7dccc553804496fa73f5be1df23e2e66edd5fc71a50fca841692fc5cf6754e62

Analysis

max time kernel
5s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260910-13mdeshl9z
SHA256 7dccc553804496fa73f5be1df23e2e66edd5fc71a50fca841692fc5cf6754e62
MD5 ea3db137a99f262ada27ea571749ddd5
SHA1 03eb615d15a1e46430b265362436d40d733ddc4b
SHA512 3571fed16e487f70002eba5063929801dc18a12daaff36fba823eb5ea2669e6c3c7b3f07d3e95925b819ba83ea6f33d2875e2e361e531fefb98e9dac4b576ee9
SSDEEP 98304:mAgtD/lICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlollloHCZMet68AY:CZICteErownP0oTcMsABqlwJ8D
TLSH
T1DA463308B3A809E1F9B3E53D85565221E5B3B4254BF0D2CF43AC96662F677D0AE3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgkjag.exe	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgkjag.exe	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes dropped EXE 2 IoCs

pid	Process
2424	0moe7pe1.exe
5192	0moe7pe1.exe

Loads dropped DLL 13 IoCs

pid	Process
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5192	0moe7pe1.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\ogjgf6ny\\0moe7pe1.exe"	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
659	ifconfig.me
12166	ifconfig.me
13336	ifconfig.me
297	ifconfig.me
330	ifconfig.me
460	ifconfig.me
1319	ifconfig.me
3445	ifconfig.me
6569	ifconfig.me
7576	ifconfig.me
743	ifconfig.me
754	ifconfig.me
873	ifconfig.me
2111	ifconfig.me
13842	ifconfig.me
285	ifconfig.me
7643	ifconfig.me
14682	ifconfig.me
1049	ifconfig.me
3325	ifconfig.me
142	ifconfig.me
1546	ifconfig.me
6257	ifconfig.me
7384	ifconfig.me
7733	ifconfig.me
13156	ifconfig.me
904	ifconfig.me
2853	ifconfig.me
5890	ifconfig.me
6535	ifconfig.me
8636	ifconfig.me
14629	ifconfig.me
1368	ifconfig.me
2224	ifconfig.me
3407	ifconfig.me
4406	ifconfig.me
7835	ifconfig.me
9577	ifconfig.me
6548	ifconfig.me
7333	ifconfig.me
11837	ifconfig.me
1834	ifconfig.me
1091	ifconfig.me
4995	ifconfig.me
11972	ifconfig.me
471	ifconfig.me
1742	ifconfig.me
2782	ifconfig.me
8240	ifconfig.me
12125	ifconfig.me
14867	ifconfig.me
15232	ifconfig.me
2837	ifconfig.me
14772	ifconfig.me
412	ifconfig.me
1256	ifconfig.me
1886	ifconfig.me
2549	ifconfig.me
5591	ifconfig.me
50	ifconfig.me
12444	ifconfig.me
14085	ifconfig.me
381	ifconfig.me
691	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2920	cmd.exe
5020	cmd.exe
1960	cmd.exe
6508	cmd.exe
6964	cmd.exe
12176	cmd.exe
3276	cmd.exe
5852	cmd.exe
6280	cmd.exe
6840	cmd.exe
6148	cmd.exe
6880	cmd.exe
6636	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5688	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4812	3200	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4812 wrote to memory of 3276	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 3276 wrote to memory of 5956	3276	cmd.exe	92
PID 4812 wrote to memory of 5688	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4812 wrote to memory of 1924	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 5688 wrote to memory of 4748	5688	msedge.exe	96
PID 4812 wrote to memory of 2852	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5688 wrote to memory of 4696	5688	msedge.exe	98
PID 5688 wrote to memory of 1448	5688	msedge.exe	99
PID 5688 wrote to memory of 1448	5688	msedge.exe	99
PID 5688 wrote to memory of 1448	5688	msedge.exe	99
PID 5688 wrote to memory of 4840	5688	msedge.exe	100
PID 5688 wrote to memory of 4840	5688	msedge.exe	100
PID 5688 wrote to memory of 1320	5688	msedge.exe	102
PID 5688 wrote to memory of 1320	5688	msedge.exe	102
PID 5688 wrote to memory of 1320	5688	msedge.exe	102
PID 5688 wrote to memory of 5452	5688	msedge.exe	103
PID 5688 wrote to memory of 5452	5688	msedge.exe	103
PID 5688 wrote to memory of 5452	5688	msedge.exe	103
PID 5688 wrote to memory of 4440	5688	msedge.exe	104
PID 5688 wrote to memory of 4440	5688	msedge.exe	104
PID 5688 wrote to memory of 4440	5688	msedge.exe	104
PID 5688 wrote to memory of 5848	5688	msedge.exe	105
PID 5688 wrote to memory of 5652	5688	msedge.exe	106
PID 5688 wrote to memory of 5848	5688	msedge.exe	105
PID 5688 wrote to memory of 5848	5688	msedge.exe	105
PID 5688 wrote to memory of 5652	5688	msedge.exe	106
PID 5688 wrote to memory of 5652	5688	msedge.exe	106
PID 5688 wrote to memory of 1328	5688	msedge.exe	107
PID 5688 wrote to memory of 1328	5688	msedge.exe	107
PID 5688 wrote to memory of 1328	5688	msedge.exe	107
PID 4812 wrote to memory of 2692	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 5688 wrote to memory of 5996	5688	msedge.exe	272
PID 5688 wrote to memory of 5996	5688	msedge.exe	272
PID 5688 wrote to memory of 5996	5688	msedge.exe	272
PID 4812 wrote to memory of 1332	4812	2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5688 wrote to memory of 2456	5688	msedge.exe	111
PID 5688 wrote to memory of 2456	5688	msedge.exe	111
PID 5688 wrote to memory of 2456	5688	msedge.exe	111
PID 5688 wrote to memory of 5924	5688	msedge.exe	112
PID 5688 wrote to memory of 5924	5688	msedge.exe	112
PID 2424 wrote to memory of 5192	2424	0moe7pe1.exe	114

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7112	attrib.exe
4116	attrib.exe
6744	attrib.exe
5956	attrib.exe
4788	attrib.exe
4944	attrib.exe
1256	attrib.exe
6904	attrib.exe
6548	attrib.exe
2364	attrib.exe
6776	attrib.exe
5036	attrib.exe
6336	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-09_ea3db137a99f262ada27ea571749ddd5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe"
      4⤵
      Views/modifies file attributes
      PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x364,0x7ffa777fc188,0x7ffa777fc194,0x7ffa777fc1a0
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,49550575760631608,9758373881985339114,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      System Time Discovery
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,10029846748048444104,12357211054273439611,262144 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,6676021948688927386,7387668069700154092,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,353274635758791817,8435807151539485359,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,4570922190986656329,12902708461604160074,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2415663478321899689,9199131147306419574,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4540,i,5177601006756807182,10588260125567933816,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4392,i,11439766077016832747,16875089658629461145,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,4267806566738941816,10877438486832879961,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3932,i,8830327653355660820,310904361091061882,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5740,i,17630328692001369884,5626540304211138788,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12552496562525937816,6574652172740983211,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,272939331051626137,6563623074691762621,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,12139454800470282500,10118615875378745930,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6476,i,10296101941806257647,14858990540702160680,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6504,i,15786186847040713316,11299286697508569734,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6808,i,1984528557254795689,2580320374446675803,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,874017388928181805,9684162805149297117,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:14
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,874017388928181805,9684162805149297117,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4384,i,5537765272057560533,14171105177900694864,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6664,i,8194532803728439186,14403665286739058125,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4080,i,10819664083346296979,12646226341594052596,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7052,i,7067574522866495502,9952355491744785815,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7120,i,11394240576170163704,18351882892144750993,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7064,i,14504587670503808850,5335073160799535257,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7596,i,9179368223529545736,10098682154267347093,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7632,i,2189029016909385203,11566553321021427048,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7652,i,379117931329258897,2932425025922505263,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7704,i,17922291278115807416,17140608428505116485,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7784,i,12373953971135470605,13153279929734277991,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7756,i,4475769537319884722,2778905637244102333,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8020,i,522268690327331343,13562860408368135807,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8120,i,6457677720195912595,90335941086001445,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8088,i,614254956886089715,5402959235532046214,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8148,i,12297360121346510659,9716298739772718301,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7156,i,2355558212210559468,16243106682369778289,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7112,i,6114903940253602054,2694730537490030796,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7624,i,17530010296168170583,4785017042337031548,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8364,i,6679392587342397374,656772778729141329,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7972,i,6950948140950285983,8696441700357484687,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8068,i,666125084474695345,9535587083451726560,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7940,i,16445166607299235889,7930388156377670451,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9612 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7688,i,8180988663893966235,15780565256009654759,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8184,i,8325142546885279427,4924773525891332013,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8376,i,12368717005317982737,6268746539231215631,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8224,i,7235169304289144013,6844989932355272851,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8136,i,4654784035583005196,872930929450295734,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7984,i,11513178060279393435,9559791445568871736,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8488,i,3523165975989333758,7748468841912848742,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9772 /prefetch:1
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8336,i,1523860209760900484,17093058638950605610,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:1
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8408,i,18025300317606688782,2982243441629209966,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7980,i,7728308338153105862,2232741563787649915,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8476,i,4401002560476809932,7852391681576103579,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:14
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7964,i,6381487825842944170,13928570826112529601,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:1
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8648,i,4865907154386658432,9638695490288623974,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8404,i,18258188578344193130,10840649130151146037,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8312,i,18089433507554692982,14703557708583730100,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8340,i,18314443725644185582,4055737363956307214,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8732,i,5830006247402972785,4709319554126722409,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9904 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8660,i,6634118850368055287,12223347302559548144,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:1
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4244,i,14377384278199916031,9509707671458254753,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8724,i,6747052137434115892,14663185106483162717,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
      4⤵
      PID:7276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8752,i,12562421028046445272,18151790549040518224,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11024 /prefetch:1
      4⤵
      PID:7284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8784,i,7703676645546785378,13802066984553538122,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:7292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5684,i,4183216747194050291,8899178566872354717,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=5368,i,15966162819994587873,10602009088864313295,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=4432,i,5647313697040791515,9263260368231307192,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8984,i,17420820403184092584,12759921418962001201,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8932,i,17600995848929291552,7166459429430887081,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11036 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9096,i,3322289572967752018,6231521165126972531,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11168 /prefetch:1
      4⤵
      PID:7388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8668,i,7470476600080456178,10092734432881545349,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11008 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8812,i,3482780574847983437,11117118148626781669,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:7300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8868,i,6209573111110596838,17691523382601368420,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:7308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8836,i,12932863867871681659,16245814606418559127,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:7316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4408,i,6546028666847985814,10635871389082439571,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9080,i,10223017494237251541,8479591830710889702,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11148 /prefetch:1
      4⤵
      PID:7380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9040,i,13917956362925084960,7715061872123246932,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:1
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9016,i,9309360619847818971,5137842839220912730,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11108 /prefetch:1
      4⤵
      PID:7396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9116,i,7922001010123858195,13424702743649761972,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9188,i,3642547739238140873,1129974453019769500,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9104,i,566511159839549090,7614379793933146854,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11208 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9220,i,15935564690519846360,8416620526308239070,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11292 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9224,i,1818174403872075457,8089464251634851651,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:1
      4⤵
      PID:7436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9204,i,5039745182092610158,7774663296342273053,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
      4⤵
      PID:7444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10632,i,10463243439750061333,10315101523687773124,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15408 /prefetch:1
      4⤵
      PID:7452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10720,i,3519774292113752495,3640762396669758405,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15460 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10688,i,17027906181455674937,1778138819191941407,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15440 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10656,i,9556053381078383760,9584018159561901820,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15420 /prefetch:1
      4⤵
      PID:7460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,3066025093065408405,7818733177055856219,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15712 /prefetch:14
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10608,i,5333712278711021487,11714512592079587695,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15396 /prefetch:1
      4⤵
      PID:7492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10812,i,15332826675295492011,11252573685318012704,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15516 /prefetch:1
      4⤵
      PID:7508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10432,i,2716252516631063354,11453131116185149643,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=10512 /prefetch:1
      4⤵
      PID:7532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10804,i,8639028945592946992,4902732847908443702,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15556 /prefetch:1
      4⤵
      PID:7524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10788,i,17315126649907667187,11621358347282891898,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15496 /prefetch:1
      4⤵
      PID:7500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=5032,i,17113581300037304963,6953997260065238747,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15616 /prefetch:1
      4⤵
      PID:7516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10588,i,349462783641358377,727057033862819212,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=10520 /prefetch:1
      4⤵
      PID:7540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10740,i,8935829808544014816,1060672134616114205,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15536 /prefetch:1
      4⤵
      PID:7556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10916,i,12120893110967597243,14210741418386152551,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15584 /prefetch:1
      4⤵
      PID:7572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10892,i,15578316278492239498,13962169048710812083,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15564 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10928,i,10518199725035734682,8634087327563628757,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15636 /prefetch:1
      4⤵
      PID:7564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10728,i,14079424540887431535,9809117485139214159,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15476 /prefetch:1
      4⤵
      PID:7548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,13646563163965088355,14758723925631634691,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=15684 /prefetch:14
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,17691494643016227571,18399692362143453199,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=16016 /prefetch:14
      4⤵
      PID:7596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=740,i,12185580548425754535,13602369124647337589,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=16092 /prefetch:1
      4⤵
      PID:7604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10980,i,11330947102309659212,17662538776821209505,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=16096 /prefetch:1
      4⤵
      PID:7612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=20560,i,17138451720820313549,10409859883677545667,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=20572 /prefetch:1
      4⤵
      PID:7764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=20712,i,17168847620461196588,7552417140554452234,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=20724 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,10140006528473708550,16535869932898154269,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:12
      4⤵
      PID:9792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=7880,i,17123742821849645222,9714289871966089815,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
      4⤵
      PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=9268,i,14498910463415575382,7193335207040685809,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=10800 /prefetch:1
      4⤵
      PID:9872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=20880,i,12128870314302510339,1564097955107754626,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=21500 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=20980,i,8645295981051039127,8127465154942088207,2097152 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=21508 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20016,i,17320843716488592319,11488463839892269691,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=21512 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20736,i,12951688986480666687,17527018755663696163,524288 --field-trial-handle=2212,i,13053716236928493228,3213688282434852739,262144 --variations-seed-version --mojo-platform-channel-handle=21556 /prefetch:14
      4⤵
      PID:12024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2920
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe"
      4⤵
      Views/modifies file attributes
      PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe
1⤵
PID:3864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gwr91uzu\q7v268vu.exe
  2⤵
  PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe"
      4⤵
      Views/modifies file attributes
      PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4256

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe
1⤵
PID:5200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93yb5k4e\gi97vtgy.exe
  2⤵
  PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe"
      4⤵
      Views/modifies file attributes
      PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1960

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe
1⤵
PID:3612
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a5nm3z14\83gb1on2.exe
  2⤵
  PID:680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe"
      4⤵
      Views/modifies file attributes
      PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3376

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe
1⤵
PID:3376
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xliyr5yz\pk9sm973.exe
  2⤵
  PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6280
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe"
      4⤵
      Views/modifies file attributes
      PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6632

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe
1⤵
PID:6732
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fro49ux3\ntty2ml3.exe
  2⤵
  PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6840
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe"
      4⤵
      Views/modifies file attributes
      PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe
1⤵
PID:6336
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bekc023w\kkw2wm7f.exe
  2⤵
  PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe"
      4⤵
      Views/modifies file attributes
      PID:6548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6968

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe
1⤵
PID:7036
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2on329qc\whvcvhgr.exe
  2⤵
  PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6148
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe"
      4⤵
      Views/modifies file attributes
      PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6568

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe
1⤵
PID:6824
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chg4drky\5lc6xskh.exe
  2⤵
  PID:6952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6964
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe"
      4⤵
      Views/modifies file attributes
      PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7160

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe
1⤵
PID:6760
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elqayefh\tgaoaklh.exe
  2⤵
  PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe"
      4⤵
      Views/modifies file attributes
      PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6664

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe
1⤵
PID:6968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\owdgo70s\ke3or2gf.exe
  2⤵
  PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe"
      4⤵
      Views/modifies file attributes
      PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10184

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe
1⤵
PID:10272
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30y22rih\so7zjuvk.exe
  2⤵
  PID:10512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12176
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe"
      4⤵
      Views/modifies file attributes
      PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:13060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:13124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:13296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:12344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:12952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:13264

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe
1⤵
PID:12436
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e94f8ul0\pj8rquff.exe
  2⤵
  PID:12688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 306KB
SHA256 25a66fdfa4e960aa54ff71c8ccd0b921243d10e25358cfab48e7ad50b8424cd6
MD5 5e636f47d75d7bfb438a4545b64a721e
SHA1 904d81324956bc2e116e075ae7aaa84869dacd35
SHA512 6262ba7662089bbe3967ad92261d0f0d238c0b82b87bba66c724ffd710d903d91c4e216a95df1d595f6f6deaadfd2123b35eccacb0afbd6ccbe8b21a7b76ad98
SSDEEP 6144:/LjceqIcEJcT5QO5Zhzqhot27GO+mb/7aqLSW03M8rlE:/0XEcT5QuZNk7G2OsOM0E
TLSH
T12D6423484148F58EBF8CEF176175D484D4F46861AF3300F96AF17B5DA20BADAAF06E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 76KB
SHA256 bda2664e3f178bcf86f8b7d17e9be4284279de8ca512d882c8de3a2a333008e6
MD5 1baa4b9b9cd320716e1368af2c14fe4c
SHA1 7ce71e944f47ed6599523e8d082f2693550edf4f
SHA512 1584be28d89a13ea7506f6945bff5d415ee3b570b85b0b7c6fea7f45ace719494b3efeb09a29c3f6acb63f53d21de1e90657bac55bcf2f5d6f8b1bd5b6083b3c
SSDEEP 1536:w1SUrqoawW8l8uLlfPAJeTZHaktq20VesO02KSBmlysuGeqtCZ+hF9kLjJ:yHF5l8uJfYJeTIktMVtnaCysuxZ+h+
TLSH
T1C3731218ED4B1CBA72CEA0DE5FF7E9105A2DB4B1A1240D082BE9F56FA542A7119703F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 228KB
SHA256 6ab46e891708ef032f3fd3b5a4171311a4a8e90d7183a0869267dad7204d200e
MD5 e623bfb729f991329da42f51a706c05c
SHA1 0926d76e3c48c8b1508327b7245e77d8d0a18ace
SHA512 a22adec507857118834cf7e076f62dc2808eb720c1a03eea2ad63d6ae9e6a95cce74a3e2cc1077a2e8201fb9368ccd23c421790f525ca2e31bab6f67f2752d28
SSDEEP 6144:eH1NKe7I76QzzrGpD6uNL5XnxTYkqrp+w3IEW:eHnV7IXzCOuBlJj/Z
TLSH
T1CE34224A7A90550FEBE3000F4DD5C30206FEED8BAD70A69DE6426717BE5E293378B520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 154KB
SHA256 3edf10861255d0c04ea8b415a2ff7bd345315dccf4bf3ef0615927a247eb2297
MD5 40d7ebc3dab506f0f84f1f7503c8f05e
SHA1 f974dfeab41c815e6a5ff59e831ba5f5ffb07af6
SHA512 56966ae9f718c877a6cb9e28c6db66fdb290b1d812333923632fdaa28c4050b25597907a359eb5622ee1fbe98d9046721cbfd6442c41057395c8e7f2f81c3521
SSDEEP 3072:ZWigiwOV4rV8l95M2/Hxa/p42xmgU59CqWcLeM9fIdXC9T:ZWiboVMRazYCq7LeIfIdX4
TLSH
T186F3136C1812B16F63476856B77A67955DE3C831E220305879B3842FBCBEBC0E752F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 207KB
SHA256 88d11b9c0bfca2511d7321cd46d45bd3031503c1affece26fd67792dcaca209e
MD5 ec070ce27087be035c3ced668bf20107
SHA1 e8368e8f37b28a5480b6de35d1d5824fc5f9887c
SHA512 db8c405409b46acc5dd6e77afd952414a33922e4560adef5e6abdaca4076da6ee81c339a7e00122cabe38280f6e727bb881e543c9b3e22cc02946ca6b90372b2
SSDEEP 6144:zwif0zagrfoJpaRzbTJacEImg38I6ynvssrme:zKWQgJpaRzbdaumg38HoXz
TLSH
T15B242270C7E823D357DC0787BA1ACDB07D840B4F4AB09B9FC70EBE4A6226E685759940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 48KB
SHA256 687170d02234bcb90abfcb093695be7e37fe7de66c9e87b05f25330b1511e827
MD5 c07bd505cd442310d7b14700b770d6f9
SHA1 b596e92c98eaf991ff3a516ff64c771977de483f
SHA512 45eb90f22d9aac13745760c530d4e24816b13316782902095de13657ba9232faa44675e2988e048dcc9d071387945474233575aeb33cba0b29b6e43c28afb6ca
SSDEEP 1536:5eoF4pfLW7Uplx6wnckovIx6ZKWYg4pT4yKsW0wr1imy:5ViCkvL3wcWjCT4psW0wrVy
TLSH
T1F62302311C4A068C8E7C41B295830B8CB65E8DDBD8DB29F1877127359942AD19B86EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 116KB
SHA256 e8f4cf9a140e7c4a8a817b6f9813741c52430e0d2bad30b538aff9563ddf4cef
MD5 f25dd3bf3bb2e88d7c200476f2cced68
SHA1 d4831efae3688a32fe95329c5038ad4c522a9076
SHA512 cd06ff2cfc05982c001ee033689121ae3da4af9c25e57301d8331186c419376e97fef9f52634ebf043cfb25d330ec655a9d08f4494bb7dab9228a743012e2b40
SSDEEP 3072:FW0LwkYpA0MGFoXIxWSZXCZFQt0wWK7+WEglgJA2sil9:FW0kbjjWoXCZFQqwWK7+jgQrBl9
TLSH
T11BC30295BAA26682D71823A87DEC5B260D1DD25FD0A43F7EC499E3831101035B5FBF2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 27KB
SHA256 49811dce110c60cece80f2efb4372b367b17cf378562df7e2300c3930ccdccd4
MD5 d0e15a030e4b8d1d073f901def899097
SHA1 989b929a34551198d680169d3e536dffa9ec568b
SHA512 cf7b55860670a35265565b6eb03892597a8acc64c852b9005abe93b6039bdaa6a3f6244afa8a1937ccb4dbaf7b6d5563e6ad85cc49674c53b63b4db88fc944b5
SSDEEP 768:7LDwh2J828DdlC2wFcl8Q4iDLMzUT+OWlLqQwIawrQpn+sTcm:7IwJ82kwFcld/XMzUY+FFnZcm
TLSH
T1C6C2E1D77A58E33C25AFEE365C4FC49D9B51249AD3838BA32030613AAC177357267B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 101KB
SHA256 a7d951b081b934ffc3c345308b8a556f39743a2859a1db21c8d8f757866c9165
MD5 d40a09f9cd91c162622b3fdc4692888c
SHA1 b04cc701456e916b4f17dcdd5c38d0ff2d97c1ac
SHA512 1da2bf015b56680d9b77584fb81df35c954b3e93eb9a75eabc18ed8d912555cbb32482da95afc967d26bc3165e60a8e28c197824424f3697f438ee2454f51d14
SSDEEP 1536:HUa67AMxhWgWHD5/L0CXEpjbkW71rJPTRPg8wpyTgnkcG+NQiQ4DCkqQHUzWCLRG:HUFhqD9zUlbjdPTyUUkZRi7mzF8
TLSH
T1C5A3123EF1106057444D7F9BAC4F3CD959F4A84E06AEB5F7C4162E88F5025A3A2AAF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 105KB
SHA256 4ce5a92a5cdf2bb7c1beac66909d177fcad9c7c549d33daae28f15c6298f2a95
MD5 68cf4afafec62da224132404c1bfcdc2
SHA1 0779311655c39db1852613f04718311f3befc67d
SHA512 6fc260989293bf62fd8ef8f424af23f541e28440d29b2e1a6960308e89d556e42224fed78d1788ea98dee78eebe729a232e8f9218f6cd30f8d483fd65e585f96
SSDEEP 1536:oL/iKCwjMoZk+fTP5B66M3Djkm2xLtudRspnxFfcV9Ucwx2wcuu12GuAWIMkvJg8:0pMz2TMzjkmJdq2Kz2wcf0Idm8
TLSH
T1E1B3125FA72B1621B39B85BFEDF94013AC0502D65B38DAD4A59E0732DC25FB62D2B0D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bc479d47781d575_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bc479d47781d575_0
Size 294B
SHA256 9e2d6ead61dc894c5cd1741fd1c3c273fc7eaa4783e925eb8ab8291613f3342b
MD5 52282778effdc32a6df2ade0302f415a
SHA1 6b44b312b72dbc7fae164299dd41bba0667cac6d
SHA512 00efb1eeb4f361f264149b9ff79d7541ecf1b509dced3ed98a521593de14dc4cb807248fe8a512e19fc7f92963c9f762063e2e297c1aa1d1f404427c99998d1f
TLSH
T1CDE0EB7FD62C60E0F928D6F0CB63520EC703942C941E8CC01047A0B220802B56C2E42B
MD5 SHA1 SHA512 TLSH

Submit Download

2c58cedae873bc10_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c58cedae873bc10_0
Size 602B
SHA256 b3aeed5dbb4afac0564b1d3f6fa6e7702c525690ea580ffc6c1f64a51c7b7d51
MD5 fd5587c584d55d33acc091f9a90463c6
SHA1 cdc8c4a43c752652848eb7be174e6732d821b6e8
SHA512 1b77a04ce2b5e58d67df8286ecd19b1d0fa444ffcf327a70246258b3ce4dff52cefcf467eea5b0d26d16533a9a109986862f9ad9cdd7923bfaa8143b3ae0c427
TLSH
T1DAF04797011CB505F8DBBBF5C2F594659352D3E6093E69F5C41490B332CB09136CA5D0
MD5 SHA1 SHA512 TLSH

Submit Download

9459187c22b69cf0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9459187c22b69cf0_0
Size 435KB
SHA256 dad55ec18daa8ae8f376536776ba288fe4e680aabf54c63d4f561cfd68e7ab18
MD5 15bdf6b054a3b9f642f42adc8cc8da85
SHA1 198886a4f8e2624cbaec80c9bcb2a972217a390b
SHA512 ff7eda3c5ccb153712138e0f3dfe964da130f631f083fa11c7c1b509ca461b995c20ef5a17df2215ee7bdb7f55aa70628ab9f35bbd1140830b38f72b7a4f2a82
SSDEEP 6144:PnAcIazHGJgSrgfBRYdsKUzv4iRKws9KtWNEpPyQ7D+uOoJPo:PnAcXogTqtU2KYNKP1mudPo
TLSH
T1FB94B5491790F998CB7A23F44552C953B731844C2EC7E32771E8B73A3C4A2E54E9A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95415041b09ef558_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95415041b09ef558_0
Size 270B
SHA256 57d7d23408da7d3ef715cac95b6c4bd32ea252e7eb6c20a2e01cd93c0c2ed9f7
MD5 dcfdbd906ef5f8ac350fef6c284ee1d6
SHA1 6bb34e2de247e9e1e91683db29f089165f90e13e
SHA512 f7f6ae3159cc79d86577b910d4157ce3e5a4ac7e3fa0dca7ed270e0972fe14df7a091decc73114ccc3b6a3a4b5e6045d58e71b95faf654eaa048033c92f44efb
TLSH
T119D02B5F4476A0A6CE18AAB089666509C1278018466E8193C00A75A27112A309A45250
MD5 SHA1 SHA512 TLSH

Submit Download

c1064073b9434115_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c1064073b9434115_0
Size 290KB
SHA256 d1a16f1009902f47802017cc43046b175eb91596adb4fbd919c1d120d86d86d5
MD5 7a18266bed8d2c5e8c21161313483978
SHA1 2566c9b144ff0f0c4e3ee50e79540a597e20591f
SHA512 43bcecdbbd6858ee053029ef52fd3bdbc2a8786cc45e616bdb7005cf1913402eb6caf30357b0a412ea0139e267be20cd8eb49e8939d07ec9f0c12df1e60ef991
SSDEEP 6144:dPX9hQykq2pv68a2Ononnm0q71GSBFgAl:dsykq2t6z2oonmBiy
TLSH
T12A54B5552B90EE15CE3663F54262C953A73590483FC7931371F8A33A3C5A2E25F9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3a6f795a7386a55_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e3a6f795a7386a55_0
Size 434KB
SHA256 7989a61245ce067d940abc925d80547965ba132c3cedd0dad7588a6f3ba39325
MD5 5fb4929732a134c57bed0216b0a1fee5
SHA1 2b430a591685edc573390ef09eae5844672a19ee
SHA512 b33869650e0329a88555e15afd4ef3b6f0c66055b32072f2a8e4cf4c42197aae0fe78c501fa4319e581c2beba4cc3a249d0e6734f47299b32afa94451f4fcf43
SSDEEP 6144:BoY07P9PHKBXERlISmoQ2SeFsPQyAN3jxzyrTjYC:OlHKBX3grsPEcT0C
TLSH
T16894E70957A0EA55CF7623F441A3C953A73540483EC7E72371E4B73A3C4A2E16F9A98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c5233032ea240a30c62c1ea0f337137aff669d72b81fa6ccfdfc7e189ea5ffd6
MD5 b969ec6900089b3bcaf9ea65e92f4e96
SHA1 4a484b98322a861f3df0211c7ea894c46f65ce88
SHA512 8412a49046e0cd55e4cbd1635e89f853ad7ba9399ed8c97ad8154c5c0ad3c98ae7930500543e0da9015a3cf54e64653f817d92c8e84b0c8d9488dc4ee2c3ac0a
SSDEEP 48:DgPyxj3KbM9qaVZQ7ev5/nBQCX/w8LoIuODyZGfdjaKdzE+w:0Pyxj3d9qoQOJzuOEG8Kdu
TLSH
T1A781C69963911AE7EBD5C4B1C2E2B84531F70C25060BAF760293EDB23CA6FB410E9507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c1a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c1a0.TMP
Size 3KB
SHA256 3fdff2da0ddf5c57f4679e403062f5ff41674abd79f391a81b46b2d26bda5344
MD5 77e8af7649fe0b121b88cb3e5daa617b
SHA1 c6672bd6df45f1e8b179009ea3d2576e43e66dd5
SHA512 d801f090e9de2f3c4429e381457d74cedc0b807cda9c1c376143c70393deef7d0ad9220b6f790d23b8688f3552a33891ccdea6889e84db5c08b1fbc398867125
TLSH
T1A761535963210AE3D7E5C9F196E0B44831F78C60450BAB3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 094601b4e3a71fe63e44b53e931b02808d0b49dfba499cb7e43ccdd1a85d0164
MD5 8b9276dca28c8ce4f10a9a18bb521fde
SHA1 64d7f4a052ef7a462714878d01506ac4afaeb832
SHA512 a43b9c119f96c98198b461acd5f3cb94ecf2b6f6d26d401555bf75959da5d28044031fd1619406f99e0eba75176e95e68248b572239c5eb425102c48bdbd41b6
SSDEEP 96:DRHYNVaaiwkzW6WQikNVIYGbLwRqjrbFw:DRHYNVaaiwkK6WQikNPGbLcqjrbFw
TLSH
T1B691BAF787F8962D9D2195F0EA056E2BCF690910532C3D6AC9D0AF1BA7E2470E101A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ad5a4fdc21052cafe90cb47c8fdeeb81ec1e52657adf7c0f7baa58f4d467ca25
MD5 a705f2fe17dc9658dc5a0802bfd96cd1
SHA1 6997ce0c7419f5f750245b77fd71e0aa6e0ac4fc
SHA512 99a7c47a8cf8846470974a625d3d1801f43ff1312164ba2fdbb1257f5a840e0b7d2d78ee33f1bef675d34826ed6a710d73620116605e98100a52c5ea6bee6ba5
SSDEEP 192:sxR5R7CB/fgsDprQ5iSzoA8pKCvvFgHg6+WNs3U98jfYBrOU1h2OGLIgVOJ:sxR54B/fgsD1965H6fp62U
TLSH
T1B642D91A6938A93B5CD7D219FB15BF53D2F95032A5D05E44A7FC9A1C00EBADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8b4d228a62908be0b646da2919e74b48d47ccbdbdda2803caac13ae61e64cfd
MD5 e69c98d27602b0dcf5bb547ca766992d
SHA1 190e8296f111c2327fd73716546f42a24d5e2e34
SHA512 6dbf384217b086d7a5e638053703b808353414fc0fd32e1bae3936aae8879906ee6bdb5404ff2c557d92c5fd43ffb4b375c1b63d3de41886614c342903a6d40f
SSDEEP 192:sxRyR7CB/fgs7prQ5iUzoA8pKB6trWFgHg6+WNsWlr+5d3sJx2fYBT8EN1h2OGLD:sxRy4B/fgs7DQ65/YKefUN2D
TLSH
T17C52F8166938AD3B6CDBD218FA15FB13E2F55022A5D05F44A7FC9A1C00EB6DE720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3ce679afa317a24810ae6b1bf01bf7d9fd8fd4c4c1f8370f7ecffbef7b61979d
MD5 e125d0046fbccf86bf62093eb10d0e84
SHA1 69992556596703c376e26657bb5d2d6d934480fb
SHA512 0539637e2449cdceff5b49e5af3f57169d7561fca330b638e9bdbfbceaa61772e6a205a31a71e0642edd7a355421228b6dd8f9c96c6b40832f84418cef269ac3
SSDEEP 192:sxRyR7CB/fgs7prQ5irzoA8pKBjtrWFgHg6+WNsWlr+5d3sJx2fYBT8EN1h2OGLD:sxRy4B/fgs7MT65/YKefUN2D
TLSH
T1CA52F8166938AD3B6CDBD218FA15FF13E2F55022A5D05E44A7FC9A1C00EB6DE720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 580e268a268376fc63a737ed1eabb1b5fbb0f0806b9d817db28273660fdb63fa
MD5 74779c46ec932574c86b8ece0b0459c0
SHA1 6642d8b9720137c213beab512bce7f86d15dc7c9
SHA512 2389c3415f66884261b73d9c4c3a74917c637da042b79d46a0054c8c7b7f2620c39ea53790f703420bf4db4c8414824eafd88706266323cef7e67ef2578e6c81
SSDEEP 192:sxRyR7CB/fgs7prQ5i5zoA8pUBjTrWFgHg6+WNsWlr+5dY5Jx2fYBT8KN5h2OGLD:sxRy4B/fgs7mr65/Y2efaB2D
TLSH
T13452F856A938AD3B5CD7D219FA15FF13E2F95022A5D01E44A7FC9A1C00EB6DE720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b54544904d04934532081177959219af1d5a440ace4eaf461dad50b05aff0432
MD5 ef6e2997dfeeeba08233fd1bd8fd5929
SHA1 cfde9ad3cb0ee9a475b5b25226289b53b14f9707
SHA512 b10302dc2fe72cb2237fc7d5d5bf174645e0c783899c71d8db0568aa63fee22a247e994f961f7124137c0324645e805cbfdde19c67b8cbb60fb23e91b54caf72
SSDEEP 192:sxRyR7CB/fgs7prQ5irzoA8pKJivFgHg6+WNs3Ul+5d8jnEBIS/YBr8N1h2OGLIM:sxRy4B/fgs7Uv65H2aEWS//N2B
TLSH
T1C052D9166938AD3B5CD7D219FA25BF13D2F95022A5D05E44B7FC9A1C00EBADE720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f27dc789681d10702a575101de508362df2bc623fdfab1752b30b7373203543
MD5 c7a0e8124fb05419e88e90c0205ac45d
SHA1 46ce0502fc62c7531b69057def8cc7e4cbc52df1
SHA512 957dae748595602d2c6ae3756e01fe233e7faf5349f1880e3245247cb0cdaeae762826e014613ecd02adbaf4c4fdc7883afa079a630e01c691d0139700ab026e
SSDEEP 192:sxRyR7CB/fgskprQ5iozoA8pK1NvFgHg6+WNs3Ul+5d8jnEBIS/YBr8U1h2OGLIM:sxRy4B/fgskb265H2aEWS//62B
TLSH
T1CE52E9166938A93B5CD7D219FA25FF13D2F95022A5D05E44B7FC9A1C00EAADE720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 64e9e11f5195df4d62678cf46ed2e5bc665751b58595c73d11b418c981b868ef
MD5 7b75c38d145315b567efeb1e7d9a41cd
SHA1 f2e87312243dcbd6592e0b493892710a59b864e2
SHA512 d96e1b273465ded6bcfb41bc6d5d29b748f9b04fa346a0a5c982fcd9482832c9b62ff54a81eaaddf7705fbd6225656f44efa493f42799984712c6b59b8caeb9a
SSDEEP 768:wb8dKg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNu466rohuGb7s8:wb8dKsE7r6Wgouf6Mu1jaeV6xYws8
TLSH
T1ACC2C97B740DCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 917b689e643f1ee4b8dfd147e964e3a31f9898129f13f21b3e40368480042c90
MD5 452298b73b593637f2a15e387004d7d0
SHA1 0b2bf76e2f9bd0f47bca441a79df0d7b1542e257
SHA512 e360561c217bfa94694da5e88631da7bf2a402c8cec1e4ea0a3c8bd7148166a871287ad175005764ba6743cc5b5acc19afa450b3739470e58460c4b6be7b2a4a
TLSH
T1E031B010313B621438BD39299074A79A8E4171673118ED2F7FE94D56CD2BE044FBD8F9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59bc51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bc51.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 125cf61ce3b95468f1b22f1038d08f17e1568a17a0c18d7f84893cd97094be48
MD5 cf70635551743eca8ef295c09fc2e721
SHA1 087f754e3c996e580c11aaca6c754900196b2831
SHA512 a81ed3146e571f383377480c090866e3c3ce7929a5aa8fded272370d93ed9950c6c0579a5fbf0c9c38fe50e28bb6cee4e3d59e59f7e026796b552151561914a5
SSDEEP 768:6rv+4UNbds3OHDZIO03SNzc4ReyIsXMeVH1S5D:6bsbS3itc44bs8EH1Y
TLSH
T19B03CE32A868D937ACF6A686B10776537EF8512B82C81ED0C9DE6F0C464B5DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 321dcbbfed15219c4d3c1dcee978313877c16b65debb29daf22f0e0726e48467
MD5 433e7897187f8c1b64876610c1e2e033
SHA1 88bd491a6c48aaa08f58f487bc9bf021b4ab0293
SHA512 639fbfa2e6bcf39edd12e2b84d8dc2d08f9e2c53478179d99cd297c92aa639ce3a3aeb99ceddcb6f040d740fd8d4c472f7a2482ce99b9437e1df5aa1563aff21
SSDEEP 768:Zrv+4UNbds3EPDZIO033VNzc4ReyIs2reVH1S5D:ZbsbS3Ttc44bs8EH1Y
TLSH
T17903CF32A838CD33ACEAA246B14776937EF8616B81C40E94C9E95F4C0A475DE175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f23f2d9ec308bbc2b2278f18d55364a63c3d23d8af3f4c4191b6366144a2fd58
MD5 c40c3151d95adf6e930b5c5e49dba5bb
SHA1 52b141a29553d2221e6232ff453fb0b38ed715b5
SHA512 db84ea6d79f354085d30c42e9a77e7cff8988b7e3638db054b7f341167fe47e3deb180e2eeff697ec4d66d04a6f86a55863461bb127708454db067cba60dfb6a
SSDEEP 768:qFQc3YwgDuZQ5O033yNzc4ReyIsPrMgfm:Rc3htc44bszMgfm
TLSH
T173037B32EC64CE6BACF79786B7067642EEF4116781C8ADD4DAD95E0C00872DE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f90421ece7966b50fd5fd37373efb2f910a306b841c69429409717eec0ea4a76
MD5 a8249d45d09c1474a61e93646e61d380
SHA1 1c84d4bf273fce5c5e33969d1ac0531b00ad843d
SHA512 2a8874f9d0987cec68ca9f00949037d0c89349869e483e055af2711b532478db12c1104e59753b7f501836d60dab30431ba4a1162acc93ccabce48acc09baa72
SSDEEP 768:grv+4UNbds3j5DZIO033VNzc4ReyIsPreVH1S5s:gbsbS3Mtc44bszEH1b
TLSH
T1C803CF32A828CD33ACFAA246B14776937EF8616B81C40E94C9D95F0C0A4B5DE175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e21fdc50658accdc55fe228963b41f9869a276e053da47c07566805a9985eb53
MD5 c0e19405f2fa8deed973506d5eb01441
SHA1 56bf9c636bcbf00a6712f9f9fa5aeec24a39cdea
SHA512 43cab1e61b444f5e3c8457f8050cb277ee0b3b36fb6723c9c9f117f081bd89a28031e283ea30782631e86af5c7be84417caf26f6b29ffb73c68bbb4c3ad99005
SSDEEP 384:ncZcIc38NpAJPWvY2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBueQ:Kc3GvDZIO033SNzc4ReyIsPrMgfm
TLSH
T1A4F2BF31AC64CDB7ACFAA346B6077683BDF4512781C82D94D5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9ead3f4a6d48aeb49b4e27ff5a6d7b2d075049cc669301a126921494cc9c11d3
MD5 ce838ff37583987d4e391b39d88d9c94
SHA1 e1b159428cf773123bb062ac58274d27aa272609
SHA512 4edae4b1772520baea71a8c8f9ce1cb956b21f36a09424760197674655b0dfc1d21ea266248d40006c47fe9ad2a0a97035ec1a0aaac92bafd13fa01818f26b63
SSDEEP 384:nLZcIc38Np5JizY2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBuela:Tc3xvDZIO033SNzc4ReyIsPrMgfm
TLSH
T101F2BF31AC64CDB7ACFAA386B6077682BDF45127C1C82D94C5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f5c689f6b3fa486a3d05f5043665da908ad898cc448d512722f9c8a8ba1bd9d0
MD5 e02061715a6d12144ad34ac15cbdd24b
SHA1 0583056a8d369b7ffd16aceab60ac0ebf1ab384b
SHA512 7862e290546e3c0e91566eabdd806e2022ea636f5b2a74f21e6b7e0c68d04f1a06f21b8eb08f6686dea7ed09c521b14c6206560929d16be113287aaf9cc8da8b
SSDEEP 768:qFH063jwgjquZQ5O033KXNzc4ReyIsPrMgfm:2063dDXtc44bszMgfm
TLSH
T153037B36EC64CE6BACF79786B7067642EEF4116781C8ADD4DAD95E0C00872DE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c6c61e6606fa6119a48ef91a9ad4986ba727e984512efd79b2116c0702cee366
MD5 08f12996b6fce2333302b44c4f6bb3a5
SHA1 26bf722e79ae9d309d6ad90acc4495a814da5c85
SHA512 9348eac657dc84d77e1068289f944cf3cdf99889a022b5d3222b5296262a2e7763a0a9bae0b03a94e94232477a8d65b64ef551e8580b565d2f892cd62ec2a7d4
SSDEEP 768:Srv+4UNbd13NpDZIO033iNzc4ReyIsPr/E:Sbsbb3ztc44bsz/E
TLSH
T16503BE31B828DD73ACFAA245B1477683BEF8216B81C41E98D9D95F0C094B5EE171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a5142ae7ea00197f897f1433de6cb0646142630115a05f6995f211288ef7b395
MD5 327915809f05fec8e78d200bdbcdd365
SHA1 9640853f0a6f485a5f00c12d5c746ac9037f2767
SHA512 c83fe086b01d0287962e2d81acc51d536f84df47322b29deb7542d93e3c53ae16f1ef645347d0a3770a926abe6f16941059fca30dcbb0847ad3bb22d3a8f8298
SSDEEP 768:2rv+4UNbdb3CHDZIO033tNzc4ReyIsPr/E:2bsbZ3Rtc44bsz/E
TLSH
T15D03BE31B828DD73ACFAA245B1077683BEF8216B81C40E94D9E95F0C094B5EE171F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b2d8f6a12258e0caaf1bfe955b17ef3bf132d025bda05849642c02d27b7aaad1
MD5 478d47e77d51a8f6bac8eb252f3fe2d4
SHA1 f57681e3d114766fd361a6f7e672fe7a3b430a0e
SHA512 42afd02f48f85158b2db04f90399ff26db9856ed8da34830e3808ec6278d87009225817a4d08b0d472d2a81fcd9f46c695ba66e84c7c368a1f79586dbf69727c
SSDEEP 384:ncZcIA38NpAJdke2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBuela:KA3GpDZIO033SNzc4ReyIsPrMgfm
TLSH
T1BFF2BE31AD64CDB7ACFAA346B6077683BEF4512B81C82D94C5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f339afb3ddd70b8ef554d490ac4f995afdd935da8a960a28ddaa6d5aa341587f
MD5 86a0e9737f08cd0c6f818e7a48dd1ff3
SHA1 7ea30a0e89e03a733d69ac321ade10192bff4866
SHA512 65e0815e47a0919a0a62bb8250f0199e5b5969e9f8ffcf9fb3a450c58bc608d28e8918f00fbe92b31dda9239eeea1d68877cee14e01077768ebd97083259eb52
SSDEEP 384:ncZcIs38NpAJ/RK2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBuela:Ks35FDZIO033SNzc4ReyIsPrMgfm
TLSH
T139F2BE31AC64CDB7ACFAA346B6077683BEF4512B81C82D84C5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d26de6d755eeee9c5af46d581378ca05dd2c80588f5aa5b0e67f9d591160490a
MD5 869cc4a7190244202ba1d63227fa23d7
SHA1 07b37aecda43edddcb4c8c6421fa9ffb08c7165c
SHA512 85c7d0a578e2102651ef934bd90d9bb2c308996dec8596fcc914a56ea088c620f9a6a22cfa784d6d72c33f0767e35797559cf0c1b2353fcd3a121f1f8f5cda3d
SSDEEP 384:ncZcIE38NpAJwtzM2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBueQ:KE30HDZIO033SNzc4ReyIsPrMgfm
TLSH
T132F2BE31AD64CDB7ACFAA346B6077682BDF4512B81C82D94C5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f7adc70dd476d4edcb5e7ad2ef5e13974340f7bde069ef0c9e3fecda6a64b661
MD5 3ecb745d0ec2173dced92e32201fe482
SHA1 0f6b1dec17791ba93f8110ff2b718a9a648eaf26
SHA512 4831cf20748cface18f1a23222da7dd6860dd141b729861b75cc70dcaf8d50c3829dae39e2fe619b2edbd9bc6dd35aca0a7bd842794b110d4ff0dc4c0322752c
SSDEEP 384:ncZcIT38NpAJaY02JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBuela:KT3bLDZIO033SNzc4ReyIsPrMgfm
TLSH
T11BF2BF31AC64CDB7ACFAA346B6477683BDF4512781C82D94C5E96F0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 39d47ad6c1220c3e612d910fa658c2658778bca80cc29262f38974a500809033
MD5 87e59cb5f2d86601bdcb158d71a262da
SHA1 b7a001857723ef120cc45b85569b3efa91254bcc
SHA512 962ef6ed6dcd2085e8fb2958b438e5b7eaf8726bdf13f475ddc246dfc7d2a092df0995978af57e1f54833a634095b82ed8ad20b8d197b8772fe0548f516111b0
SSDEEP 384:ncZcIG38NpAJHi62JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBuela:KG3S1DZIO033SNzc4ReyIsPrMgfm
TLSH
T1AFF2BE31AC64CDB7ACFAA346B6077683BDF4512781C82D94C5E9AF0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 63c83674e3eb7f6476a250d725d88cdc37a31e161f09a1b721a370cbaf4bec25
MD5 e93469234f4531879b482f433b41e538
SHA1 883c926aadc01ecb0c4701cd53a00ffefd248a03
SHA512 2ccc24160ca78335d9eff8d02ee25ac348f29fb55f4316b997162c3ed541e08edf1f30bfbdb8cf5e924b969b2905ad616d7eedc111f1489d02a6eefdfe6ff2f8
SSDEEP 384:ncZcIG38NpAJQ3ELC2JDZNfNoXOVSUUHXCDOHRETRzcoXfK86sfxEZxxsIj4lBun:KG3zdDZIO033SNzc4ReyIsPrMgfm
TLSH
T193F2BF31AD64CDB7ACFAA386B6077683BDF4512781C82D94C5E9AF0C08476DE171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6d5bed5d2c8d0da080905dd1454779853facee00c7f736dd6d0ca4a1ad27f4f
MD5 330d0599332b3a7ad66c128aa4be1d8e
SHA1 bac2842eedd763b782e9d171254b13c59b6ac3c5
SHA512 0b7cc3b53351c80ac0e7788d264eb87bce48661211de75e3bbb98abd07245c80795174ed22dc5a7e875d4b711e925f75be41b543d27051fc0433b6c3aac12d35
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe597352.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597352.TMP
Size 392B
SHA256 b7984e96b29cbfd817f89d6fffe86f996ad848e934082411a3957774db6b3618
MD5 00c0c51d220b6447c7fc140a7a8f2162
SHA1 cce7ced8a0638c3d7e2f24476d8316b742667546
SHA512 5133953643d8f323652773485b0c5a8a9c4c8764952c4b04892de59643557020e4a8c40fed0e54444610a5588cc9ca212a9ea3844e95396240c5cb940f0f4ec1
MD5 SHA1 SHA512

Submit Download

e3caf6c3-200d-403a-8707-5d72505fcc8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3caf6c3-200d-403a-8707-5d72505fcc8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\base_library.zip
Size 711KB
SHA256 9d982d05f69c22fb630c83739f65df7f54889ffbda32b35e19216840f42f4a72
MD5 e829fbf929350640a23a1bafa69634ac
SHA1 fbbe7b45c84c51319f8446a6c26a8ef846f96fef
SHA512 fb0b730632f68dc5897eabf9e970ce3ed947aefa2ba9585ddcd8626da73ed0f22b585495247fca6bca860a4abecacbca2c85138a630fae9b4cf415927ba43744
SSDEEP 12288:vaxb2osQNRs54PK4I15XJV0cRok1IdToQDSgsjfyErhHm:vsb2osQNRs54PK4I155V0cS1dToQDShQ
TLSH
T107F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0moe7pe1.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ogjgf6ny\0moe7pe1.exe
Size 5.4MB
SHA256 7dccc553804496fa73f5be1df23e2e66edd5fc71a50fca841692fc5cf6754e62
MD5 ea3db137a99f262ada27ea571749ddd5
SHA1 03eb615d15a1e46430b265362436d40d733ddc4b
SHA512 3571fed16e487f70002eba5063929801dc18a12daaff36fba823eb5ea2669e6c3c7b3f07d3e95925b819ba83ea6f33d2875e2e361e531fefb98e9dac4b576ee9
SSDEEP 98304:mAgtD/lICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlollloHCZMet68AY:CZICteErownP0oTcMsABqlwJ8D
TLSH
T1DA463308B3A809E1F9B3E53D85565221E5B3B4254BF0D2CF43AC96662F677D0AE3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads