bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8

Analysis

max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
Size 5.4MB
Sample260822-yhrrastthy
SHA256 bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8
MD5 34d68b50ef78ed4b31f00497ee7115d0
SHA1 b826d7e4a53e1c9819277db3d66980c0286bf057
SHA512 9ccdd4a09fc8d4d56aa8eb18816baa1e7bdbc077a5ad79e7e203280e0284b3b451ecb1ef04ff468ff7da71d29e105940648427354a508dfb5bf422768b71a537
SSDEEP 98304:5igtRgpH1/GICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll9HNMzQ6nL:F+f/GICteErownP0oTcMsABqlSvL
TLSH
T1F0463308A3E809E6F6B3E13D85565221D873B4254BB0D1CF03AC9A661F677E0AF7B750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ijuff6.exe	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ijuff6.exe	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6eb5l.exe	9vrfbbdb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6eb5l.exe	9vrfbbdb.exe

Executes dropped EXE 2 IoCs

pid	Process
2392	9vrfbbdb.exe
888	9vrfbbdb.exe

Loads dropped DLL 23 IoCs

pid	Process
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
888	9vrfbbdb.exe
2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\e0gn6uw4\\9vrfbbdb.exe"	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\q3vjrxhz\\19nbsatu.exe"	9vrfbbdb.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
115	ifconfig.me
186	ifconfig.me
262	ifconfig.me
491	ifconfig.me
1243	ifconfig.me
1636	ifconfig.me
2215	ifconfig.me
2226	ifconfig.me
497	ifconfig.me
1050	ifconfig.me
3226	ifconfig.me
3652	ifconfig.me
3984	ifconfig.me
1312	ifconfig.me
1320	ifconfig.me
249	ifconfig.me
461	ifconfig.me
521	ifconfig.me
855	ifconfig.me
902	ifconfig.me
1088	ifconfig.me
231	ifconfig.me
290	ifconfig.me
759	ifconfig.me
1772	ifconfig.me
2132	ifconfig.me
2216	ifconfig.me
2475	ifconfig.me
2487	ifconfig.me
847	ifconfig.me
1016	ifconfig.me
2952	ifconfig.me
3246	ifconfig.me
3569	ifconfig.me
184	ifconfig.me
649	ifconfig.me
2613	ifconfig.me
3278	ifconfig.me
6	ifconfig.me
437	ifconfig.me
1279	ifconfig.me
1878	ifconfig.me
2289	ifconfig.me
3664	ifconfig.me
1335	ifconfig.me
1518	ifconfig.me
2174	ifconfig.me
3059	ifconfig.me
3089	ifconfig.me
3842	ifconfig.me
327	ifconfig.me
277	ifconfig.me
594	ifconfig.me
700	ifconfig.me
1564	ifconfig.me
1813	ifconfig.me
2651	ifconfig.me
3240	ifconfig.me
3612	ifconfig.me
143	ifconfig.me
370	ifconfig.me
434	ifconfig.me
1763	ifconfig.me
1912	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 18 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5984	cmd.exe
5824	cmd.exe
6720	cmd.exe
7348	cmd.exe
7984	cmd.exe
5388	cmd.exe
3224	cmd.exe
6724	cmd.exe
6516	cmd.exe
7904	cmd.exe
11496	cmd.exe
10692	cmd.exe
6052	cmd.exe
6972	cmd.exe
3712	cmd.exe
5684	cmd.exe
6236	cmd.exe
4036	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3496	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2356	2340	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	84
PID 2356 wrote to memory of 3712	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	85
PID 3712 wrote to memory of 1892	3712	cmd.exe	87
PID 2356 wrote to memory of 3496	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	89
PID 3496 wrote to memory of 2116	3496	msedge.exe	91
PID 2392 wrote to memory of 888	2392	9vrfbbdb.exe	92
PID 2356 wrote to memory of 1888	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	93
PID 2356 wrote to memory of 2076	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	94
PID 888 wrote to memory of 4036	888	9vrfbbdb.exe	95
PID 2356 wrote to memory of 3128	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	132
PID 2356 wrote to memory of 2760	2356	bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe	98
PID 4036 wrote to memory of 3300	4036	cmd.exe	99
PID 3496 wrote to memory of 3012	3496	msedge.exe	101
PID 3496 wrote to memory of 3968	3496	msedge.exe	102
PID 3496 wrote to memory of 3968	3496	msedge.exe	102
PID 3496 wrote to memory of 3968	3496	msedge.exe	102
PID 3496 wrote to memory of 4264	3496	msedge.exe	103
PID 3496 wrote to memory of 4264	3496	msedge.exe	103
PID 3496 wrote to memory of 3828	3496	msedge.exe	104
PID 3496 wrote to memory of 3828	3496	msedge.exe	104
PID 3496 wrote to memory of 900	3496	msedge.exe	105
PID 3496 wrote to memory of 3828	3496	msedge.exe	104
PID 3496 wrote to memory of 900	3496	msedge.exe	105
PID 3496 wrote to memory of 900	3496	msedge.exe	105
PID 3496 wrote to memory of 1684	3496	msedge.exe	186
PID 3496 wrote to memory of 1684	3496	msedge.exe	186
PID 3496 wrote to memory of 1684	3496	msedge.exe	186
PID 3496 wrote to memory of 4384	3496	msedge.exe	107
PID 3496 wrote to memory of 4384	3496	msedge.exe	107
PID 3496 wrote to memory of 4384	3496	msedge.exe	107
PID 3496 wrote to memory of 5064	3496	msedge.exe	108
PID 3496 wrote to memory of 5064	3496	msedge.exe	108
PID 3496 wrote to memory of 5064	3496	msedge.exe	108
PID 3496 wrote to memory of 1928	3496	msedge.exe	206
PID 3496 wrote to memory of 1928	3496	msedge.exe	206
PID 3496 wrote to memory of 1928	3496	msedge.exe	206
PID 3496 wrote to memory of 2328	3496	msedge.exe	296
PID 3496 wrote to memory of 2328	3496	msedge.exe	296
PID 3496 wrote to memory of 2328	3496	msedge.exe	296
PID 3496 wrote to memory of 1956	3496	msedge.exe	111
PID 3496 wrote to memory of 1956	3496	msedge.exe	111
PID 3496 wrote to memory of 1956	3496	msedge.exe	111

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6588	attrib.exe
3300	attrib.exe
5188	attrib.exe
5968	attrib.exe
2624	attrib.exe
7412	attrib.exe
8096	attrib.exe
10620	attrib.exe
5520	attrib.exe
4816	attrib.exe
4100	attrib.exe
11940	attrib.exe
1892	attrib.exe
5372	attrib.exe
6296	attrib.exe
7056	attrib.exe
4472	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
"C:\Users\Admin\AppData\Local\Temp\bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe
  "C:\Users\Admin\AppData\Local\Temp\bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe"
      4⤵
      Views/modifies file attributes
      PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff8bd60c188,0x7ff8bd60c194,0x7ff8bd60c1a0
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6023970662637826871,12531890921306740552,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
      4⤵
      System Time Discovery
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,12137861022235700697,13731797335433947781,262144 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,8756162678707312222,4930931308974810876,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9049333164678165471,10265687785894445576,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14697652173391893818,13425816088764805076,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,10691042238640378894,12450541487123256093,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,3882174160706145639,7431373061122896868,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4452,i,9344662555925045900,12992802939729022565,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4848,i,16950213641307954650,2480172607035507440,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4820,i,13973040015803921800,14312327853783568594,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5004,i,11315593892957268768,4440402900561602868,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3580,i,12204753111756067224,17342229643555831955,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5644,i,1151659177767168442,5370425784393321860,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,10666723043941816391,17587058419950086270,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6208,i,7704004482741602107,15115370409017034810,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6356,i,1812620732261341145,3555458953400556809,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5860890505074691334,5357357183427777243,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6676,i,3273864642124532417,7783191169038082270,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,9982547800257230354,11653991095370058041,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,1614580607358607542,9834136371687907654,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
      4⤵
      PID:656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6868,i,1760168124982853256,7393018722955180755,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7376,i,16083619501098206065,5479803973379388724,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7648,i,14121743415538785527,14209802003461456110,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7780,i,810232223092577863,15485331522265435285,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7948,i,15017382775855743605,584720142138903625,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8176,i,99814102193513899,9302212251224846819,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7388,i,1036753463428967809,13246036284485195972,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9356,i,3926027820889196145,3551237017799306403,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:8
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9356,i,3926027820889196145,3551237017799306403,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:8
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,989407445816531423,12933543721955744523,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:8
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8556,i,11257285254626991716,7303512035674929568,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8640,i,2326056169173411383,360157695893486342,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8676,i,5161018468789296750,11736440314154374271,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8680,i,16493782775014231861,4727780541659234599,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:1
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8684,i,14187186838961353844,5558434494066363074,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8704,i,2305638730905745332,4122527446324688013,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4300,i,4857520371764295976,8468545644533810767,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
      4⤵
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4268,i,16712919081618835614,14243095885342703457,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=4184,i,10955223887718017797,17815970010875532893,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5344,i,11297927891091599352,5801592622771640898,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8836,i,10495784960606684804,6035559876179189473,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=10952 /prefetch:1
      4⤵
      PID:6904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8844,i,12680578226650103912,177030826573370090,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8912,i,17563536176831598632,2017766878965022854,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11080 /prefetch:1
      4⤵
      PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8884,i,10170650433333969426,873465327369395014,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9072,i,17283669452627062411,896682581711334870,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9092,i,11149539926540292112,3455319395335454438,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11136 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9288,i,5792064273357104649,7973154413139558593,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11268 /prefetch:1
      4⤵
      PID:6984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9220,i,8298142634676814341,8300848936415495862,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11316 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9192,i,13785651630858828969,15820386266279956763,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11232 /prefetch:1
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9160,i,12069718510174186859,13423374681776512371,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9776,i,15740981661152567469,8147074496292546145,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11468 /prefetch:1
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9800,i,4748584086379725624,15236591032924274079,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11496 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9428,i,16919096368388702724,11745746893874780318,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11628 /prefetch:1
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=6860,i,8158393276145520895,4966609449451556771,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
      4⤵
      PID:7052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9324,i,737206236669634077,14072410995371852914,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11376 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=6696,i,18036932153329752138,4040833637082067708,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11592 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9552,i,9760302208224856132,4569251809770535142,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11536 /prefetch:1
      4⤵
      PID:7076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9652,i,7220867453918046882,4659124817373766562,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11524 /prefetch:1
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9440,i,6634276134601405621,6003802826831357105,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11412 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9516,i,16820142732845740731,2621252759122592102,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11448 /prefetch:1
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9448,i,5014534506335167700,8476657302701795683,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11444 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9112,i,5886487990244548320,345155880442611240,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11100 /prefetch:1
      4⤵
      PID:7072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9176,i,18371979967853634995,11922887866746720125,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11176 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9004,i,7266487661370595933,10928432518542172811,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11084 /prefetch:1
      4⤵
      PID:7056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9968,i,16911862196894850984,5929085969572763528,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11736 /prefetch:1
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9960,i,17346492534309698964,16814586689759132386,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10020,i,26114074245079270,6190488575036978083,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11988 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10040,i,14002920390588333382,3741623575138471075,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12040 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=6768,i,18436370396425771776,6188538777208631260,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=11600 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10052,i,9396653020155681510,12199888122072845568,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10372,i,979861215311457185,2785863557832326209,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4688,i,12986083477636161633,11130746628232590406,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
      4⤵
      PID:7908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6140,i,15983401881356485141,15265400698832374544,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=4632,i,10195078277972400490,7551916346412455993,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4672,i,6608420969105593975,9621013777714623099,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:7336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4636,i,549436232159523688,17715893863476701598,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4892,i,14349945260555322630,10059396069663840204,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=4852,i,11396349042123124823,3474273719241219791,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=5016,i,6906157972416047953,14137021610425541822,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12580 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=6016,i,7517643050184150003,945534556281586848,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12612 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=5104,i,16866630073468343149,9202178178786903176,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12640 /prefetch:1
      4⤵
      PID:7764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=5092,i,14548723481347480544,6926959381082539782,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12672 /prefetch:1
      4⤵
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=5884,i,16006409720413613839,97555656184256869,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12752 /prefetch:1
      4⤵
      PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=5596,i,11796337152822864722,3922752417227387479,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12808 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=5068,i,9553085521122692481,419418606411777271,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12660 /prefetch:1
      4⤵
      PID:7848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10564,i,18140749503853430828,1220303812015963333,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12952 /prefetch:1
      4⤵
      PID:7900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10540,i,1353793686621203923,7054013158319217766,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12948 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10568,i,6961821785504334968,16841338386097269658,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=12964 /prefetch:1
      4⤵
      PID:7964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=5984,i,1342142096072088330,16664926496360744277,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13060 /prefetch:1
      4⤵
      PID:7992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=4932,i,7249118080027579670,1667030734085153848,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13088 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10616,i,2680017886612003610,3630052650279890638,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
      4⤵
      PID:8112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10600,i,338020138891917120,4987912581407142202,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13080 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=6036,i,5468814025547778762,86371252138702113,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=6108,i,3795817742934627707,4735487170418816588,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13144 /prefetch:1
      4⤵
      PID:8128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10640,i,15464268441278153327,3732064502397377940,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13164 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10648,i,13747115636738096530,9712656753781337345,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13184 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10668,i,12095983701248850160,2716551128218999173,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13264 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10680,i,4143851021214152599,16261966301231547807,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13384 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=5904,i,16497033270295391615,8191080170377313026,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13400 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10700,i,12492163150174198657,5053594791767644747,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13388 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=4444,i,11838693635636482216,7996794395136562999,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13412 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10396,i,1479996183024505118,2234817447641373719,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13432 /prefetch:1
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10760,i,15377643456008182317,7446031890235648228,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13452 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10792,i,16278163422928581005,13596043058940791965,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13536 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10812,i,12686162794068714262,4639776537268757467,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13648 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10836,i,15736107731800864853,11626488572917689831,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13652 /prefetch:1
      4⤵
      PID:8196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10852,i,2306756416628230664,11207868245179343365,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13664 /prefetch:1
      4⤵
      PID:8204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=10908,i,11829526004839312779,14372054235615773064,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13696 /prefetch:1
      4⤵
      PID:8220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=10892,i,13174208475269333920,13964684034180041648,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13676 /prefetch:1
      4⤵
      PID:8212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=10936,i,11154313761129402347,3122914284912247632,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=13716 /prefetch:1
      4⤵
      PID:8228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12140,i,9023360380320893062,5876109100355679075,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17392 /prefetch:8
      4⤵
      PID:8284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12176,i,11085906589132238433,15805296900927034971,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17416 /prefetch:8
      4⤵
      PID:8292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=12280,i,250866176809504241,13237227698157592214,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17436 /prefetch:1
      4⤵
      PID:8300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=12292,i,3692063660423165108,10585469045406249825,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17440 /prefetch:1
      4⤵
      PID:8308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=6628,i,11219025778867805085,13852134872374326507,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17452 /prefetch:1
      4⤵
      PID:8332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=6584,i,13324708033417291787,7588547525371196095,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17616 /prefetch:1
      4⤵
      PID:8340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=6536,i,15092913044516870344,4584392724151399846,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17620 /prefetch:1
      4⤵
      PID:8348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=6572,i,15766339807472193184,222156485608840666,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17464 /prefetch:1
      4⤵
      PID:8364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=6512,i,14577034844102972054,12031637074427926979,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17500 /prefetch:1
      4⤵
      PID:8356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12336,i,5975562483255426126,2345421632444505240,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17644 /prefetch:8
      4⤵
      PID:8372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=6540,i,7045380171715316903,15368253276548577432,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17632 /prefetch:1
      4⤵
      PID:8380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=696,i,4463526777242282263,5417325152385673729,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17752 /prefetch:8
      4⤵
      PID:8388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12328,i,16953818282483450288,13329316867896033877,524288 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17816 /prefetch:8
      4⤵
      PID:8396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=12360,i,15111126018325760912,13571732762481710552,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17860 /prefetch:1
      4⤵
      PID:8404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=12396,i,13327448476653704078,364624835782346160,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17876 /prefetch:1
      4⤵
      PID:8412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=12428,i,14018578357589143280,10441746009359920556,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17888 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=12440,i,12392631090473311551,6013022440130380044,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17984 /prefetch:1
      4⤵
      PID:8428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=12456,i,14618207357898297300,9348696355925767837,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17976 /prefetch:1
      4⤵
      PID:8436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=12488,i,1168185346932929748,10367653526326848545,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17960 /prefetch:1
      4⤵
      PID:8444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=12512,i,15097630030280008087,17350581585680627656,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=17992 /prefetch:1
      4⤵
      PID:8452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=12548,i,13211850412024495456,425615055279259341,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=18012 /prefetch:1
      4⤵
      PID:8460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=5900,i,8293084301113398215,2419259030765801881,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=18032 /prefetch:1
      4⤵
      PID:8468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=7968,i,11329721379915693113,903873122925057940,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=23032 /prefetch:1
      4⤵
      PID:8592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=12240,i,16895258279437551847,15464806475499518411,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
      4⤵
      PID:10468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=10792,i,14477368036396762246,8728263418971559032,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=10808 /prefetch:1
      4⤵
      PID:10660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=4964,i,12938787936883264523,17293491796020321623,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=23880 /prefetch:1
      4⤵
      PID:10700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=24008,i,16943199623640278534,2630554515859732939,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=18284 /prefetch:1
      4⤵
      PID:10792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=23776,i,1444686376722011802,14952907152210386586,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:1
      4⤵
      PID:10996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=24216,i,1482238369427699615,13829442060955936697,2097152 --field-trial-handle=2416,i,3584294458363021737,11450015632280818794,262144 --variations-seed-version --mojo-platform-channel-handle=24232 /prefetch:1
      4⤵
      PID:11232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2760

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe"
      4⤵
      Views/modifies file attributes
      PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3016

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe
1⤵
PID:5160
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3vjrxhz\19nbsatu.exe
  2⤵
  PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5388
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe"
      4⤵
      Views/modifies file attributes
      PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:536

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe
1⤵
PID:5916
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mqhqm9mt\pz90dek3.exe
  2⤵
  PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6052
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe"
      4⤵
      Views/modifies file attributes
      PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5200

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe
1⤵
PID:6100
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0az2a62\mnmv283b.exe
  2⤵
  PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe"
      4⤵
      Views/modifies file attributes
      PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5948

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe
1⤵
PID:5972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\la2vhy6m\klizqvej.exe
  2⤵
  PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe"
      4⤵
      Views/modifies file attributes
      PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe
1⤵
PID:1684
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q7lm3f26\6j3ya2f5.exe
  2⤵
  PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe"
      4⤵
      Views/modifies file attributes
      PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5816

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe
1⤵
PID:5540
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fbyd8neh\l7sjfr4p.exe
  2⤵
  PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3224
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe"
      4⤵
      Views/modifies file attributes
      PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe
1⤵
PID:5748
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9cb41xpm\8yecqyfr.exe
  2⤵
  PID:6208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6236
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe"
      4⤵
      Views/modifies file attributes
      PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6660

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe
1⤵
PID:6864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lk1dez9l\dtzq6lbu.exe
  2⤵
  PID:6936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6972
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe"
      4⤵
      Views/modifies file attributes
      PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe
1⤵
PID:6480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5zlhbch3\m7ezbcjd.exe
  2⤵
  PID:6592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe"
      4⤵
      Views/modifies file attributes
      PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6232

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe
1⤵
PID:6296
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p2wejnxn\qr9hgkol.exe
  2⤵
  PID:6368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe"
      4⤵
      Views/modifies file attributes
      PID:6588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6152

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe
1⤵
PID:6244
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gixwj9qw\pc0j9uhw.exe
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6720
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe"
      4⤵
      Views/modifies file attributes
      PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe
1⤵
PID:7212
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oe7lryh6\7sjxeswv.exe
  2⤵
  PID:7304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe"
      4⤵
      Views/modifies file attributes
      PID:7412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8164

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe
1⤵
PID:7644
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3frj893\rhuzcyrx.exe
  2⤵
  PID:7804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7904
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe"
      4⤵
      Views/modifies file attributes
      PID:8096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10924

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe
1⤵
PID:7752
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c9ljs5wz\if3wuump.exe
  2⤵
  PID:7740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe"
      4⤵
      Views/modifies file attributes
      PID:10620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:12076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe
1⤵
PID:8184
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzzszzpp\itisdizy.exe
  2⤵
  PID:11408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11496
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe"
      4⤵
      Views/modifies file attributes
      PID:11940

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe
1⤵
PID:10680
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mp5fbfzn\s6kk8li7.exe
  2⤵
  PID:8560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xuythiwf\fwn4xm1g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

17c7ca74-cbc4-4386-ba6d-8cdbe6d8c306.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17c7ca74-cbc4-4386-ba6d-8cdbe6d8c306.tmp
Size 11KB
SHA256 4da40b327c9f47b70bdee04e467f789294e64421caf4045cc9d9b14613e00fa0
MD5 d43e1bec8f58460ff80b7f522ceed2ec
SHA1 418b4fc68d37642ed86ab1e0067238d54aeab53f
SHA512 73b16dc9ecbb6e20c29f6c58178ef478d1e7812613ed6fd196f633ac8dd21a55bc9e92b38fad426db93ee8e735f1ad7b04588a0e38050e2ae0d90eeffcc56375
SSDEEP 192:sxZ6uRnjjl/fD9scS4eXEdpLhzuTjFr/W6+WNilCFVhdBFZYBV5qrTQRIg55mJ:sxZHRJ/fBscS8SFbRhNZ/sS
TLSH
T1E632C8526A3869774CDAE219FE14BB17E3F5502191E11E49EBFC9A2C04E76DD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 281KB
SHA256 38fc7a53fe5553b741b4eb08b3480d57adb1912eaac73ab7bb4b8b8c85af966d
MD5 c61a4457f8f071fc497e0aaed382d416
SHA1 8f30af17fd2495cfa617c9c5c058d5565de96f0c
SHA512 a1a1dee4dd96debbafdfbd19761aa8e922d6463c07882e78ce5dce3474b8a582a5ff7f0fab328b035c2de02445429e4e8f595710f4c3992b167621c8e14ef2bb
SSDEEP 6144:8PXR9dhPGJWp7xIrQCumRSUM837ZGZrKavj5hL:EbeJWRivrM83yXL
TLSH
T15A5422DDCC0401059ABE00589D9ED509DE2DF2BAFBCA29D7B0896B6E87016F317B3748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 43KB
SHA256 6e99b810ad4dcbaf34328873b99a6cbe465c7cb3fb324711d026e066edfe0496
MD5 1445302f1b96e71a00517027b95d3788
SHA1 87be7bb86e7474dbacbdec3cb680f43e16fa75c1
SHA512 c1d995df45f3601f7eff11c7436e5218bcdeb08e2a2da0f2776db6e0affb54e2c9a8e2424d42baea748c84d60ebb55fa7b4f99138d0d511f560934b4d306f277
SSDEEP 768:IBKXDmVlq2aQmGAvzE6OI15Um0DvfwA8qwJklj4UT9tQ/SZYKh9:IB6DmVlpaQm9vzE6fKvjCqYKj4G9tQOh
TLSH
T10A13F2D7D18CC8FCA62D01B9EA15FB847F17211BDD99CB1615B0FAB9648BA62310F5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 67KB
SHA256 aeae0da73139a235146c7e1a5605a969b0bed0743c2c06a272ee818329f48cc6
MD5 1a3e207eb153670f2c2385982d8a51e8
SHA1 d3b43669f9a94159bd9b8bb3a84efb6f6a02443c
SHA512 9cf1048da74f382aa5e40c4ea9cc2e6db854603745820687bde686b8d0e4dff59620a48f4f8d4a7d7dc664b0ab9e35e0691af306f238601ec3220c9ffcbff33b
SSDEEP 1536:yWor/EUuvPCdgVVidBZm9sxZUezwC77Tl:sr/EUuvRoSsx3MC77Tl
TLSH
T1CC6302A501357053D84F5ABECAC71B5E0CCD9975B0A9C6CBA59D29A33C3887874EABC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 105KB
SHA256 ceac3b0378fdb764f9e846c863701cb2f885c0e90aa7d5fcdaaba43e02e82e7a
MD5 58df8a94a629faef8722cdebb1b41967
SHA1 8a680ec10d596630e92dc1fbca20a7e84d7c3816
SHA512 57041c596317d5b657b9a24c461e8161c2cf4f2e04037a77e0d44ca0e8f7ced9d9897f72518619f84af02e7b2e620bcea4a101c51f07c36495d1d159c94fa6f4
SSDEEP 3072:WLBT9FH0lj+H8Wth2rbV83O5tYF8gqwRWU75Jw:WL9DJcwho881eLw
TLSH
T1A2B312A440C0B5B3BE65D9F1985FB01934EB730DEAEF91C626D4217B981083F3D4AE24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 93KB
SHA256 1fb85147bc3e20d7d904479bf80268297b9a8e6d83703f159669d4106c739e49
MD5 857b205879311ee9b174d600919f98d3
SHA1 786293fca88655f2dc03ba7278d34c3c9a3f2baf
SHA512 bc3a26297a04d06bf8a656886981f8d6bf0c79743ae091b0065e90a6402ac2bc853ee67e5951004ca173606922c682b28b4cfada8ebcd54e86d521513003f312
SSDEEP 1536:IGzW3idsmMUowl8CcBS3L5OHp2fwiTqxUigO627QngblC+aQ0E5l5SpX1svcuxLF:IKMidjMTpPB0bXqxVgUG+lzP3MJ6WrY
TLSH
T188930268F1A5149B444A32F116F62459EF11AB91F241FE8C2C6BB8F0EA764D31DF78B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 160KB
SHA256 be5a967d51ac263ccdb691505da56e748126920bec3283681318ae6e69897da9
MD5 dbdda61077e6fea442136d6fe60ed5d2
SHA1 301edef721032a4dd9b0a9be7c321e905f43beee
SHA512 cbaadc00a251033bf8d66e19a3f3e0da9ab5e6608bfd0c8ff9c1205901a41326f61250e77d7f0aa81435e10387986524833d27a6b3e7633fc152ce023673570d
SSDEEP 3072:y4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrWNoho5xtSfrIt1xJ9zLLoewpp2:yg6JDk3ZgtDn2po5xtSfrIBJ9zfZIoVL
TLSH
T190F31361E94C67DC53B8FDF20B2B2B149E69D0F846E0403865D3A5DCB8B44DA93ADD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 204KB
SHA256 fe430c6d63b02c7f262b8c47abf6367f229f0e7cbf1941c7287a8ef89b404562
MD5 461f60671c92135b4dd4163ef782097a
SHA1 63ea35fd3ec3fff026529281f4193fb3208d4afc
SHA512 36e867e82fec1817aa05c3e89aefddaf7a620e711c98031d9f89c137a00f3c1f126599cc56b6caecfb613c88a0fbdee720f38d6000974b8fcec664b85d08dab1
SSDEEP 6144:Oj8NBNT44jE6ZCWsesNXXPSWnBYZqS0pVyWp:OANB544/JWvSHv02C
TLSH
T1B82413368125862BC1D4EFFC04D8A57837FBCD5B750252D6A7B192FA102F3C66A32D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 219KB
SHA256 38099a60ec09576e1831e11a065c1f6a53cc7a1da92ebe772769df4501a2ca42
MD5 dcf251d67b6af1709572c2c4fb77fb55
SHA1 9ae867d4ceff4df4af6ff958601752e3986e7c46
SHA512 0c1bdff76abcea9f73dc3b19c0353b64a134f5b710412613a74232ed99268ff4b2a696ec7d52d6f4383e7b180a6861fcb68cd9abc6859e6e29d9b9efcfdb719e
SSDEEP 3072:Lbzi/rNmHnBtA4Xb7fgyWuF08Pz3gywjM5OBZ5H3Lb8ABAs+iJ6b34:/zi/Bk1bgoxbgywjM5O5X0AB/+i6o
TLSH
T1412422E1821223BFD258433B8BA0BCD7673B18B5C7E7AF908B89D94FD61938114571C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 21KB
SHA256 d87ee0accef9bf0955a0e85e7e458b19c2bcab2b0ad53f350d3d2b3b6f740f99
MD5 dade4f80440fada5643fbb9b1d5336cf
SHA1 fd6dc9e3ff445614f6627cfbf5418677e8d866f7
SHA512 9fe25a4981983059989e094370016a6b87700eab8feaeb0a6453a8f12bb5a32fa5b00809db98008bc2a7365db6287c786d19ad533c7ad7dc9fe9ab0eb8501b4a
SSDEEP 384:9iRzNDSyRnxox0WG8AC/qxc4ktq4JydBD0HKkW4hFbNW57tG0YO0IGRdtP99WzG8:9SRZnxU095xcZ4nWHKklVY5ZGbO9gTA
TLSH
T1C0A2E1A2F94FF5817E4A90322483C8F44CE5658A9F85ACDD8695CC81E11FA927BCD7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 92KB
SHA256 de8b043363106f77b0fb50cdc5c8b511736374767fb5e73746805556d246dca7
MD5 e3d1554c1148a311d92570741ad0d4b8
SHA1 9e690e1f8aadb69779f9b65db3c41565717b3e58
SHA512 dfe81aef983097e55bcc31322625120bc75aed0fa7f2bb78e09758eed3ad4ddfc992b10d072ca3df0ac410989178b8a48d467bd88e1f6a35640d9e21e4ddf6f3
SSDEEP 1536:ArB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwtkvLHC02U:M+dCdU1UKok0HaFA9wRw0YuoqsmGeqDe
TLSH
T1DE9302BDD72DBB4C403A9728678C91E704FB06FCE514D7860B98D3C6A13941B58764A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 26KB
SHA256 a983e0f95af54b58e1a15e228c06799be82f0fae9debf3afe8d5f2d1d82fda08
MD5 f2a2b3c1bb190cfe7c0e6dd0e9b51d71
SHA1 c24b7cd9218e600c890c30aab9cd5f19c14efd57
SHA512 e3d26c4e041eff323c6ac2673a81512cbe5e066cf5e43d90125a33ea7ab73c2d647c9abce44b0f859b1ed25ae3d654ed552cda0b2cf76dc55616aa05feaf7463
SSDEEP 768:QBN21TdIzYV1EG27V8ASjtyq1TcA25YBT:ngYV1J2ZWyq1J0YBT
TLSH
T1C4C2E177EE69034D8AE43C2A4E0D51784CF57B9F2C16FC806B15B81496E0EA729FBB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 08ced81ac859fc1942db6ab4d3ba645997cbaa35bf4b0569ba25c9af39091360
MD5 0a5b4bedf1ba23807fb104437d15c431
SHA1 afd5c611532f40635bde5ba08cfe86400879b906
SHA512 8756a6d0a1429d837c9df75b64f1f285a4298314c503cb7af719d473a09d8e1e611436cd279d4bd994c2eabc04324f54b163d23a8cafd807358bafb32c04c97d
SSDEEP 192:sxZ6uRnjjl/fD9soS4AXEdpLr2NyuTUFr/W6+WNilCFVhdBFZYBVErTQRIgyJ:sxZHRJ/fBsoSuJFbRhNZLsO
TLSH
T1A732D8526A3869774CDAE119FE15BB17E2F5402291D11E49EBFC9A2C04E7ADD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 da44fefcc3ebd725c93a0516c7a1ffec72e9b99072d25289042a78f0f348e49a
MD5 c8370a399512ea973b4d77e35b168026
SHA1 c4e85ea7f2d88422f6af0a800f261d0a6d77ad5a
SHA512 30e89e0fad8029d70adee03fe02c90221c8f0c0aa4aa9d88820c39f43a8fdd6a527347013ac6833e8b408ed7040e2c987dc7fa8345e7b2abf61d9f838807a877
SSDEEP 192:sxZ6uRnjjl/fD9scZ47XEdpLNNuTjFr/W6+WNiDRrVhdzRhYBVokrTQRIg55mJ:sxZHRJ/fBscZfoFbcLLhYsS
TLSH
T15A32D9526A3859774CDAE219FE14BB13E7F5502295D11E49EAFCDA1C04E76CD220BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 44689b02653ddb460fd966b30b2e7866d0ce2e0aeb54de53ddb8ffcc25634555
MD5 91c55b09757fb21a960626885638dc52
SHA1 252fad23882b0e496442ead80fd19b7b573fca63
SHA512 3a0844a1d55f830373d2dd803c3ba3faf4769931c4d443f2dc0268127cb245872e8038212cae5dfcb2889cbdec5c6f90b7583af4e4d5e4c85c025ca26d83b533
SSDEEP 192:sxZ6uRnjjl/fD9scZ4sXEdpLb+uTjFr/W6+WNilCFVhdBFZYBVBkrTQRIg55mJ:sxZHRJ/fBscZ63FbRhNZ/sS
TLSH
T18A32D9526A3869774CDAE219FE14BB17E2F5503191D11E49EBFCDA2C04E76CD220BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 00c3bcdaa468a6d837cd3a575c6d7c378d41b9a21a1c69438d98d845af4bde71
MD5 fb70b682ee9ada0c35f2bf7a1d3ad57c
SHA1 8989e404821e20ebf948d255d2e9870b44d6655c
SHA512 471374fef450d0dc0e75dcaf8ad16787cd17508239d4fffa3f6af82943ae80e5951d88f2c3c5f2107aec98886f332d9dbc0056e9d66645fccae2c28ddd296fc1
SSDEEP 768:/9qbUm+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVDZLlRTKrProu:/9qbUm+WvSCs6u1jacZLbWrcu
TLSH
T12AC2E93F340CCA7E4F801E9DDD5A6F972EA802C767588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 a4e03d07ad97d5b8f893ac82e636dd1dc78cddc65a6a38aeb214269f88ea812b
MD5 c94fd015c3925a1f67fc2b63ee795c9f
SHA1 fb20085342a37c9936b155d61633f2d6a7c90c30
SHA512 162550a468424da634e8d1efcc25c4616cdf885b043bcb243203d5fcc4472df75ea24fe7f67b3779ba2e8e86de3471a4376c5280f2aa05907bd9f52455fec912
TLSH
T1F8214C2131FA034C2C7E2E2C8194A41EA64130B734A7E42B7AA940750AF7E444EFE7CD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 e9febd91b8ee897648575b38b892734e340ad802c6d64c5a7c69689a65186785
MD5 57de958760913eaf3265d4aee9cea86d
SHA1 071e04f57968e151bbc423e2b267b9ef63ccaa13
SHA512 bd65fedc51dc29edff443e073fcbfee2dc3333e6089a141bcfd9b60a2c63f8cf5cb63aa135365c3b23587ff5b5f8833750a421092f72282ca0a4556435393610
TLSH
T19B215F2171F6034C2C7F2E2C8154A45E9A4230B730A7E42A77A900750AF7E445EFE7CD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 06294cfce684b68948c4b81f7504c75260b632208621524bd8d027ad11d88503
MD5 59fc0043319ddc1d54ab051e7791b429
SHA1 dea1e2933132cd0662fad44c3b1affa14840db09
SHA512 021e54cd2539cfd00c09e4d8fca34ad6dcd91a46b3b5e7d381359af93c967a5838ba8f44dd83d1aa30359f5efe9bfee52d6d328a90573d29f3211fb99fad003c
SSDEEP 384:n3ZcIwsNk23KWpgUVQEa+edyjEEDIyivI+aYUWoe:/wQKrURa30QdyiwlYD9
TLSH
T133827B311C789C7669EAA104FD8A3A579FF8A07799CD2F50E9DDCF1D0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0bc124093c77f93ce6cc4ffb1a98fdc857867a32ffa2d1a93bd6ce390dc2b743
MD5 37bf8bbd17f0d8f8cc7e03250171308d
SHA1 f7f8b190c1aeae1c5dba005fc2d11ab8b9a7dfca
SHA512 86e9200ee090c067d82778b202cb0989a568d5b79a7adb0741ecec35377e5480dc88202e8f0b45754f23049a8237ee59fd1e1c6feb844897e8ba8be9ff9d8764
SSDEEP 192:uu7FEsN2ZTQtD7OKXbiagJXQmiU14PT4IWG84tEa+jN+FdChHtFkamECrqdlIyLo:nmsNkT3KWfgKV0Ea+edyjEEDIyXRy
TLSH
T1B84208356878AC7659E66105F88B36939FE450B789C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 95060b2b45bcb37243f902a19c587987b3688e6143600c8bc2ed9a544edeb2e3
MD5 cb41e8378b55cb379b618210fe77a77d
SHA1 fb50a88e5e815128063906ed1953e80ebdeb9f52
SHA512 8bc82b2850402b5726a27b6098901d277ec73c464f8112b3ba70ebb894d78e679a544f635d92ea9332d2019b435ebb2cf7da231fa2fa0ab8887b5990a7b7a438
SSDEEP 192:z7FMsN2ZtQtD7OKXbiagJ1QmiU14PK4IWG8eqEa+jN+FdChHtFgNmECrqdlIyLqL:z2sNkt3KW1gDVhEa+edyj9EDIyXRy
TLSH
T14C4207356878AC7759E66105F88B36A39FE850B798892F54EAD89F0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b7c2cf5bfd8fd0b3d30bf0666c76a7d9b252088124c62b1e4fd2ab1a91984c3
MD5 7b950688d497c73648cc0e707a4727ae
SHA1 0c66f6988327dde9bcb7221e9dc5d69de4841d3b
SHA512 36120e628c09a6beae495b045a10a9225bf3abe5bb66939dbf8b577717b708085181b073f4c23391f75b1bff55175ecb63da58e1bf3e118e9df315326d115641
SSDEEP 192:vONu6Db6QmiUy4Pm4UHBa+jN+FdCtRg0pU6:vONu6uZWHBa+ed7AU6
TLSH
T13E02E83568786CBB9AE26D49F88737275FE4203BD99A2B54DADC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e05b8f576fb233b97db0ce046cd6a92028a46d1e89371d04ef774573da1bbeb8
MD5 b67dac239c746c7a32080140acf171c1
SHA1 61ac545eeda2476692b1df7f96db9176b4057379
SHA512 bdaa24280793f5804464f837f9905872b953044baad7f139023bc26f418c0b42472b81fde446ee9f041a7743fd2226ef92d32ef8e969121aa4aeebd74a6a3fcb
SSDEEP 192:z7ksN2ZibQtD7OKXbiagJwdQmiU14Pl4IWG8HrEa+jN+FdChHtFpNmECrqdlIyLT:zIsNkU3KWabgAVLEa+edyjqEDIyXRB
TLSH
T1F94218356878AC7759E66115F88B37939FE860B79C892F54EAD8CF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6fe28c38f7b90a3582a8f4a8e12961291afc09abcd7b201744375e72c3748673
MD5 d8cf94f1e5951c5ce6af484092d76be4
SHA1 b9e4d350efa69a7eb0a5be22968cd3f7be9ac68d
SHA512 c7fd3f3958932e93ad4bc4864809328fa0641e61a1b72fd88b8109926446595c7446f023fac0107cf8ff8950b28475f379f7da49669e502212a66a38be3e8d7e
SSDEEP 192:z7ksN2ZkbQtD7OKXbiagJAQmiU14PC4IWG8KOEa+jN+FdChHtFpNmECrqdlIyLqA:zIsNkS3KWqgLV7Ea+edyjqEDIyXRB
TLSH
T18F4208356878AC7759E66115F88B37939FA860B79C892F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 18822117d5021d59ac7774e9f4086b4cdf6aa53fa64e6336bd05184edbcd9cbc
MD5 eb182608b98a65fa45340a7999d7d977
SHA1 9d235036b9884c31b5fe102de99cf69e2003536e
SHA512 ca9f0fd720d32d1c3b3703744ff1de9f5bbee6a6fcbc9986efbab78c99e74590ffd2493d26133ff715c4a9f80d70865b276b60bce196226bea195022648ecdf0
SSDEEP 192:z7ksN2ZtQtD7OKXbiagJAQmiU14Pv4IWG85xEa+jN+FdChHtFgNmECrqdlIyLqyc:zIsNkt3KWqgOVfEa+edyj9EDIyXRy
TLSH
T1C64208356878AC7759E66109F88B37939FA860B79C892F54EADDCF0C00D769C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 14649faf215ee4374070e5d1c1479251c4d1b76516d2e434cd6a7a49fdd4136c
MD5 9dbdd371270e3d279fdfb9225735f239
SHA1 365066c8943e12be0909834434384bce38ee2251
SHA512 e2bf8f2d6bf9ae57b1d066523ce2ddf5d817a7932aed54e05eca8f666af9abd947e83184bad5f969e10265c3664b4d706c6d6b7b0797033d9cacf28ac38757f8
SSDEEP 192:z7SsN2ZtQtD7OKXbiagJyQmiU14Pu4IWG8l1Ea+jN+FdChHtFgNmECrqdlIyLqyc:zWsNkt3KW4gfVTEa+edyj9EDIyXRy
TLSH
T1FE4207356878AC7759E66115F88B37A39FE850B798892F54EAD89F0C00D769C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3f0ac59ac838fb10e2f3ec96f0934d447df68fcbf95953b92c474ecb9988bb7a
MD5 545ef90ded22ba0c3c10e58b9b06a949
SHA1 5a4973fd83350c4241eba4e1206a64f0bea95353
SHA512 1864b2359439dd0a1e0917ddfb4dbbc5df6ecc9a67aa14ebaebde492641f063d9ea9a5b887303135a00c93e05fcdec5286a0514e0346ce75a4eb7e5dc95e8062
SSDEEP 192:z7lsN2ZtQtD7OKXbiagJ1QmiU14P74IWG8GyEa+jN+FdChHtFgNmECrqdlIyLqyc:zZsNkt3KW1gCVhEa+edyj9EDIyXRy
TLSH
T1F342083568786C7759E66115F88B36639FE850B798892F54E9DC9F0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d1ac507e1d280b2668afd4159a5759cf84f59f9f558d9dd073a00d5b16e97170
MD5 77e7a529a679920c9a1950a697ad1a0a
SHA1 f4d7814275e07c7426b0a22061bf878a52627f3d
SHA512 cc4d8a3e2ce80a6f86008d91e78a48021ffca40b6b94605a6e8b5971c1e855b1981150c2aff52d871e1439fdbb4aec73901747b324491e9abe8b6f2a6f8080ca
SSDEEP 192:z7F7sN2ZtQtD7OKXbiagJjQmiU14PR4IWG8SbEa+jN+FdChHtFkamECrqdlIyLqL:zNsNkt3KWHg0VYEa+edyjEEDIyXRy
TLSH
T1344208356878AC7659E66105F88B37939FE860B798C92F54EADCDF0D00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7cac1b42dcba21f4d146aa34d2fe27d188a86b667594b115b3f91788b081caf4
MD5 f9edc791150d1f790e4e9311a6657a94
SHA1 9b75554d20002c951dbe82a67d51713e65a10660
SHA512 5e3c12a495e0ea24759afbd70bde5685b110e6093feec629238137dfd2e7fad9c88a613ec2823c57341008a4a206f5937bd446923028ee046c153ad761f1ad30
SSDEEP 192:z7FHsN2ZTQtD7OKXbiagJoQmiU14Pw4IWG8VkEa+jN+FdChHtFkamECrqdlIyLqL:z1sNkT3KWagVVeEa+edyjEEDIyXRy
TLSH
T10E4207356878AC7659E66105F88B37939FE850B789C92F54EADDDF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e85669b7932991d9e094a480cab30a82f9ab920a353552433f0c0c6dc04d9b65
MD5 7ea358a54e77769b5d744f2778526e64
SHA1 d01bb56e05e302af89c87c4c5067fcd3a6132bc6
SHA512 2f6c24d48d35ca3b494ccd0474c1140368a23d87d5f8d0fac17e0763bb6021d4bcabb990c5a6154370aec02b6e330fdbdb9d7e650c25cd8c8f4cb9b7da34a03c
SSDEEP 192:uu7FHsN2ZTQtD7OKXbiagJoQmiU14PO4IWG8qTEa+jN+FdChHtFkamECrqdlIyLo:n1sNkT3KWag/VoEa+edyjEEDIyXRy
TLSH
T11A4207356878AC7659E66105F88B36939FE460B789C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a000d01d57abba91ca9c2c85fcb7695d12731f131484deef005e5b925eb2878c
MD5 15eef6f6714f2288430a3f416f74afa7
SHA1 ed66648a46781593b75abb3dcb92097776aa7773
SHA512 23ae690cda04e3f848a2e4aa5c16ef8791f926f2352336e17f8c55a06681e24501e877d038ae32bbc8e1e54aa33efb7ee25de7786bfd4eb5c3d47d104d078b69
SSDEEP 192:uu7FOsN2ZTQtD7OKXbiagJmQmiU14PI4IWG8juEa+jN+FdChHtFkamECrqdlIyLo:nIsNkT3KWQgdVKEa+edyjEEDIyXRy
TLSH
T1514207356878AC7759E66105F88B36939FE460B799C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 27bdda351fbbe2f75e0751c255fb39ce725085fd311e731077389284cde777fd
MD5 8af0b4674c30a5cc0b18b0f47125eaf3
SHA1 b8506676b48634557ebc72368abbbfc1f36b2ba0
SHA512 b0ca5107778ea9121bfd629791099a9b891ceac31d3174e7ecac5f1dae814831f5514a7906d53780fcd9f8930b509b1b2befacc28672f71eee9831d2c6b25815
SSDEEP 192:uu7F9sN2ZTQtD7OKXbiagJmQmiU14PZ4IWG8zstEa+jN+FdChHtFkamECrqdlIyM:n/sNkT3KWQgMVzMEa+edyjEEDIyXRy
TLSH
T1ED4207356878AC7659E66105F88B36939FE460B789C92F54EADDDF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 50d80ea06cfb9586141cdff112086cb8cba80ccd4eea70f1b26a98e0b64ccf0b
MD5 3099e97fd35d410a81e60e143ff727d1
SHA1 68c3e36959d2d1b22b9551b24b2d6c15038fa855
SHA512 156c8b044c0161b887746eb34583b5a105c0861aba021c57cb6101bd79cdf291e28c7576f132de212f4257e14f3eefae0a095cef509f201f21104d680e7b7c7a
SSDEEP 192:uu7FPsN2ZTQtD7OKXbiagJTQmiU14P64IWG8juEa+jN+FdChHtFkamECrqdlIyLo:nJsNkT3KWTgTV6Ea+edyjEEDIyXRy
TLSH
T1B94207356878AC7659E66105F88B37939FE450B789C92F54EADDDF0C00C769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 caea3c59670828394d51a8b14a6dc179a73e13f4647ba27f37a2333de7d785e2
MD5 3751679158694d7f2316ab6a2dd930e6
SHA1 7fb3c6c432009e882c50fb70e93465208896791e
SHA512 a211b67989cb233b64061533c705a685af0c31eeea4262ae8f653f3baf34caf738d439a0f04d8b03133ccfec074c104d1b5d24b72b85bcc824ce6966eb20292e
SSDEEP 192:uu7F6sN2ZTQtD7OKXbiagJ2QmiU14PC4IWG8BIEa+jN+FdChHtFkamECrqdlIyLo:nQsNkT3KW4gLVCEa+edyjEEDIyXRy
TLSH
T1434207356878AC7659E66105F88B37A39FE460B799C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c0dc69dd900eb7811ec88fccb42835dcc2ce2a95c64f75e01ec96d4d142094a7
MD5 c8957507011a402384631e02d7a76226
SHA1 bda73c22fa7311594ab756e1fc9d2a1a7312d3c3
SHA512 b2e00048a15cb3dd1b62e42dca1f4e5f3ec597c65e9c5cddf7319412333546b0b0c1aaf0745472fbc2da1c36676bae5df6c1148e5c5d9409a01f0e6688918044
SSDEEP 192:uu7FysN2ZTQtD7OKXbiagJZQmiU14PL4IWG8WXEa+jN+FdChHtFkamECrqdlIyLo:nMsNkT3KWFgyVYEa+edyjEEDIyXRy
TLSH
T1904207356878AC7659E66105F88B36939FE460B799C92F54EADDDF0C00C769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 034b3d7f3ce444fc6de619be3db8d4c4da4165d7eee1bd33df0bb7d662cc9949
MD5 376ba7175677f661b50b0426188fa6cf
SHA1 9792bc5aa7ee6a6cf5fe8da75b9a47daad469a66
SHA512 314046aa64bf852728d861ee9276c642e1493572038db7078ea89e473b1e63eca0890816155634c43b01ea977002dbac3734e06de738d9ef7b2499185f401543
SSDEEP 384:nSZcIgsNkT3KW5gwVYEa+edyjEEDIyivI+aYUWoe:ggzK7wJa30QdyiwlYD9
TLSH
T1F2827B311C789C7669EAA104FD8B3A579FF8A07799CD6F50E9DCCF1D0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 74809dd138e3b11946d6badeffe69d9eff31651fe22803ec52646431df010a2a
MD5 0cc2ee65b93ec30f8793f43e66c12604
SHA1 d5cc8dd89568a75968861fe404c4388746735da7
SHA512 3385bb6eafcf3aeb46e0e482c402251343daac6774ce5318e620f6008a76d83848a47fc9e99009456279750ec2ed74a31eb58685c3fac7b6e761f8eb60ae0d5d
SSDEEP 384:n3ZcIcsNk23KWngYVqEa+edyjEEDIyivI+aYUWoe:/cQKtY3a30QdyiwlYD9
TLSH
T106827B312C789C7659EAB104FD8A3A579FF8A07799CD2F50E9DCDF1D0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83ee38b14f9919b30ba8007a637e014ec476ca64b5deba6a73764577466fc5a9
MD5 136191a93621e4d8a23de6aed5e8b879
SHA1 b6e4556945bf7ad3121e81e80c5e0739666ff1c0
SHA512 39072a75612aa8f36fe307ff3b980dd8018ddd85c814bd71eb38aabcc31caad1b3ebe68d36208626a83d5e04fb6e4c8cd8d7cca3caab0845d9b3323d5744aa58
SSDEEP 384:n3ZcIdsNk23KWsgpVaEa+edyjEEDIyivI+aYUWoe:/dQKupHa30QdyiwlYD9
TLSH
T1D8827B3118789C7655EAA104FD8B3A579FF8A07799CD2F50E9DCCF1D0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bdfafd1155d15c4e512096a473a4d8ef7224bed5ce1eff1ffb8cba5ebcc09b70
MD5 28dd670640cb51671c8eced72dc208f8
SHA1 0704b6f04957a1e412180f6c2294312058f16e6e
SHA512 20adbd4d94164fe72c14523444e4a30d29c1143866d284b76f87a9b1df4517f78b2d147f68271eae8c5c729ee4cfcb09f4fd658e006ed18ce31a4aa6e91db08e
SSDEEP 192:z7nON2Z6DbiagJSdQmiU14Pu4IWG8T/Ea+jN+FdChHtFpNmECrqdlIyU9:zzONk66QbgfVzEa+edyjqEDIyU9
TLSH
T13D2207356878AC7799E67508F88737939FA820779C8A6F51E6D88F0C00D769C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3c301f7d5ad8b4e469e00540d4c34243197a182ab085f5a8e43d6075280d6c71
MD5 9b163eefe206a3670817227a3e92fd3d
SHA1 81c141def4fb28af311287a3054b32d851934a78
SHA512 8b616d6cc6f1328cbb46f868dabacee5f42be5fc96d2da9014d187c5a4254c38094a27e31dd306261c77d1728f8316da29260d9b7816abd6cd0e268219b3370a
SSDEEP 192:z7FpAsN2ZtQtD7OKXbiagJCQmiU14PL4IWG8ExEa+jN+FdChHtFkamECrqdlIyLo:zksNkt3KWcgyVoEa+edyjEEDIyXRy
TLSH
T1C54208356878AC7659E66105F88B37939FE860B798C92F54EAD89F0D00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 89264b6354350bc426b29120546863327c199e016d3fc460e606b11f5f363270
MD5 7b907d286e83769e66d0e35b48fef62e
SHA1 713be45a37cad6d72204f2e10cca045db68c9ab7
SHA512 cddec0939ed5fb877c1f563511a888a6976793a3c0f5b1d69d997f9e5f65dd9bdc15073572d7d04b17031ca21cb1c71417d8ab34dae508b9fb1ace2cd723500e
SSDEEP 192:z7FpAsN2ZtQtD7OKXbiagJjQmiU14PM4IWG8hoEa+jN+FdChHtFkamECrqdlIyLo:zksNkt3KWHgJVmEa+edyjEEDIyXRy
TLSH
T1714207356878AC7759E66105F88B37A39FE850B798C92F54EAD89F0D00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 28422eaef77459654f07b1ab3930bdb03bcff494e4eeb2d8c44af14bba13a20f
MD5 eb2d09f5655b4049f51951582bb6be6b
SHA1 1ce0cb623f2deb8fc4dcd3e39b375549ac7601b7
SHA512 ccfcaf9676d381ea7c647d93279ba7850cea5b0735e6bd2e948468a2d7fe4089c6cfcab2225ae162b3422d6c40d68f02a2a55f6bcb5c432455d72c2dacdf2674
SSDEEP 192:uu7F6sN2ZTQtD7OKXbiagJZQmiU14Pv4IWG8y7Ea+jN+FdChHtFkamECrqdlIyLo:nQsNkT3KWFgOVYEa+edyjEEDIyXRy
TLSH
T1A04207356878AC7759E66105F88B36A39FE460B799C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 527d90e4cb84104ac0a231b861c9f0e42253c5a6f749b4d752df2d1249cf994e
MD5 a312345c74de3e7387449643e372cb2c
SHA1 6e13a10ad5a46e2ecd862d005d634b2b3ee34cd6
SHA512 92e43edb1edfb1b15ed32ab2fab22ba3bb55224908606eb2239ea62e50f78987506baa32d67eb3a43a3942c9ee4a7e5acdb9eef484bec660fb6a7f33bf032614
SSDEEP 384:nSZcIcsNk23KWxg5VWEa+edyjEEDIyivI+aYUWoe:gcQKL5za30QdyiwlYD9
TLSH
T190827B312C789C7655EAB104FD8A3A579FF8A07799CD2F50E9DDCF1D0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c5f7298b620f1f8c4b8db4aa00151c8f72972812cc3e190b40092424d1b46978
MD5 1ab91285561b3534853064a45167ef21
SHA1 21f5ac69ca2d0f832b6506a7a24243d3ef0c7ccd
SHA512 02dd1280453722df4f93fd9b05963ad7a4de5875b3d5924511d1f37b5d284e8c9223236463d1107d95fb5ee5b316877da55c9d76f3525de822a16258f8e0d23b
SSDEEP 384:n3ZcIusNk23KWngjVYEa+edyjEEDIyivI+aYUWoe:/uQKtjpa30QdyiwlYD9
TLSH
T19E827B311C789C7655EAA104FD8A3A579FF8A07799CD2F50E9DCCF1D00D6A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d54326edae4d80be693e1e63ccacbfedaa31a2d2fa5297dba5fdad74cde47b27
MD5 297b883ee6af2c17accaf1f379009a37
SHA1 798415d85608c2786eb27c0da686ac32f31e26b0
SHA512 589c463a9cc8388e361f188b9eaf137aa82a467c8bec1e7e05b16a618665324138a3bc19ca61b53cfcb133ce18d40dc4c1586c99b8a5afbdfaf2ff45f421a184
SSDEEP 384:nmZcIFsNk23KWmgawJCEa+edyjyEDIyivI+aYUWoe:0FQKMawba30OdyiwlYD9
TLSH
T1FC826B311C789C7669EAA104FD8A3A579FF8607799CD2F54E9DCCF1D00D6A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7162de6f8d988cbb194c44d5fe730c94324e1a4d82c49d096bd1df0614c112e4
MD5 40bf4d77428f65809d640b3c58e640f9
SHA1 916fbb7baeb855382c66f96e472ba9b1b39eef71
SHA512 9a2f5df11d4bbad9aa3167dc8a33db49e21d6479ede84708d7469f618e5ff97281a9a414e1c706c7f7bfc3b06633d90f9be42de12ddf0bae923672a40fb466af
SSDEEP 192:z7nsN2ZTrQtD7OKXbiagJwdQmiU14Pg4IWG811Ea+jN+FdChHtFpNmECrqdlIyU8:zzsNk/3KWabglVPEa+edyjqEDIyU8
TLSH
T1C932F9356878AC6759E67558F88B37939FA820779C892F55EADC8F0C00D769C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9401543540074945f74dcdd0e6f389b6a7fa1a44c1fcefde3b65701b44acae06
MD5 dbbda0b0645637c477cb2f62644d88c7
SHA1 e5231dc774fbdeaa0b917b306df8f2b9ae9972ea
SHA512 0ea02980c901eb35b25f617651b036c3ef0500c213c4657aadb69e336fb26818f1982424461901dc24aa20c17ed131327674818073d4501d2cf2799811c6d8bf
SSDEEP 192:uu7FssN2ZTQtD7OKXbiagJoQmiU14Pb4IWG8ZAEa+jN+FdChHtFkamECrqdlIyLo:nesNkT3KWagiVGEa+edyjEEDIyXRy
TLSH
T1CF4207356878AC7659E66105F88B37939FE460B799C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f594049d3c7ca0999dd75612793e342a64116a1f46cab1562215d81dc3aae18e
MD5 da7003b0d7829ae340c3febf105e9174
SHA1 97811fe6a848fddb0716fb5634af5ac392d03a38
SHA512 e240457ff2933eb34c8a151e02dae765376bb8a12d11725a13abaca9bc9ceb2bded96e95a613f72029dd3c6489973a8a7163043dc0da1dd16cfc619b8aa75983
SSDEEP 192:uu7FEsN2ZTQtD7OKXbiagJTQmiU14PG4IWG8X6Ea+jN+FdChHtFkamECrqdlIyLo:nmsNkT3KWTgnVKEa+edyjEEDIyXRy
TLSH
T1554208356878AC7759E66105F88B36939FE450B789C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4f81185ddf8fbfa1e780a5e07bb1ec0668b495168fefc1a64fa3d5e98a74de97
MD5 00e33cad37039a8eeb0a1e4af7a224ff
SHA1 e95948673463c8cecd83e3646fca7341a56b4cd3
SHA512 27aae2581aef4a65828ff3ecece06efb81fe956d8e48b9b1cce947be566c9458dad0dadaedeb8c9a2c10cc530dc8ea72edaea05b4b1095831d09c94d0f05c1cc
SSDEEP 192:uu7FPsN2ZTQtD7OKXbiagJ2QmiU14PW4IWG8CLEa+jN+FdChHtFkamECrqdlIyLo:nJsNkT3KW4gXV0Ea+edyjEEDIyXRy
TLSH
T1B24207356878AC765AE66105F88B37939FE460B789C92F54EADDDF0C00C769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 919c46e2af1ad88a7829feaaec4cc7b70898df9d07259c231b23296ccbedb773
MD5 c1139bae4d8f9d4fd46928d3e5de9c8f
SHA1 7ec5aa863813666a5137eb3bc52eeb77efc2a2b7
SHA512 b5b8571c6f038b3c3eafa2e4a0c46c001c59687f17ed408ae56e8d8190ed6f5c20c55faad251eda79c1683726cfb0d6830cc528151838ea67cc928df60e8ef53
SSDEEP 192:z7FBsN2ZtQtD7OKXbiagJ1QmiU14PN4IWG8D/Ea+jN+FdChHtFgNmECrqdlIyLqL:zXsNkt3KW1g4VDEa+edyj9EDIyXRy
TLSH
T1D14207356878AC7759E66105F88B36A39FE850B798C92F54EAD9DF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a571aed5404487637a34063c7a3bf6a168dfd433a9a1777423432cddac378add
MD5 f3b8732b1f4e9f787815b8469f3c913e
SHA1 dfce2d87376dde1da1f949fb381864e7a9ce41a5
SHA512 3ed602db98489c4db86cb6415d46fd95788640ec09a169f4e92ee99e1d25e46d92fe29a858f7919f0c5ae8dc78608bf043c4830e08f89798afc01a832613c707
SSDEEP 192:uu7F9sN2ZTQtD7OKXbiagJXQmiU14Pf4IWG8FUEa+jN+FdChHtFkamECrqdlIyLo:n/sNkT3KWfgeVqEa+edyjEEDIyXRy
TLSH
T1B34207356878AC7759E66105F88B36939FE860B789C92F54EADDDF0C00C769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 210bf99a6b778c4370f337082f4fe321586372459e8170f2bd32b3e943c67e67
MD5 ea21a429a9fb36a82a2d7b886980cbaa
SHA1 6c8f9997c64ab68a1e49f8b37a95c41587858d49
SHA512 b713df8311de5b8833b5c0e44e49ec94d0c7ce25a13df6dc4589f9fe937e8bb6359305a0ae30fe74afd0adaa6925d51ebd24565c623f0fb1be732b1e7e7c13f5
SSDEEP 384:nGZcIYsNk23KW1bgNwJ4Ea+edyjEEDIyivI+aYUWoe:UYQK/NwNa30QdyiwlYD9
TLSH
T1CA827B311C789C7669EAA104FD8A36579FB8A07799CD2F50E9DCCF1D00D6A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9f82f3ce71f3ad64b0af30b5baf1ba707167fef83dac92c7c565650ed9a79ed7
MD5 656d6c8dc117b182c43576cc1db9be0e
SHA1 b82bf7938549e236509ce5a0dea68792e0716559
SHA512 e9f9a39f8928dacdcb26db5247341829751c50c3fb4e75ca9c1c604888b9d48794e1b41678e2aad3271f56a8b5870347731f7ced5961299bd493fa5a4b522040
SSDEEP 192:uu7FysN2ZTQtD7OKXbiagJrQmiU14PZ4IWG8HqEa+jN+FdChHtFkamECrqdlIyLo:nMsNkT3KWHgMVKEa+edyjEEDIyXRy
TLSH
T1574207356878AC765AE66105F88B36939FE460B799C92F54EADDCF0C00C769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 40c62d3598ef1d707f589d1173be65c80ae73684fcc3f3dead132863203a1b5e
MD5 a71cc64665794ab7a1c85cb45e078388
SHA1 e61047259eb425bfc52812bc9e6ba7da32647b32
SHA512 5f8b972f71e43c0b5e66cd1d6f1ae401948b0bdff5368811b91e75951e282fb2b616936ec622dc642d837d5b69051340b4f918495c6fbfd4cf50088447a853fc
SSDEEP 192:z7nON2Z6DbiagJSdQmiU14PV4IWG8WyEa+jN+FdChHtFpNmECrqdlIyU9:zzONk66QbgQVDEa+edyjqEDIyU9
TLSH
T1F222F7356878AC6799E67548F88737939FA820779C8A6F55E6D88F0C00D769C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 607dd757c5f334fb244031f74bbc09c6669fb81ca8cc07a79f2a1ec37fc5eb08
MD5 bb5aa6254d83204beca3fff361bb4753
SHA1 8f0603eb43049f47a8670bd5423a6e4c373651b6
SHA512 7b1a59bd090fd489af642783b97d57877d9ecd74159b1fe753f16af398bbb09c86dad1c8235ebaa3a50f2f2815409a355f1ba9cfa84b089c9b42a50ff7f0cfb6
SSDEEP 192:GnON646Db02QmiUy4P14UGHBa+jN+FdChHtFpNzECrqdlIyU6:QONl6BZBgBa+edyjfEDIyU6
TLSH
T1C712F8356878AC6759D27918F88736939FE42077DD8A6F51E6D88F0C00D7A5C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fc8b5ff5e39ee85f572c4a712b5c4e94f256956dafad79db049edd48d818eb17
MD5 6d42ee5fa5b4bcf4862c3537d82b8bfe
SHA1 c0cbba344160429fa594b79bce3cd2d41b05374a
SHA512 133351c13c65afab6221f600ab37f35bbb638f53977a31ef07256ccc4d7d6eb1486b7c80bb94aa3fa272f1ee702621a5923ef4b1fcc31cf5d4857b3776b6724f
SSDEEP 384:nSZcIssNkT3KW5g7VaEa+edyjEEDIyivI+aYUWoe:gszK77/a30QdyiwlYD9
TLSH
T1D3827B311C789C7625EAA104FC8A3A579FF8A07799CD2F50E9DCCF1C0096A98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 db8e87bc841bebb7be54c629708a6bf4242d9801fa7b3482f8ba6992a68baf33
MD5 022c7fbf4cb05a717eb547dc9c8662d8
SHA1 d44152d170bc88efbcd259f75da2ca7dee16d0a3
SHA512 17e2efb7bdaf839ecc27014b74a367fb0c384f7fb89930d4b078ba7670350d24bc57b51e3fbdc9f3d56d9dc73303cad1aee90482f95d35c54a1cdeed318f6839
SSDEEP 192:z7nON2Z6DbiagJSdQmiU14P84IWG8BZEa+jN+FdChHtFpNmECrqdlIyU9:zzONk66QbgZVfEa+edyjqEDIyU9
TLSH
T10022F8356878AC6799E67548F88737939FA820779C8A2F55E6D88F0C00D769C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 64ad371678e761e70c454889b666dd9417496f478ff1db00024179ab4943238d
MD5 58ddb6a68701465410649181f0422db0
SHA1 569ed49eacdb1c0ba6ec65578ddec87ca761d0aa
SHA512 5374d24cc55f596468a190f5d760019303bc8320f4710a73a0b774cde7fd3240b5adf1809e9e8cb42f5db4bf4aeba4ba9c4a232669aeac7a40a034e656515980
SSDEEP 192:z7nON2Z6DbiagJSdQmiU14P74IWG8P8UEa+jN+FdChHtFpNmECrqdlIyU9:zzONk66QbgCVPHEa+edyjqEDIyU9
TLSH
T17322F7356878AC7799E67548F88737939FE820779C8A6F55E6D88F0C00D769C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 64a54268a4c09f4708a077843abebd3b85a832dc0c4d49c4f1e64351ae921631
MD5 b1eb9765d5edcd41bb51ae4d1e275749
SHA1 8ed62481ba6b40dc4d6f3e4e43c12e03480f2b1e
SHA512 9d070f6c8118c4ae68dce1f4b1b434fdad7cc8ad9eddc3141253e371ae015399bc4998a0cbf48b5f901ae5865f8f23aace0993358efb2fd864d03f82c195984a
SSDEEP 192:z7nsN2ZMpQtD7OKXbiagJwdQmiU14Pw4IWG8ogEa+jN+FdChHtFpNmECrqdlIyLa:zzsNkMp3KWabgVVPEa+edyjqEDIyXRA
TLSH
T1E242193568785C7759E66115F88B37939FE850B39C892F54EAD8CF0C00D769C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b309a815-394d-41bb-80c5-05add3c6bcc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b309a815-394d-41bb-80c5-05add3c6bcc9.tmp
Size 12KB
SHA256 91ac01414319f7595226357320d0af87b92773bffc7feea80f9025362cd4fcc4
MD5 7a8f79bba569292e2b4c216f0105fefa
SHA1 23c3ccd133394fafca1a262aa417ee31878bc226
SHA512 c8b0b19d87fb3f5dff14df81b7f704829139ee8e79753ccf5731a8c0edfab8b3f6aadadb47e683f27b982af61b34ed97503c1c2dc64b1af2348dafc73dcd6762
SSDEEP 192:uu7F1sN2ZTQtD7OKXbiagJrQmiU14Pm4IWG8KzEa+jN+FdChHtFkamECrqdlIyLo:nvsNkT3KWHgHVoEa+edyjEEDIyXRy
TLSH
T14E4207356878AC765AE66105F88B37939FE460B789C92F54EADDCF0C00D769C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2213788-c40f-453f-b99b-3cae9967f7c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d2213788-c40f-453f-b99b-3cae9967f7c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c002926e87f77936e17e2725b69cf9eb2ba41036dd1935658afd5c9674acd4f
MD5 433b95ea48bdffc23172fe866119bb86
SHA1 ab2afc1c975a908eda4e28cd614c09f684b9038b
SHA512 1d656750f28b206a5e6436d8bb1d36a088d7b2ab075ef61ce511dfb94e220754bda836f1e94378c025879e270d151f6a9b9989abe500c555183956646c5bede6
TLSH
T17D41F698A6FD1104B3B77F5AABF6A86E447BB9772E06C49E10110D4F0A26B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

3460b6a9-5bb3-4cf5-9291-0174d4da57a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3460b6a9-5bb3-4cf5-9291-0174d4da57a9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

829dcc9a-6861-460b-ab99-3d58f97bad07.tmp

Path C:\Users\Admin\AppData\Local\Temp\829dcc9a-6861-460b-ab99-3d58f97bad07.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\base_library.zip
Size 711KB
SHA256 d11c3fa29703ae3d80b84ed8b1e342d8cf8255950deb974fca42a13da49b7c44
MD5 4035f4026cb96567d71a19b11c360556
SHA1 3db2f27a7a2995bb6b56e86a905d5183add937fa
SHA512 428402465a13a138f9c365cf0ad18b41ed4c7959d79e30b8074f8fbb927e4f5506c3c913ae3b329dc2aba07c8cb8785bc2fe6b559626ad7eba0d1d2a47d1179d
SSDEEP 12288:IfoQDS6Q2osQNRs54PK4I1/WV0cxhRoaxwk1yfyEL1dYcV:eoQDS52osQNRs54PK4I1/WV0cJoswpf5
TLSH
T1FBF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23402\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fd0367b-6ba2-42bc-a7a2-e73d36d90e92.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_160155147\2fd0367b-6ba2-42bc-a7a2-e73d36d90e92.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9vrfbbdb.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e0gn6uw4\9vrfbbdb.exe
Size 5.4MB
SHA256 bf2d75f042e713eae3bea6cd0bba4a58b27cdac8d8fbae6b1c467ad95d6b91d8
MD5 34d68b50ef78ed4b31f00497ee7115d0
SHA1 b826d7e4a53e1c9819277db3d66980c0286bf057
SHA512 9ccdd4a09fc8d4d56aa8eb18816baa1e7bdbc077a5ad79e7e203280e0284b3b451ecb1ef04ff468ff7da71d29e105940648427354a508dfb5bf422768b71a537
SSDEEP 98304:5igtRgpH1/GICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll9HNMzQ6nL:F+f/GICteErownP0oTcMsABqlSvL
TLSH
T1F0463308A3E809E6F6B3E13D85565221D873B4254BB0D1CF03AC9A661F677E0AF7B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5256-736-0x0000023A49F90000-0x0000023A4A2DD000-memory.dmp

Download

memory/5536-994-0x000001DEF3C30000-0x000001DEF3D44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads