Overview

overview

7

Static

static

3

9e24803ef4...2e.exe

windows10-2004-x64

7

9e24803ef4...2e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    1s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 23:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e.exe
  • Size 5.4MB
  • Sample260801-3vs74sztct
  • SHA256 9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 11 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 16 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Views/modifies file attributes 1 TTPs 15 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e.exe
    "C:\Users\Admin\AppData\Local\Temp\9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e.exe
      "C:\Users\Admin\AppData\Local\Temp\9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe"
          4⤵
          • Views/modifies file attributes
          PID:5716
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
          PID:4536
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x358,0x7fff27a5c188,0x7fff27a5c194,0x7fff27a5c1a0
            4⤵
              PID:4908
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,11892627972007436937,10924277966199430617,262144 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
              4⤵
                PID:6140
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,13776570507331726867,4382367833374769360,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
                4⤵
                • System Time Discovery
                PID:5704
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,14926044281511601345,5561078109006624380,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
                4⤵
                  PID:5676
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,8398790889895744924,538995770433739362,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
                  4⤵
                    PID:1140
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7019057307215085299,7928755024005179327,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
                    4⤵
                      PID:3576
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,16366606070916718891,17082200797362072675,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                      4⤵
                        PID:568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4754251778847468734,13071478824240244466,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
                        4⤵
                          PID:4944
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4412,i,9389360721439543850,14413368064286573373,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
                          4⤵
                            PID:2784
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4824,i,16390197780656327846,13363726965201482106,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
                            4⤵
                              PID:4276
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4904,i,12489322724992265684,10448793479311358447,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
                              4⤵
                                PID:3936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3908,i,13046535921898936528,1311597419168505172,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:1
                                4⤵
                                  PID:5804
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,11662383935328672370,1192471342464742116,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
                                  4⤵
                                    PID:4588
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6072,i,8293985598333792350,9242333220693941964,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
                                    4⤵
                                      PID:5584
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6240,i,8160776239448414766,14663098987711723264,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
                                      4⤵
                                        PID:2816
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6408,i,10574017799029175828,1661031719007968330,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
                                        4⤵
                                          PID:5712
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6576,i,13506181769928914941,12740158218398956571,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
                                          4⤵
                                            PID:716
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,7463565631215563437,15270716703605065386,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
                                            4⤵
                                              PID:6076
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10149250313373475391,15566395595445332977,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
                                              4⤵
                                                PID:5432
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,16355069982696550847,14911424152378804998,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:12
                                                4⤵
                                                  PID:5012
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,4296756747793345381,13839706778014337266,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14
                                                  4⤵
                                                    PID:1228
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,4296756747793345381,13839706778014337266,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14
                                                    4⤵
                                                      PID:4640
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7628,i,14613541054764829887,4483574158829148478,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
                                                      4⤵
                                                        PID:5176
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7516,i,10146074987714370642,5560649739903955266,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
                                                        4⤵
                                                          PID:1496
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7968,i,3977021590771667995,583606550715310449,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:1
                                                          4⤵
                                                            PID:2296
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8116,i,5895421893258490511,8513082897666485291,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
                                                            4⤵
                                                              PID:3828
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8196,i,2749647014247514603,11309150135933740303,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
                                                              4⤵
                                                                PID:4420
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7876,i,5396386318033713802,16822513502420884874,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:1
                                                                4⤵
                                                                  PID:4920
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8144,i,13064790123312139212,4695907360239632869,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
                                                                  4⤵
                                                                    PID:6892
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,16316597643764765576,13047905767957960663,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:14
                                                                    4⤵
                                                                      PID:6720
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8744,i,9809594922162996079,4553954432194353074,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
                                                                      4⤵
                                                                        PID:7004
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1976111599583799935,14058589910961985502,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9672 /prefetch:14
                                                                        4⤵
                                                                          PID:2912
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4272,i,11887971353484507928,11613966356677676446,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
                                                                          4⤵
                                                                            PID:4052
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8812,i,16739078772983610667,3471505897937455019,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9856 /prefetch:1
                                                                            4⤵
                                                                              PID:1496
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8836,i,10687392519604663329,14659805132113332741,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
                                                                              4⤵
                                                                                PID:7176
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8808,i,5773186467198377816,9974135143476006419,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
                                                                                4⤵
                                                                                  PID:7184
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8896,i,5608802345038988912,4967632783679120188,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=9988 /prefetch:1
                                                                                  4⤵
                                                                                    PID:7192
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8944,i,2047346627737221386,11142968297902499731,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
                                                                                    4⤵
                                                                                      PID:7200
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8980,i,8449859166853538914,4054459737944339854,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
                                                                                      4⤵
                                                                                        PID:7208
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=4376,i,4183878992074004480,2460228847284870893,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
                                                                                        4⤵
                                                                                          PID:7216
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9116,i,10501227184124833160,14145434766803524150,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
                                                                                          4⤵
                                                                                            PID:7224
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6000,i,15179870722734737164,2314752504161216296,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10152 /prefetch:1
                                                                                            4⤵
                                                                                              PID:7232
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5976,i,4113002703299955928,17620919665043130383,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:1
                                                                                              4⤵
                                                                                                PID:7240
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5996,i,11887612156060617124,13369609616249121260,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:7248
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4284,i,9716189038885688059,4244221358060386088,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10260 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:7256
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9224,i,7384437356728997890,6401870065666581474,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:7264
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9264,i,15385051911935771556,3980598662641632069,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:7272
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5952,i,1734847183612039570,4675343771490744812,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10272 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:7280
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9320,i,12906332121264291250,9438125468187451127,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:7288
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9168,i,17974590348871288867,8879936981596816481,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10208 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:7296
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8240,i,10290352548306288300,16428106387989484898,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:7304
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9348,i,1147187291219978392,14501892098300492820,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:7312
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9356,i,10994847181498352619,3928705935862655459,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10400 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:7320
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9416,i,12540907057475761215,8453920976977033700,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:7328
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5812,i,13752231113067001623,7074766146973780845,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10320 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:7336
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9280,i,5939336060770335865,13969419103100050887,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10340 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:7344
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4296,i,11474874963939977424,12580078331953951615,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11036 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:3544
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=4720,i,862053327212069426,7858999406621537364,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:2604
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7908,i,16748834633021320696,13362663767605331346,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11252 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:7612
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=7856,i,6740773162783858072,1647298983436590292,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10836 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:7652
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=5524,i,10039110230005254955,10674158974944584717,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10864 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:7588
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9372,i,4806301145194890622,14998711070280896097,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11288 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:7664
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4456,i,2575798513740764749,10107926129986627132,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11084 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:7672
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4936,i,3820811677771600140,6821491742088603284,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:3356
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4484,i,10243645091168791092,10687808770830250359,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:7636
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7756,i,7018118091879397451,4105068166230602740,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:7720
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9460,i,11885796997132418502,12765337711558518889,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:4696
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7688,i,9595305832696753698,8413348324269616658,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11108 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:7712
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4656,i,16774592947685062484,14360775787914930273,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11088 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:7704
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4648,i,6636668550098318552,5601495535322628100,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:7752
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=4888,i,11457643263133594784,2350304279879215033,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10960 /prefetch:1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:7584
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7636,i,4917031796633286454,18080657233474532043,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:1
                                                                                                                                                        4⤵
                                                                                                                                                          PID:7580
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4868,i,15628311795896839175,12256628510796717910,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10964 /prefetch:1
                                                                                                                                                          4⤵
                                                                                                                                                            PID:7692
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9428,i,5756554137394487813,15616357421678109747,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11168 /prefetch:1
                                                                                                                                                            4⤵
                                                                                                                                                              PID:7728
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9444,i,6774919093486098412,15495936360039402704,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11148 /prefetch:1
                                                                                                                                                              4⤵
                                                                                                                                                                PID:7760
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7820,i,15012471400234712249,12164587481819815094,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11236 /prefetch:1
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:7736
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=4952,i,13080882135758974341,17509937497034407878,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:7748
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9468,i,16805557791914195459,14916240385969913839,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11328 /prefetch:1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:7744
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4844,i,4714288699293004667,13524665335767254432,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11348 /prefetch:1
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:7780
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9496,i,7666632912338901763,16681909131505940631,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11484 /prefetch:1
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:7788
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=4448,i,17536698458074333896,11806662237775067804,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11624 /prefetch:1
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:7820
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9552,i,10193976795729088659,12244686000881295757,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11560 /prefetch:1
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:7844
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9528,i,14682311787014817835,6393075492152205021,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11556 /prefetch:1
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:7796
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9588,i,6095844151005883441,5813445300486629681,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11576 /prefetch:1
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:7836
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=9640,i,8073991386413355275,7218397281609803088,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11612 /prefetch:1
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:7812
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9572,i,12831988254733020423,3799851566096370884,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11564 /prefetch:1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:7824
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=9632,i,16941388459958369146,642287965594369462,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11616 /prefetch:1
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:7848
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=9744,i,5208850664138050172,4233399639062552027,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:1
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:7792
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=9696,i,3287601287163707774,3682856997807394120,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:1
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:7880
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9776,i,14628959595858022727,5441075747839751396,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11704 /prefetch:1
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:7896
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9684,i,8848305995076687353,4428906913190046756,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11724 /prefetch:1
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:7888
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=7276,i,14964019340496052452,14040589625964778777,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11792 /prefetch:1
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=9832,i,2702858238887512576,5131573662214066002,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11744 /prefetch:1
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9772,i,3594199903625396432,14324356697439003526,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=11664 /prefetch:1
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10740,i,16979485320483880903,15326775522801383054,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=10688 /prefetch:1
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:7968
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10724,i,12188026924312912782,13211497292583195219,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14784 /prefetch:1
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:7956
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,7557417604943880463,2645814154155550813,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14900 /prefetch:14
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:7924
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10716,i,1877809735331145452,11983810197974534340,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14788 /prefetch:1
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:7972
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10828,i,17138711151040494151,181132842747597230,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14848 /prefetch:1
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:7932
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10780,i,8181826911243733932,12748937915378113886,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14852 /prefetch:1
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:7940
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10924,i,13642915116725399751,3767449035575323953,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14888 /prefetch:1
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:7920
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10804,i,14264420917022920404,13786736519648227872,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14836 /prefetch:1
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:7908
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,9313700535243566308,17238766748792865489,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=14992 /prefetch:14
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:7976
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,15525600511064941192,11138409080153891647,524288 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15072 /prefetch:14
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:7984
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10916,i,5367079284597457090,5348443239399055088,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15160 /prefetch:1
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:7988
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10888,i,17834876309297072448,7354930022833232501,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15164 /prefetch:1
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:8024
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10884,i,5241150185461423690,4271102916861555323,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15228 /prefetch:1
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:8008
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11008,i,12347601659132719607,7682810773314629692,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15168 /prefetch:1
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:8016
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=10988,i,7019728953427545796,17797807831865448710,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15284 /prefetch:1
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:8032
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11072,i,7155497717919741431,6139354194083678568,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15212 /prefetch:1
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:8088
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11048,i,8848658010391950119,6927779266345906084,2097152 --field-trial-handle=2412,i,855211006578341342,896089259728658686,262144 --variations-seed-version --mojo-platform-channel-handle=15180 /prefetch:1
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:8044
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3828
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1904
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1380
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5716
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                      PID:3084
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1128
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2540
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oiq5afua\rchnyk9y.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                      PID:6216
                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                        PID:6344
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6572
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:6592
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:6644
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6664
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:6796
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6376
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:6904
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9r3dkdp\nnbzd0cf.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:6996
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                      PID:7096
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                        PID:7152
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:6340
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:6300
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6424
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6376
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:6256
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1j1lxmk9\glzexf7w.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:6592
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                    PID:6672
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:6880
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:6988
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:7088
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:6156
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:6380
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtsxcqsv\e25ys1kn.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:6468
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                  PID:6520
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:6744
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:6720
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:6688
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:7032
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:7092
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:6276
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lado09h2\hdvpbczx.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:6420
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                  PID:3932
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:6700
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:6840
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:7064
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:6340
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pybwslhl\rj71hjts.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:6676
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6808
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6988
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1392
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xkgm8l2q\at1cgpll.exe
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                            PID:2760
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                              PID:3212
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5932
                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6568
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03qr659l\dbrvm94h.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6940
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                          PID:6232
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                            PID:6884
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6556
                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6556
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ag6n8a3i\n2irttfa.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3604
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                          PID:6888
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7476
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7588
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7688
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7792
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4yrgj47z\0tbg0gwh.exe
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7852
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7956
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:8008
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:8060
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7496
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7560
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q3sowdvl\twedo7dw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7548
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8248
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9936
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9896
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10088
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10016
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7516
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l518n12i\ts59di48.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8620
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9952
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8196
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9400
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9940
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9876
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10004
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9888
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vmglf0et\4tbm9e02.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10304
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10748
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10300
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11520
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11832
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12096
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11524
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7872
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12152
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zyk5nt21\5xkwojlw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0gx3ds6w\haws803m.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4192

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_00004d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 281KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_00004e
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_00004f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 74KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000050
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000051
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 69KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000052
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e3337541f7bf46df169e816b2a7b53fd29065c6fa5b856e5d9c4f07859c6e262
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000053
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 57KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000054
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 105KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1e51d10113e4c1547eb35b2547582e98c51140478b897f26154d1af26fa8fef3
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000055
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 90KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b48363bf074f8091eaf45b3e2537fcd7234e337968ed1eee25a24c4baba60911
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000056
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 149KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f88317d2d9277801ff3151e5079d70e4ff4c330fb367fcf89d914fd3ea8c97cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000057
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 215KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000058
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 219KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000063
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              f_000064
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 98e01cf5b937322b9b0ce68afbc6f1cf73706dde495ed9724ea0e86c441db36f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 51feb1b15fa5539f79280f1bf76872825659192b64dfa02d5e5d95e4f0ec3b26
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 39afa1e9c9e88a2c94e8e88bbb3f2707eb9e7ca89f3d84562be26ebaf9c0b96b
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              the-real-index~RFe5a257b.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a257b.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 dc0df026633376e1a41206355e8284a4abbb4aa386026283ab742f686aad667a
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 458a93d37545d1b610edad370c32f8e6257ddd1f32b4f17202abc69c766a8096
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4321873fedd0de7fdd5bbf2375b2cbcbb6091826a63b5e3f3a09dcde3d99d929
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 3546b7f3e5e54e857280458a0aa5b195bf5335f782781bc2c216cc166fd554f7
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 affb975e1eb740d6f967ee7c5c658f3138f604bc08185b51dabd77f5c7317fc8
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1699fd00fbdaca612b6707b64a0f19c91d48822884126f52899be09d6e1ed7dc
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c98198a2bab9e46de5c95bcef07d417d6350c8cb79c39f386c624cf97fca948f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              OperationConfig
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              OperationConfig~RFe5a3eef.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3eef.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e0050db591613ee93c4c469e93ff504bdf245745c2b40f57e4ad5b1d4516dbf3
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 32857a23951093ba8ba33c8af62450a3d4d5254197553527e090425d16db1591
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8833ecc6ce76471583a1ca432110b248a1895ddfd8c7f3eb189926339bbe224d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0238f5e61f1cf4e313c0f2d61aad31f96d54c414395ad560cc4c0ed6a6733b1e
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 28979e39a3bffe3f11a55c1ec90659c1dd7d4a7f262baea6ecabd2eb5966a0aa
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 597f9cefdc067d6d94393d04b76e71000640a41753a56112f7b55bcdfdee6db9
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 38cedc4ded37f0af98955736f40708074e574bec1fc5ce93e4a06306c4216f48
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 402c19e729dd5ae34dbecac5e794e6ffa0304b525d159d3280715a2486964c59
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 77220a01ce0351b5c4a9c29be06aac67baf8751c9286a20f04a096e1e83f48f1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 559139442dac9ecfda9cfb9bf3413d076ca87ae5cf6e20bca756fb03da19cd91
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 08a35dd1929bd7d3444ee43d667fed859c74717e2cbd63fdb94ee5401a0983b5
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2c3d6f8bdba21582675fc725c5adfbfcd5c55cf0a8f0b12bcf92835595cb5062
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 cf62124722bf1d50efbc70118eaa827a46c51bc8af2c32735c3e36c63cf715c6
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 67a3614fb0f16a84d82aa7f615294f40446073df88c9f08094b325a3a509e528
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9790f822c36fd46758404d10da72fae135e8893b8d26ec18e83c9cd4d54a84f5
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4f09c9daae0f1cf1a85d683e133ddff1a2016130cec1476092c7f5bd03d5f49b
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d6dca877c438a2dd249e25a8dfab96694ba230c377df5a45b43894254c7d121d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 14bf30ec27c6f9d23911b8fb811ea4e05a08820f3e3bf7271713943f6066dc53
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 aa09d0c98b4433f0a789507a6eb59dcb7552757c0592c293220d1dd961e198dc
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 153KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              23fdadc5-9018-4b27-929c-ccac51f325cd.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\23fdadc5-9018-4b27-929c-ccac51f325cd.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 94KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 265KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 64KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 159KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 78KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 151KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              _uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 711KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8d5a44b741f1637eb707f4e49b7c5cd49d3d58c4806e94138de7139495ad9be3
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 678KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              python39.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\python39.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              6cozmez5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5rzrrmw\6cozmez5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9e24803ef467e3c0e454d592fa73e0a318cf4567dc1c4e656db3c7083af0092e
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download