa3c1e7
SSDEEP 768:RC3SucL+QkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:RC3ix5vVTVKa49IfA1e
TLSH
T1D5F2BF71EC619C7348EAD3847247264B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 95b15d7766565b5448a9c078f68ccf46b5d1cdaeb048a9707295e120d5849464
MD5 ec5c2578cd9e0b6f45e3a02def6a4499
SHA1 50a848b60468c0bea72f0346ca15be4eb8575e55
SHA512 2eeb27b959c1c8e33ca32c7c1174e8b087d8c202d3a8e23cce3537aae08fd9b835867c9fdd3c96d0db0fcf09feebfa8e338a674c96ec225923aeaddc13a43117
SSDEEP 768:4f3pucLcekDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:4f3d95vVTVKa49IfA1e
TLSH
T182F2B071EC619C7348EAE384724736476EB91173DACD5E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf4c9fc9d504e251011e848fcf10189efee63c82199aee511954dfdbb393e91b
MD5 d8d3f9f1768234e9ec64d112702b623e
SHA1 8a6cff88c244ace829c08cd71a8a372a9844000c
SHA512 479a8a6d21cd13b47eaec9f7bf9bccbac88004ac965f2c6fe0c0741481e1ec699ceb37c0256dd7354e9ffb3f3fae302ebf3093f3dedb01e7b0d6f90262456f10
SSDEEP 768:3rv+4UNbdv3PucL6KkDTd+ZgtxtdeX6+qTko0u229a4vsTGIo3:3bsbp3TvDvVTVKa49Io3
TLSH
T1EE03BF31F8659D738DF6D684B14B36477FB821B389C90A44D9EE6A0C054B5AC370F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2865765101ed27c4f62f006d6bb08c8fc64490086693e232f6bdf7fad858e779
MD5 2b56e522590fa178058c2bbc61ca842d
SHA1 552b69954f19fbfc8e5afa73ddb80db11ba160e1
SHA512 70d0b44796a198f36d1947e0fc74852f194ebeefebc3ab12b01765ad34a0310f1e68ae57d899e74a02aad3fc96f31c8e1421bcfaac15841f06bdc387654f249b
SSDEEP 768:7rv+4UNbda3SucLtekDTd+ZgtxtdeX6+qTko0u229a4vsTGIo3:7bsbo3iyDvVTVKa49Io3
TLSH
T13903BF31F865AD3389F6D684B14B76477FB421B389C50A44D9EE6A0C054B5AC370FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7ba458348b1e900023ca02c4ac276970628cf3ae1a9cb7d355a33ef5406a5794
MD5 5109e142b5f775be04d3cf112f75226a
SHA1 4ca159782f79ae989c8b2768a26e38e2661fb604
SHA512 a1eeb101e33d4a8437c7c1854a4fd78aa53c1c3039948605101268ca0a52de5e98194c237e2583608e89265b40c0fa0f54f46a80a39c1a7b8855cf2336815d9e
SSDEEP 768:R63SucL6AkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:R63iV5vVTVKa49IfA1e
TLSH
T1ACF2BF71EC719C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7ba17a4f5c88cf5d40c05acc2f05fc1db08dc035f49fa6c5c86ca7aaf51337d1
MD5 d68be1186eee76c41d5c73014ea9c0ad
SHA1 85d614da0be88288bee0637021e87f5210298209
SHA512 f272868e276440016bc34eba46e31523181470993304b0f7bacd65a0df903df860a60c5259848f8cd902aafc52ea92385409f1db006f0e016eec73cb6f77fda7
SSDEEP 768:RJs3SucLPmkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:RJs3iI5vVTVKa49IfA1e
TLSH
T17FF2BF71EC719C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bae82a1ee91f755f6a1040099f170c87987f3135778f25e1fcd958174222fc26
MD5 4ba3a963aaba9ab4ad3510386e1a5fe7
SHA1 be1d7f1067eb9cdcc7e1ce80ac68d783f5d53c28
SHA512 9a05ed350ae7e3ad38e873ac45ac2391966bdb4fab1e52b0fdb8f3dad398a4682aabcb539137a5721b972f3db49885b00b7d9673a0a1f5a0d988fba0f458c37b
SSDEEP 768:R23SucLjykDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:R23iQ5vVTVKa49IfA1e
TLSH
T133F2BF71EC719C7348EAD3847247364B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1f3a913c97a98e44e3958dc8b453cc1faf9e47b674461e3b7fdc384f0f2526ea
MD5 c0f9495fa9acebdf7a9ba625bb2b2f4d
SHA1 a52dabfa22df23dff47e48168719bad1bbe3e374
SHA512 8cefeeb26a7b55fe4656ea884f25274cabd3c0e6c68afb532fff1021711342ad44e491e3422cb6fc07d0cbbe1f6f6d206fc24008eb9f397e53c29459a7ef35ae
SSDEEP 768:RJ3SucLTAkDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:RJ3i+5vVTVKa49IfA1e
TLSH
T1E1F2BF71EC719C7348EAD3847247264B6EB911B3DAC95E4499EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 285f3ba5d9c2b247a5673978c5912d9d3996b0d6433d97f38687b12d77442c4f
MD5 11643f9c80e6978747b51ccde2bf71a6
SHA1 475989bd88d4a1b9c9ad9d53733d90ae20ccb149
SHA512 bb0abab3e3eb00bc284336b813782dd9a79d8798c07bb276234a8cb55d4940ba7e7047f6208358dfae5dea3512381d75df418e989da73a12733495b15a3b38f1
SSDEEP 768:R/3SucLVokDTd+ZgtxtjeX6+qTko0u229a4vsTGIfAu4e:R/3ic5vVTVKa49IfA1e
TLSH
T1FFF2BF71EC619C7348EAD3847247264B6EB911B3DAC95E44D9EDA71C044B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1ef286b36c05e6d5187ebb092b79cf2fe40cf74bb731c0ab4a33cd807aa5fdf1
MD5 aaa3a83de294d9a74f361157fa868ec1
SHA1 5bdb9fcbaaf6eababad3c13ba82daa17695b48b4
SHA512 d6f0fb317e3e24eca458a7eb2ec64797a9474d404d8a72100efe753db01eb1c182d92b9f5621a312ec4ae0c5e1ad74146c14fb2fb6e96f9afb63b5ff799fb1ae
SSDEEP 768:Rj3SucLdEkDTd+Zgtxt8eX6+qTko0u229a4vsTGIfAu4e:Rj3igQvVTVKa49IfA1e
TLSH
T1AFF2B071EC719C7348EAD3847247364B6EB91173DAC95E4499EDA71C005B6AC2B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 eaa02485b9596fa199dd42cba8afc136beb1c08471d81dc11d6732fd6528bbd6
MD5 9e1c27ed746a3c91d702d7321e45fe14
SHA1 d1c12cb3836bf91870bd2b0b97e4fabe12c8cf03
SHA512 2cb934dd29f3b18aa0ff9c250f45b92e13e8c9cba39a67964ee791e747df19c19696a750df42205d0e54fd8dade57f97b09247dc2b0c232e51044a31361ca9ad
SSDEEP 768:urv+4UNbdG30ISqDTd+ZgtxtzeX6+qTko0u229a4vsSGIeVH1SdW:ubsbU3uVvVTVKa4wIEH1h
TLSH
T1DA03BF32E4799D3389E797847147764B2FB821638AC40B84D9EDAA4D054B59C270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 eced30521186c907394a62566e3dfd0a74ecf0fb89354ccd29a23e5508af9f56
MD5 6b40172d65c5f5ae5b84d9bad9ffa086
SHA1 bc176464b080b579f3841d2ce9795abfde56607c
SHA512 cf2b32f73bbe61187dd2068a48ab42e9cd987ed453607d6745882f2b5d77a04bc693277b9b9be50097a07d786ddad8cb3e3d51870b12d68e00ff894bdd836e3a
SSDEEP 768:Prv+4UNbdG3HASkDTd+ZgtxtzeX6+qTko0u229a4vsTGIeVH1Sdh:PbsbU3lVvVTVKa49IEH1a
TLSH
T19F03BF32E8799D3389E79784714B764B2FB81163DAC40B84D9EEAB0D054B59C270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1ebfa72c057a663018e086718fed0c219637dff549e9168910f2926940ae6338
MD5 fbff29027a93e0c54efc63435eb506cf
SHA1 c70f452ea06a0f88b5dacbd5fb87211525513d6e
SHA512 a33d52997546c9b84ea32efe550f62afb52efccc59d64843be882f1240936a7a91f8077681b3e1325316cce9fdb8c25d04495e47772cd263fc2453365e139344
TLSH
T1F8E00217E30001FDC07C0234114712342397D03005D107865C1005543C012001F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3fe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3fe9.TMP
Size 392B
SHA256 2fa2e8a2636d64a5df2f7c02e0753e075c8133a3774a63e0fd45c991c3125ff2
MD5 18c05e2c55ecf89d5bd60745c2a34ba0
SHA1 2be708b433b1e3eae589cb9725206525f0d20385
SHA512 5b6a6c6c29649f032a175e94853ec71dffd770e1b439e58845681f23d6616bf5951016fcc8955f284b856d64714b55bb1a88835c6d413d1b642fda7efbde505d
TLSH
T1DBE00417F30001F5C05C03341147111433D7D03005D107C55C1005543C013001D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

6a0568a8-8325-42c4-af14-c680b6a2e970.tmp

Path C:\Users\Admin\AppData\Local\Temp\6a0568a8-8325-42c4-af14-c680b6a2e970.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45282\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fuf625tb.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2dc4wgn\fuf625tb.exe
Size 5.4MB
SHA256 e2a292856cbf010fbf61db2682a1abbac57e8d5b8ad707d70835834aef838eb6
MD5 03acbd59f9a0b131d078a8509919cfba
SHA1 605b523f0f8048d428c5abe1af4b7718dff05ea2
SHA512 ff7a1680c3d374f8888221eaf1c884b165a2d5ebeb8693740177305b25dc645413babab40acfb34bcc70e526e1aebce98140cf87224a3070c24748726fc94dd9
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zry:k7ICteErownP0oTcMsABqlkgcz2
TLSH
T1E7463308B3A809D6E6B3D53D81565211E872B4264BB0D2CF43AC9B662F777D0AE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads