Overview
overview
10Static
static
100a36d74a14...04.exe
windows10-2004-x64
80b8b9525ea...96.exe
windows10-2004-x64
10bcbf39901...03.exe
windows10-2004-x64
100e5e999136...e7.exe
windows10-2004-x64
100fc0de254b...ce.exe
windows10-2004-x64
101a47c4fd5a...a8.exe
windows10-2004-x64
71a6ed538d9...ed.exe
windows10-2004-x64
71ac9b17068...d7.exe
windows10-2004-x64
81be6fdb2df...e9.exe
windows10-2004-x64
102bbbb9b0cd...b2.exe
windows10-2004-x64
102cda90e9e8...33.exe
windows10-2004-x64
32d58b1a373...aa.exe
windows10-2004-x64
52e966d3480...2e.exe
windows10-2004-x64
73a0297561d...1c.exe
windows10-2004-x64
103a90ad3258...8d.exe
windows10-2004-x64
63e76598b80...50.exe
windows10-2004-x64
104a5b5eb5a4...36.exe
windows10-2004-x64
104b482e8492...8c.exe
windows10-2004-x64
64bd46a2850...9c.exe
windows10-2004-x64
104cca8b360d...0a.exe
windows10-2004-x64
104e31114ffd...f7.exe
windows10-2004-x64
105ac2fcc4da...83.exe
windows10-2004-x64
105b25182d96...14.exe
windows10-2004-x64
75ddb366ead...46.exe
windows10-2004-x64
95f1364d246...bc.exe
windows10-2004-x64
106e0c9935ea...65.exe
windows10-2004-x64
16ea27426ff...08.exe
windows10-2004-x64
47dad12bd22...d2.exe
windows10-2004-x64
87db9e09e8b...71.exe
windows10-2004-x64
37e9af10bfe...5a.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2025, 08:25
Behavioral task
behavioral1
Sample
0a36d74a1458e8ca334d0c8169ec320e9d7735853a4c0c74660b578a13ee3104.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
0b8b9525ead4b3ebf6e5ba923057432a809d70b8beecb07df329ad23bf5a0c96.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
0e5e9991361cc4228bbb1f7c531379f52c2dd8e353af3f27b0d87a2c0d75b4e7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
0fc0de254bc80e54c708fbd0eb0460c730283508b94108e4b2d1d70525ef3fce.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral6
Sample
1a47c4fd5aa52c954123b3871ed1e6cdacf81b1d18e8281d1b0ab304133ee3a8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral8
Sample
1ac9b17068a19f093e347bafa92112dc8f1a935ba176aadbf58e57f35e4beed7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
1be6fdb2df40e128e25bd4959ae3fa83c634ced9f51ab2994c209dcadc9adde9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral10
Sample
2bbbb9b0cdbb3a1f26ce3357d9119edf008e4894c881351f89989a67d0a192b2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
2cda90e9e87c9db37ba5015909a7efb45fbe3a351ec9ca7a5359204e801dcb33.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral12
Sample
2d58b1a3735269002d5499c67bd32c3b800fd1c44ca78d19ac3d21df84832faa.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral13
Sample
2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3a90ad325806107cadbd87ed4825ff967c3535e74433ab04fa6ff30b512b818d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral16
Sample
3e76598b8086857c38e2016dc729fa4879136e46b6f5962ff0b042ef35666b50.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
4a5b5eb5a4e1ba423df24c110fc43f7b3428d2126e99fd9c170b9dfb2baf7236.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral18
Sample
4b482e8492e8c1943330745899214b29bfd2582000371243400d854838dfb88c.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral19
Sample
4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral20
Sample
4cca8b360d5053a789ea822ab80261dc6f010c1c72b0d449ca8cdcaffd2e2c0a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
4e31114ffd1000c0242b7537d6329641dc0457dcd6590c57659326a1785ce2f7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral22
Sample
5ac2fcc4daab08132ad947ffedcf88286f2af526a260111f3ae00de9ba0a6283.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
5ddb366eada77b037e23b02034be67099372dad8ab32668381290af66ec4ba46.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral25
Sample
5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral26
Sample
6e0c9935ea61a09f4ced2b9a871b5f21b637a7979b21aa4ccb490a9442182865.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
6ea27426ff47b4abd8a8e53f7d3452c981aa6fe86ca07ef15e45f6f8fcae3108.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral28
Sample
7dad12bd22c31f2618cc56cbd738f1cce5afaea128fcfe1deb18f4ac7366c9d2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
7db9e09e8bdcc45eafbb75b83d57503d11bf54d96c9eaa003fe8e5d518180571.exe
Resource
win10v2004-20250314-en
General
-
Target
5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe
-
Size
1.0MB
-
MD5
7e81e8492efb9fc3c9659110dc086afe
-
SHA1
7fa61b56f596e96db069874559f2c295615397f6
-
SHA256
5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714
-
SHA512
d9e6336e5d22e6b7360118f40d8badc5d8390faa40c0bcd1c59ef1fd4a5d993acd59512b1d3cf5c0b8851dd1c59f055d6bf25b5ec1d3f9fcd6a0ea323e575390
-
SSDEEP
24576:H8RhrEtJNzrcPxtakUuy5OKwId/mz6tXn/xfg1drcUl4lbHK3:c6zrc/atMK1dfHy/kbHi
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral23/files/0x0007000000024272-24.dat acprotect -
Checks computer location settings 2 TTPs 62 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe Key value queried \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation openvi.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 4672 openvi.exe 4784 openvi.exe 2216 appupdater.exe 2460 openvi.exe 5560 openvi.exe 3040 openvi.exe 2596 appupdater.exe 4356 openvi.exe 2808 openvi.exe 4232 openvi.exe 4568 appupdater.exe 3468 openvi.exe 5684 openvi.exe 2300 appupdater.exe 1104 openvi.exe 5004 openvi.exe 1116 openvi.exe 1308 appupdater.exe 5684 openvi.exe 2076 openvi.exe 1044 appupdater.exe 436 openvi.exe 3144 openvi.exe 4768 appupdater.exe 6452 openvi.exe 6760 openvi.exe 6776 appupdater.exe 5980 openvi.exe 6536 openvi.exe 6552 appupdater.exe 4028 openvi.exe 6240 openvi.exe 5660 openvi.exe 6588 appupdater.exe 6584 openvi.exe 6404 openvi.exe 6448 openvi.exe 6504 appupdater.exe 2404 openvi.exe 6480 openvi.exe 4176 openvi.exe 6964 appupdater.exe 6924 openvi.exe 936 openvi.exe 4176 appupdater.exe 7336 openvi.exe 7636 openvi.exe 8084 openvi.exe 8100 appupdater.exe 7344 openvi.exe 7960 openvi.exe 7252 openvi.exe 7276 appupdater.exe 8156 openvi.exe 4432 openvi.exe 7620 appupdater.exe 8176 openvi.exe 8168 appupdater.exe 8152 openvi.exe 7968 openvi.exe 7608 openvi.exe 8076 appupdater.exe 8536 openvi.exe 8800 openvi.exe -
Loads dropped DLL 64 IoCs
pid Process 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 4784 openvi.exe 4784 openvi.exe 4672 openvi.exe 4672 openvi.exe 4672 openvi.exe 4672 openvi.exe 2460 openvi.exe 2460 openvi.exe 2460 openvi.exe 2460 openvi.exe 5560 openvi.exe 5560 openvi.exe 5560 openvi.exe 5560 openvi.exe 3040 openvi.exe 3040 openvi.exe 3040 openvi.exe 3040 openvi.exe 4356 openvi.exe 4356 openvi.exe 4356 openvi.exe 4356 openvi.exe 2808 openvi.exe 2808 openvi.exe 2808 openvi.exe 2808 openvi.exe 4232 openvi.exe 4232 openvi.exe 4232 openvi.exe 4232 openvi.exe 3468 openvi.exe 3468 openvi.exe 3468 openvi.exe 3468 openvi.exe 5684 openvi.exe 5684 openvi.exe 5684 openvi.exe 5684 openvi.exe 1104 openvi.exe 1104 openvi.exe 1104 openvi.exe 1104 openvi.exe 5004 openvi.exe 5004 openvi.exe 5004 openvi.exe 5004 openvi.exe 1116 openvi.exe 1116 openvi.exe 1116 openvi.exe 1116 openvi.exe 5684 openvi.exe 5684 openvi.exe 5684 openvi.exe 5684 openvi.exe 2076 openvi.exe 2076 openvi.exe 2076 openvi.exe 2076 openvi.exe 436 openvi.exe 436 openvi.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe File opened for modification \??\PhysicalDrive0 openvi.exe -
resource yara_rule behavioral23/files/0x0007000000024272-24.dat upx behavioral23/memory/1016-28-0x0000000074B40000-0x0000000074B4A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language appupdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvi.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\nvifile\shell\open\command openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\DragDropHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\.nvi\ = "nvifile" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi64.dll" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\nvifile\Shellex\IconHandler\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\DragDropHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\.nvi\ = "nvifile" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\CopyHookHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi.dll" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32 openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi.dll" openvi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\DragDropHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\nvifile\Shellex\IconHandler openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32 openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\.nvi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\CopyHookHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\nvifile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi.ico" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32\ThreadingModel = "Apartment" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32 openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\shellex\CopyHookHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\Background\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Folder\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Directory\ShellEx\CopyHookHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\nvifile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi.ico" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{71748560-AA80-4469-9C1D-29A66233974C}\InProcServer32 openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Drive\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\shellex\ContextMenuHandlers\.webnavi\ = "{71748560-AA80-4469-9C1D-29A66233974C}" openvi.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\*\ShellEx\ContextMenuHandlers\.webnavi openvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID\{D66AFFF1-8FE8-48f0-A2D7-D231D926E751}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\webnavi\\nvi.dll" openvi.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5584 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs
pid Process 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe 5584 msedge.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5584 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 4672 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 90 PID 1016 wrote to memory of 4672 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 90 PID 1016 wrote to memory of 4672 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 90 PID 1016 wrote to memory of 4784 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 91 PID 1016 wrote to memory of 4784 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 91 PID 1016 wrote to memory of 4784 1016 5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe 91 PID 4784 wrote to memory of 2216 4784 openvi.exe 92 PID 4784 wrote to memory of 2216 4784 openvi.exe 92 PID 4784 wrote to memory of 2216 4784 openvi.exe 92 PID 4672 wrote to memory of 5584 4672 openvi.exe 93 PID 4672 wrote to memory of 5584 4672 openvi.exe 93 PID 5584 wrote to memory of 4588 5584 msedge.exe 95 PID 5584 wrote to memory of 4588 5584 msedge.exe 95 PID 4672 wrote to memory of 2460 4672 openvi.exe 96 PID 4672 wrote to memory of 2460 4672 openvi.exe 96 PID 4672 wrote to memory of 2460 4672 openvi.exe 96 PID 2460 wrote to memory of 5704 2460 openvi.exe 98 PID 2460 wrote to memory of 5704 2460 openvi.exe 98 PID 2460 wrote to memory of 5560 2460 openvi.exe 100 PID 2460 wrote to memory of 5560 2460 openvi.exe 100 PID 2460 wrote to memory of 5560 2460 openvi.exe 100 PID 5584 wrote to memory of 1916 5584 msedge.exe 103 PID 5584 wrote to memory of 1916 5584 msedge.exe 103 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104 PID 5584 wrote to memory of 3080 5584 msedge.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe"C:\Users\Admin\AppData\Local\Temp\5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871383⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x2a0,0x7ffa572bf208,0x7ffa572bf214,0x7ffa572bf2204⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1760,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:34⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3772,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:24⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2036,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:84⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3120,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2344,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3128,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5072,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5228,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3440,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5356,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5816,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5984,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6172,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6356,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14⤵PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6512,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6688,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6756,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14⤵PID:5156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7120,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=7560,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7736,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14⤵PID:6220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=8052,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:14⤵PID:6516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=8312,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:14⤵PID:7108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=8208,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:14⤵PID:6304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=8812,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:14⤵PID:6984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=9068,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:14⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=9272,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9356 /prefetch:14⤵PID:6484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=9588,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9616 /prefetch:14⤵PID:6808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=9860,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:14⤵PID:6768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=10032,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10052 /prefetch:14⤵PID:5456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=10400,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10308 /prefetch:14⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=10640,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10652 /prefetch:14⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=10892,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:14⤵PID:6912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=11260,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=11044 /prefetch:14⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=11476,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=11508 /prefetch:14⤵PID:7132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=11820,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=11864 /prefetch:14⤵PID:7196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=12172,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12180 /prefetch:14⤵PID:7464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=11984,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12440 /prefetch:14⤵PID:7940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=12692,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12680 /prefetch:14⤵PID:7484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=12952,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12960 /prefetch:14⤵PID:7720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=13192,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=13200 /prefetch:14⤵PID:7916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=13216,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=13376 /prefetch:14⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=13104,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=13544 /prefetch:14⤵PID:7976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=13812,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=13524 /prefetch:14⤵PID:7956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=14056,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14180 /prefetch:14⤵PID:7248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=14440,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14164 /prefetch:14⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=14824,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14832 /prefetch:14⤵PID:7932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=14828,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14572 /prefetch:14⤵PID:8392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=15224,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15200 /prefetch:14⤵PID:8660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=15560,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15588 /prefetch:14⤵PID:9144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=15712,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15724 /prefetch:14⤵PID:8404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=16088,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16108 /prefetch:14⤵PID:9024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=16348,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16332 /prefetch:14⤵PID:8432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=16656,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16652 /prefetch:14⤵PID:8852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=16856,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16716 /prefetch:14⤵PID:7984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=17148,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=17164 /prefetch:14⤵PID:8272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=17396,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=17428 /prefetch:14⤵PID:8232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=17404,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16968 /prefetch:14⤵PID:8456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=17744,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=17852 /prefetch:14⤵PID:9388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=18116,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18016 /prefetch:84⤵PID:9636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=18120,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18012 /prefetch:84⤵PID:9648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=18128,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18176 /prefetch:84⤵PID:9656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --field-trial-handle=18232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18248 /prefetch:14⤵PID:9764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --field-trial-handle=18208,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18240 /prefetch:14⤵PID:10148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --field-trial-handle=18588,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:14⤵PID:9892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=18804,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18812 /prefetch:14⤵PID:8544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=19012,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18972 /prefetch:14⤵PID:9048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=19244,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19164 /prefetch:14⤵PID:8492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=19016,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19480 /prefetch:14⤵PID:9800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --field-trial-handle=19768,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19508 /prefetch:14⤵PID:9772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=20044,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20036 /prefetch:14⤵PID:9888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=20256,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20116 /prefetch:14⤵PID:9256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=20520,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20516 /prefetch:14⤵PID:10100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=20692,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20728 /prefetch:14⤵PID:10160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=20724,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20932 /prefetch:14⤵PID:10700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=20956,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=21272 /prefetch:14⤵PID:10964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=21520,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=21524 /prefetch:14⤵PID:10440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=21444,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=21816 /prefetch:14⤵PID:10800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --field-trial-handle=21952,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22060 /prefetch:14⤵PID:10468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --field-trial-handle=22316,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22344 /prefetch:14⤵PID:10976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=22532,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22320 /prefetch:14⤵PID:10460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --field-trial-handle=22832,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22720 /prefetch:14⤵PID:10464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --field-trial-handle=23064,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22936 /prefetch:14⤵PID:11140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --field-trial-handle=23072,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22668 /prefetch:14⤵PID:11128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --field-trial-handle=23560,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23480 /prefetch:14⤵PID:11156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --field-trial-handle=23808,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23820 /prefetch:14⤵PID:10852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --field-trial-handle=24060,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23964 /prefetch:14⤵PID:11752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --field-trial-handle=24316,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=24352 /prefetch:14⤵PID:12068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --field-trial-handle=24560,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=24564 /prefetch:14⤵PID:11504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --field-trial-handle=24872,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=24736 /prefetch:14⤵PID:11968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --field-trial-handle=25128,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25132 /prefetch:14⤵PID:11496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --field-trial-handle=25440,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25448 /prefetch:14⤵PID:12104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --field-trial-handle=25676,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25652 /prefetch:14⤵PID:11588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --field-trial-handle=25948,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25664 /prefetch:14⤵PID:12272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --field-trial-handle=26076,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26184 /prefetch:14⤵PID:11396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --field-trial-handle=26420,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26424 /prefetch:14⤵PID:12124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --field-trial-handle=26668,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26696 /prefetch:14⤵PID:12520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --field-trial-handle=26920,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26948 /prefetch:14⤵PID:13028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --field-trial-handle=27116,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27092 /prefetch:14⤵PID:13300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --field-trial-handle=27420,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27444 /prefetch:14⤵PID:12516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --field-trial-handle=27684,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27712 /prefetch:14⤵PID:13068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --field-trial-handle=27976,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27984 /prefetch:14⤵PID:12664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --field-trial-handle=28124,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28104 /prefetch:14⤵PID:11732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --field-trial-handle=28352,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28356 /prefetch:14⤵PID:12892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --field-trial-handle=28720,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28692 /prefetch:14⤵PID:11800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --field-trial-handle=28972,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28736 /prefetch:14⤵PID:11480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --field-trial-handle=29184,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=29112 /prefetch:14⤵PID:12700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --field-trial-handle=29384,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=29472 /prefetch:14⤵PID:13452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --field-trial-handle=29716,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=29740 /prefetch:14⤵PID:13876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --field-trial-handle=30028,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30048 /prefetch:14⤵PID:12932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=30320,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30340 /prefetch:84⤵PID:13588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=30328,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30396 /prefetch:84⤵PID:13660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=30368,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30444 /prefetch:84⤵PID:13668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=30420,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30864 /prefetch:84⤵PID:13908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --field-trial-handle=4800,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=31328 /prefetch:14⤵PID:9640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --field-trial-handle=31580,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=31544 /prefetch:14⤵PID:13676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --field-trial-handle=30852,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30180 /prefetch:14⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=31552,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32048 /prefetch:84⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=31552,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32048 /prefetch:84⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --field-trial-handle=32288,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32296 /prefetch:14⤵PID:13704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --field-trial-handle=12648,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12624 /prefetch:14⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --field-trial-handle=29976,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28196 /prefetch:14⤵PID:13700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=31096,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23752 /prefetch:84⤵PID:14068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --field-trial-handle=31104,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22268 /prefetch:14⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --field-trial-handle=31044,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=22740 /prefetch:14⤵PID:14292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --field-trial-handle=31964,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=31948 /prefetch:14⤵PID:13604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=21688,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32528 /prefetch:84⤵PID:14764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --field-trial-handle=23740,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=31796 /prefetch:14⤵PID:14836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --field-trial-handle=29360,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=29408 /prefetch:14⤵PID:14724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --field-trial-handle=22460,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32664 /prefetch:14⤵PID:13688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --field-trial-handle=27584,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12352 /prefetch:14⤵PID:14496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --field-trial-handle=22796,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28188 /prefetch:14⤵PID:14448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4100,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:24⤵PID:15108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3920,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:24⤵PID:15080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --field-trial-handle=30600,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30060 /prefetch:14⤵PID:13404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=27972,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28208 /prefetch:84⤵PID:7688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4372,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=31220 /prefetch:84⤵PID:12348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --field-trial-handle=3132,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14⤵PID:7924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --field-trial-handle=13536,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20904 /prefetch:14⤵PID:8088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --field-trial-handle=31060,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28536 /prefetch:14⤵PID:11316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --field-trial-handle=4764,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26892 /prefetch:14⤵PID:8168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --field-trial-handle=26352,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28532 /prefetch:14⤵PID:8108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --field-trial-handle=5036,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30276 /prefetch:14⤵PID:9100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --field-trial-handle=10276,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30608 /prefetch:14⤵PID:6344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --always-read-main-dll --field-trial-handle=30352,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30732 /prefetch:14⤵PID:8892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --always-read-main-dll --field-trial-handle=25896,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14⤵PID:8148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --always-read-main-dll --field-trial-handle=25912,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27332 /prefetch:14⤵PID:7820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --always-read-main-dll --field-trial-handle=25244,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25256 /prefetch:14⤵PID:7708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --always-read-main-dll --field-trial-handle=25284,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25272 /prefetch:14⤵PID:11832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --always-read-main-dll --field-trial-handle=25024,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=24268 /prefetch:14⤵PID:8752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --always-read-main-dll --field-trial-handle=23232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23240 /prefetch:14⤵PID:9980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=3880,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:24⤵PID:13940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --always-read-main-dll --field-trial-handle=3872,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14⤵PID:13656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --always-read-main-dll --field-trial-handle=30656,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14⤵PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --always-read-main-dll --field-trial-handle=30700,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30676 /prefetch:14⤵PID:7840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --always-read-main-dll --field-trial-handle=27272,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14⤵PID:7836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --always-read-main-dll --field-trial-handle=25628,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25552 /prefetch:14⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --always-read-main-dll --field-trial-handle=30764,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30440 /prefetch:14⤵PID:15292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=162 --always-read-main-dll --field-trial-handle=22300,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=28188 /prefetch:14⤵PID:10380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=163 --always-read-main-dll --field-trial-handle=30760,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=164 --always-read-main-dll --field-trial-handle=5444,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14⤵PID:11176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=165 --always-read-main-dll --field-trial-handle=6124,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14⤵PID:8300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=166 --always-read-main-dll --field-trial-handle=5688,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14⤵PID:15236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=168 --always-read-main-dll --field-trial-handle=30608,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30604 /prefetch:14⤵PID:5460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=169 --always-read-main-dll --field-trial-handle=30740,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:14⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=170 --always-read-main-dll --field-trial-handle=27636,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27412 /prefetch:14⤵PID:6828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=171 --always-read-main-dll --field-trial-handle=4968,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=27596 /prefetch:14⤵PID:12364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=172 --always-read-main-dll --field-trial-handle=3428,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=24256 /prefetch:14⤵PID:7704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=173 --always-read-main-dll --field-trial-handle=24032,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=23504 /prefetch:14⤵PID:13576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=174 --always-read-main-dll --field-trial-handle=21696,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=21756 /prefetch:14⤵PID:14356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=175 --always-read-main-dll --field-trial-handle=21232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=21216 /prefetch:14⤵PID:9820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=176 --always-read-main-dll --field-trial-handle=20864,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20548 /prefetch:14⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=177 --always-read-main-dll --field-trial-handle=20232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=20200 /prefetch:14⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=178 --always-read-main-dll --field-trial-handle=19716,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19700 /prefetch:14⤵PID:10352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=179 --always-read-main-dll --field-trial-handle=19176,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19144 /prefetch:14⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=180 --always-read-main-dll --field-trial-handle=18156,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18228 /prefetch:14⤵PID:12956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=181 --always-read-main-dll --field-trial-handle=18096,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=18196 /prefetch:14⤵PID:12896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=182 --always-read-main-dll --field-trial-handle=17364,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=17176 /prefetch:14⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=183 --always-read-main-dll --field-trial-handle=16996,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15156 /prefetch:14⤵PID:14504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=184 --always-read-main-dll --field-trial-handle=16284,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16272 /prefetch:14⤵PID:15228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=185 --always-read-main-dll --field-trial-handle=15804,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15780 /prefetch:14⤵PID:14452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=186 --always-read-main-dll --field-trial-handle=15288,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15268 /prefetch:14⤵PID:13444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=187 --always-read-main-dll --field-trial-handle=14804,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14780 /prefetch:14⤵PID:12400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=188 --always-read-main-dll --field-trial-handle=14144,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14128 /prefetch:14⤵PID:11724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=189 --always-read-main-dll --field-trial-handle=13616,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=13604 /prefetch:14⤵PID:14352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=191 --always-read-main-dll --field-trial-handle=25232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=25384 /prefetch:14⤵PID:14252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=192 --always-read-main-dll --field-trial-handle=25636,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12848 /prefetch:14⤵PID:14860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=193 --always-read-main-dll --field-trial-handle=12040,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=12016 /prefetch:14⤵PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=194 --always-read-main-dll --field-trial-handle=11672,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=11492 /prefetch:14⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=195 --always-read-main-dll --field-trial-handle=11184,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=11176 /prefetch:14⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=196 --always-read-main-dll --field-trial-handle=10776,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:14⤵PID:9416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=197 --always-read-main-dll --field-trial-handle=10320,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:14⤵PID:9956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=198 --always-read-main-dll --field-trial-handle=9796,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:14⤵PID:14544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=199 --always-read-main-dll --field-trial-handle=9048,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:14⤵PID:14456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=200 --always-read-main-dll --field-trial-handle=8560,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:14⤵PID:8220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=201 --always-read-main-dll --field-trial-handle=8016,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:14⤵PID:12144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=202 --always-read-main-dll --field-trial-handle=7492,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14⤵PID:8560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=203 --always-read-main-dll --field-trial-handle=7476,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14⤵PID:12116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=204 --always-read-main-dll --field-trial-handle=32784,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32796 /prefetch:14⤵PID:13072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=205 --always-read-main-dll --field-trial-handle=32832,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=32972 /prefetch:14⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=206 --always-read-main-dll --field-trial-handle=33116,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=33128 /prefetch:14⤵PID:13796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=207 --always-read-main-dll --field-trial-handle=33296,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=33316 /prefetch:14⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=208 --always-read-main-dll --field-trial-handle=33464,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=33452 /prefetch:14⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=212 --always-read-main-dll --field-trial-handle=33640,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=33612 /prefetch:14⤵PID:14512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=211 --always-read-main-dll --field-trial-handle=33740,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=33768 /prefetch:14⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=213 --always-read-main-dll --field-trial-handle=27368,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14⤵PID:12812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=214 --always-read-main-dll --field-trial-handle=6068,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=30796 /prefetch:14⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=215 --always-read-main-dll --field-trial-handle=6664,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15432 /prefetch:14⤵PID:8124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=216 --always-read-main-dll --field-trial-handle=30604,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14696 /prefetch:14⤵PID:12708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=217 --always-read-main-dll --field-trial-handle=26148,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14⤵PID:14532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=218 --always-read-main-dll --field-trial-handle=13924,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=14324 /prefetch:14⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=219 --always-read-main-dll --field-trial-handle=13944,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15588 /prefetch:14⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=220 --always-read-main-dll --field-trial-handle=15076,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15732 /prefetch:14⤵PID:6776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=221 --always-read-main-dll --field-trial-handle=15876,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15884 /prefetch:14⤵PID:14252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=222 --always-read-main-dll --field-trial-handle=16232,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15404 /prefetch:14⤵PID:14548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=223 --always-read-main-dll --field-trial-handle=16120,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16108 /prefetch:14⤵PID:14580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=224 --always-read-main-dll --field-trial-handle=15548,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=16124 /prefetch:14⤵PID:14584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=225 --always-read-main-dll --field-trial-handle=33068,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=15976 /prefetch:14⤵PID:14004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=227 --always-read-main-dll --field-trial-handle=23264,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=26636 /prefetch:14⤵PID:12160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=228 --always-read-main-dll --field-trial-handle=4768,i,16730565243305034853,199936651517857610,262144 --variations-seed-version --mojo-platform-channel-handle=19432 /prefetch:14⤵PID:8116
-
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871384⤵PID:5704
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871385⤵PID:3748
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871386⤵PID:896
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871387⤵PID:4848
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871388⤵PID:5264
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=17441871389⤵PID:828
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713810⤵PID:4776
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:5684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713811⤵PID:3608
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713812⤵PID:1752
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713813⤵PID:5708
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713814⤵PID:3188
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713815⤵PID:5340
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713816⤵PID:3612
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713817⤵PID:4768
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713818⤵PID:6204
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713819⤵PID:6500
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:6760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713820⤵PID:7088
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713821⤵PID:6280
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:6536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713822⤵PID:6968
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713823⤵PID:7080
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:6240 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713824⤵PID:6472
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713825⤵PID:6016
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713826⤵PID:6284
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713827⤵PID:4700
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:6448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713828⤵PID:2608
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713829⤵PID:5988
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713830⤵PID:752
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713831⤵PID:5108
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:6924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713832⤵PID:3232
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713833⤵PID:7180
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7336 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713834⤵PID:7448
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:7636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713835⤵PID:7920
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:8084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713836⤵PID:7476
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:7344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713837⤵PID:7704
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:7960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713838⤵PID:7828
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:7252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713839⤵PID:7824
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:8156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713840⤵PID:7244
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713841⤵PID:7288
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:8176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713842⤵PID:8136
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713843⤵PID:7692
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713844⤵PID:7264
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713845⤵PID:8376
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713846⤵PID:8648
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:8800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713847⤵PID:9128
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"47⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:7228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713848⤵PID:8388
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"48⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713849⤵PID:9008
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"49⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
PID:9196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713850⤵PID:8288
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"50⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713851⤵PID:8784
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"51⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:9132 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713852⤵PID:8280
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"52⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:9060 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713853⤵PID:7776
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"53⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2820 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713854⤵PID:7948
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"54⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713855⤵PID:7948
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"55⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:8416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713856⤵PID:9356
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"56⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:9536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713857⤵PID:9708
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"57⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:9968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713858⤵PID:10132
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"58⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:9464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713859⤵PID:9884
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"59⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:9808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713860⤵PID:8636
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"60⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713861⤵PID:9968
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"61⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
PID:9888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713862⤵PID:8984
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"62⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:8500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713863⤵PID:9804
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"63⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:9476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713864⤵PID:8416
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"64⤵PID:9656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713865⤵PID:8980
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"65⤵PID:9376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713866⤵PID:10140
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"66⤵PID:8300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713867⤵PID:9408
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"67⤵PID:8292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713868⤵PID:2084
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"68⤵PID:10356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713869⤵PID:10684
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"69⤵PID:10836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713870⤵PID:10944
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"70⤵PID:11152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713871⤵PID:10396
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"71⤵PID:10576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713872⤵PID:10788
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"72⤵PID:11060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713873⤵PID:10448
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"73⤵PID:11232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713874⤵PID:10676
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"74⤵PID:10936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713875⤵PID:10576
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"75⤵PID:11128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713876⤵PID:8292
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"76⤵PID:10936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713877⤵PID:10580
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"77⤵PID:11244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713878⤵PID:10264
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"78⤵PID:9952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713879⤵PID:11144
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"79⤵PID:10540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713880⤵PID:10480
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"80⤵PID:11384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713881⤵PID:11728
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"81⤵PID:11952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713882⤵PID:12048
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"82⤵PID:12208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713883⤵PID:11488
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"83⤵PID:11764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713884⤵PID:11996
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"84⤵PID:12164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713885⤵PID:11528
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"85⤵PID:11948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713886⤵PID:12140
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"86⤵PID:11304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713887⤵PID:11576
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"87⤵PID:12080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713888⤵PID:11684
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"88⤵PID:804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713889⤵PID:12124
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"89⤵PID:12140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713890⤵PID:12176
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"90⤵PID:12384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713891⤵PID:12468
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"91⤵PID:12696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713892⤵PID:13012
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"92⤵PID:13168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713893⤵PID:13284
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"93⤵PID:12348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713894⤵PID:11288
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"94⤵PID:12912
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713895⤵PID:13048
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"95⤵PID:12128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713896⤵PID:12636
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"96⤵PID:12876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713897⤵PID:12920
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"97⤵PID:12668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713898⤵PID:12860
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"98⤵PID:13008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=174418713899⤵PID:12864
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"99⤵PID:12536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138100⤵PID:12668
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"100⤵PID:13056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138101⤵PID:12300
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"101⤵PID:12556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138102⤵PID:13440
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"102⤵PID:13704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138103⤵PID:13820
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"103⤵PID:13996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138104⤵PID:12864
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"104⤵PID:13552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138105⤵PID:2216
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"105⤵PID:5140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138106⤵PID:14056
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"106⤵PID:14160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138107⤵PID:13624
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"107⤵PID:13864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138108⤵PID:13332
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"108⤵PID:13464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138109⤵PID:13884
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"109⤵PID:5272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138110⤵PID:12900
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"110⤵PID:13576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138111⤵PID:13848
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"111⤵PID:4992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138112⤵PID:14272
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"112⤵PID:6184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138113⤵PID:3788
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"113⤵PID:14496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138114⤵PID:14816
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"114⤵PID:15080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138115⤵PID:14688
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"115⤵PID:15200
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138116⤵PID:14344
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"116⤵PID:14708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138117⤵PID:15120
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"117⤵PID:15168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138118⤵PID:6180
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"118⤵PID:15308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138119⤵PID:8568
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"119⤵PID:5188
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138120⤵PID:5640
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"120⤵PID:13444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138121⤵PID:4180
-
-
C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"C:\Users\Admin\AppData\Roaming\webnavi\openvi.exe"121⤵PID:11520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bacdau.vn/?tn=test&mc=8BD81C6940A04AD8207496113AC940D2&i=1697537500&t=1744187138122⤵PID:12392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-