34c720b98fa5a286f8ff821a2a909cfbb17e389764ad7ceae3ec06583fecb42f

Analysis

max time kernel
4s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260802-3dyfhaywcs
SHA256 34c720b98fa5a286f8ff821a2a909cfbb17e389764ad7ceae3ec06583fecb42f
MD5 f30ee82dd4994838d656516a746cc89d
SHA1 94227f6c6930cc3f1716238eb18d786e0cf0ebaa
SHA512 de99a18ea3713a5f5a1cfda24bed1d008b6875e8c038f5b1e03beafda4b345bf9830ae3bd51f0bddcfa7beead09862dd01c3be7f013450c797249dd362e81773
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6ul:AsTICteErownP0oTcMsABqljko
TLSH
T125463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ofs7wj.exe	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ofs7wj.exe	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Loads dropped DLL 12 IoCs

pid	Process
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\3u8f3hms\\7j3q9wtp.exe"	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
949	ifconfig.me
3032	ifconfig.me
4820	ifconfig.me
5984	ifconfig.me
6666	ifconfig.me
786	ifconfig.me
1626	ifconfig.me
1642	ifconfig.me
4221	ifconfig.me
5422	ifconfig.me
5716	ifconfig.me
1780	ifconfig.me
2445	ifconfig.me
2018	ifconfig.me
3518	ifconfig.me
4306	ifconfig.me
356	ifconfig.me
13014	ifconfig.me
3638	ifconfig.me
1206	ifconfig.me
2152	ifconfig.me
9652	ifconfig.me
3522	ifconfig.me
134	ifconfig.me
267	ifconfig.me
281	ifconfig.me
765	ifconfig.me
2428	ifconfig.me
4387	ifconfig.me
6322	ifconfig.me
9366	ifconfig.me
2919	ifconfig.me
3756	ifconfig.me
6674	ifconfig.me
14823	ifconfig.me
2260	ifconfig.me
4037	ifconfig.me
11804	ifconfig.me
188	ifconfig.me
413	ifconfig.me
1747	ifconfig.me
4166	ifconfig.me
6283	ifconfig.me
6813	ifconfig.me
6986	ifconfig.me
8614	ifconfig.me
3697	ifconfig.me
12304	ifconfig.me
13818	ifconfig.me
15047	ifconfig.me
15157	ifconfig.me
341	ifconfig.me
1431	ifconfig.me
3888	ifconfig.me
7567	ifconfig.me
13639	ifconfig.me
8926	ifconfig.me
11417	ifconfig.me
14126	ifconfig.me
1018	ifconfig.me
119	ifconfig.me
483	ifconfig.me
2673	ifconfig.me
4004	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
14940	cmd.exe
5776	cmd.exe
4884	cmd.exe
6300	cmd.exe
8264	cmd.exe
11156	cmd.exe
12768	cmd.exe
12428	cmd.exe
16164	cmd.exe
6052	cmd.exe
4880	cmd.exe
10120	cmd.exe
13020	cmd.exe
7188	cmd.exe
7456	cmd.exe
7464	cmd.exe
6560	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 3956	6012	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	87
PID 3956 wrote to memory of 5776	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5776 wrote to memory of 3348	5776	cmd.exe	91
PID 3956 wrote to memory of 2884	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 2884 wrote to memory of 4132	2884	msedge.exe	93
PID 3956 wrote to memory of 4172	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 3956 wrote to memory of 2056	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 3956 wrote to memory of 4464	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 3956 wrote to memory of 2000	3956	2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 2884 wrote to memory of 3608	2884	msedge.exe	99
PID 2884 wrote to memory of 1584	2884	msedge.exe	100
PID 2884 wrote to memory of 1584	2884	msedge.exe	100
PID 2884 wrote to memory of 1584	2884	msedge.exe	100
PID 2884 wrote to memory of 3060	2884	msedge.exe	101
PID 2884 wrote to memory of 3060	2884	msedge.exe	101
PID 2884 wrote to memory of 5084	2884	msedge.exe	103
PID 2884 wrote to memory of 5084	2884	msedge.exe	103
PID 2884 wrote to memory of 5084	2884	msedge.exe	103
PID 2884 wrote to memory of 1788	2884	msedge.exe	104
PID 2884 wrote to memory of 1788	2884	msedge.exe	104
PID 2884 wrote to memory of 1788	2884	msedge.exe	104
PID 2884 wrote to memory of 3676	2884	msedge.exe	105
PID 2884 wrote to memory of 5700	2884	msedge.exe	106
PID 2884 wrote to memory of 3676	2884	msedge.exe	105
PID 2884 wrote to memory of 3676	2884	msedge.exe	105
PID 2884 wrote to memory of 5700	2884	msedge.exe	106
PID 2884 wrote to memory of 5700	2884	msedge.exe	106
PID 2884 wrote to memory of 4368	2884	msedge.exe	107
PID 2884 wrote to memory of 4368	2884	msedge.exe	107
PID 2884 wrote to memory of 4368	2884	msedge.exe	107
PID 2884 wrote to memory of 4836	2884	msedge.exe	108
PID 2884 wrote to memory of 4836	2884	msedge.exe	108
PID 2884 wrote to memory of 4836	2884	msedge.exe	108
PID 2884 wrote to memory of 1568	2884	msedge.exe	109
PID 2884 wrote to memory of 1568	2884	msedge.exe	109
PID 2884 wrote to memory of 1568	2884	msedge.exe	109
PID 2884 wrote to memory of 3636	2884	msedge.exe	110
PID 2884 wrote to memory of 3636	2884	msedge.exe	110
PID 2884 wrote to memory of 3636	2884	msedge.exe	110

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4664	attrib.exe
7680	attrib.exe
4476	attrib.exe
5208	attrib.exe
8324	attrib.exe
12828	attrib.exe
12504	attrib.exe
3348	attrib.exe
8396	attrib.exe
10320	attrib.exe
11300	attrib.exe
16264	attrib.exe
5924	attrib.exe
6708	attrib.exe
7252	attrib.exe
3316	attrib.exe
15208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_f30ee82dd4994838d656516a746cc89d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe"
      4⤵
      Views/modifies file attributes
      PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x35c,0x7ffdbd1cc188,0x7ffdbd1cc194,0x7ffdbd1cc1a0
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,17468208782783287378,14498561025137278316,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      System Time Discovery
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,11638263042307933441,16750284305803737295,262144 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,18341563907858314970,10476682801772021660,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,10618904747226366140,15281629945720256622,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,6234392495426901810,9502768295774914662,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,7075872573274858486,5973446588605647006,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,5564057105874203724,7602158475551949674,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4328,i,11484835023615284730,6198339395225430302,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4508,i,1004607613348046543,16367434279038940103,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4992,i,8256087797720644344,18122455004645937018,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5148,i,5727645808091762199,503576099522043652,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2714444030234566854,2000065266570069916,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3880,i,17270205599299883437,8347718057397282722,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3932,i,4895207547912751695,17837323902125044648,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6464,i,20740887023550928,14777566906933190598,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6484,i,14860572633826577229,7472075989665645646,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6776,i,3479619168623488705,5601822211366541667,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,12730657393729387935,3025050570552833417,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,4547578615140295830,16894783269604750506,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6128,i,4108477662143362182,10719166453814113436,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7768,i,10583277698272776359,15922078465104657061,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7928,i,4623852933773555983,5669664394762374041,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8100,i,13024553432551735505,1878887116569849812,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8268,i,5778143364165725888,6522301294611406764,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8536,i,1320186401803887623,5087824230958751548,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8536,i,1320186401803887623,5087824230958751548,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8712,i,4190049807274523641,11824796288554532746,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8872,i,12536379626926316168,889372109077142460,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9068,i,11702749321379137276,7348145443250359141,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9220,i,14940214481251365522,13753480798148558573,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9376,i,15861682090518015864,643270550703561634,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9664,i,10145601915996437725,17209415259779329667,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:14
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9880,i,17444959797532820065,13791383317203871463,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:14
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=10268,i,7726033053995875548,2152870736198123368,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10336 /prefetch:1
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10624,i,18122293330780304646,9234664280942556819,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10620 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10280,i,14134434001260723555,7147646796584862973,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10604 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10824,i,739727226010917755,1552321247830768787,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10980 /prefetch:1
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=11144,i,9600472552218458470,7671489325206053196,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11140 /prefetch:1
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9928,i,200036118122971701,16446074220821845367,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=9948 /prefetch:1
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9608,i,16691333334839871150,13763073054546384042,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11004 /prefetch:1
      4⤵
      PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9984,i,15173458399546545039,15459543262196437312,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10000 /prefetch:1
      4⤵
      PID:7548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11464,i,6625685404482028853,5129268265291025005,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11344 /prefetch:1
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11304,i,3374407307921086827,1752092912464195704,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:1
      4⤵
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11656,i,11848580887045028072,12370446392481390003,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11652 /prefetch:14
      4⤵
      PID:8048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11896,i,2208174380444057019,5960266919592834833,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11884 /prefetch:14
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12248,i,17720046057308018315,2795339764391915362,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12252 /prefetch:1
      4⤵
      PID:7908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12408,i,4048086963948531748,1069385819152603968,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12296 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12692,i,12415277039146267527,12123301249520326097,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12704 /prefetch:1
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12820,i,15992041245886621428,13580135880574639328,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12832 /prefetch:1
      4⤵
      PID:7676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12980,i,16739507696204490761,14691716495012896320,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12984 /prefetch:1
      4⤵
      PID:7912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=13176,i,13106937045401016629,12959638404927911023,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=13192 /prefetch:1
      4⤵
      PID:8452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12640,i,6290020290953244020,14027430070634578134,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12612 /prefetch:1
      4⤵
      PID:8560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12592,i,7472640084001820154,13533591612898814879,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12628 /prefetch:1
      4⤵
      PID:8716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13424,i,1916674645958875525,15436347703760680760,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=13400 /prefetch:1
      4⤵
      PID:8844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13592,i,2869262069744142011,12834443311577981514,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=13612 /prefetch:1
      4⤵
      PID:8960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13856,i,1305470107886861689,8950968997880892182,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=13728 /prefetch:1
      4⤵
      PID:8584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13896,i,6940217174584352531,18200351327457893908,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14080 /prefetch:1
      4⤵
      PID:8676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=14104,i,5686315665562232257,17617323726288305635,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14096 /prefetch:1
      4⤵
      PID:9096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=13992,i,14941788606403387117,14360105006542488042,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14132 /prefetch:1
      4⤵
      PID:8292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=14452,i,15448273202455025064,11719519303194508435,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14428 /prefetch:1
      4⤵
      PID:8392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=14584,i,6806636241599775361,14620882631553236484,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14600 /prefetch:1
      4⤵
      PID:8352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=14736,i,1656481618760447244,1733857962499224275,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:1
      4⤵
      PID:8548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=14924,i,2488696521615199484,12658798412793775357,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14940 /prefetch:1
      4⤵
      PID:8692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=15044,i,10967598081585304482,3525910491804378283,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14780 /prefetch:1
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=15244,i,12181081141796142357,12912720856064685312,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=15256 /prefetch:1
      4⤵
      PID:9248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=5144,i,15169228336718958218,2791397913400310592,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:9316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=15436,i,14593464909767799355,887736689956267100,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=15532 /prefetch:1
      4⤵
      PID:9376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=15656,i,11322838870895067474,17000040784115777255,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
      4⤵
      PID:9440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7900,i,9221630337465825723,16349768366749438482,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=15760 /prefetch:1
      4⤵
      PID:9456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=15868,i,4734810939230954841,11273047210416463393,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=15912 /prefetch:1
      4⤵
      PID:9516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=15920,i,16651975220847057791,1261826272050278273,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=16048 /prefetch:1
      4⤵
      PID:9628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9092,i,10850705267165717199,5965920044104677420,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=16200 /prefetch:1
      4⤵
      PID:9700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=16416,i,281710205590938859,15185439505162210317,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=16444 /prefetch:1
      4⤵
      PID:9812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=16468,i,7755940081809410299,12932973025088203337,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=10944 /prefetch:1
      4⤵
      PID:9904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=16424,i,3926389171551681659,6634848577193483113,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=11492 /prefetch:1
      4⤵
      PID:9988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=16876,i,1501496964462244707,4894811507028168308,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=16884 /prefetch:1
      4⤵
      PID:10048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=12060,i,3024644198927890612,12066427028824073321,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17048 /prefetch:1
      4⤵
      PID:10152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=17148,i,15439947549316605528,18216749024256627573,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=12640 /prefetch:1
      4⤵
      PID:10236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=17432,i,17305828561773747409,4640299817582271817,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17472 /prefetch:1
      4⤵
      PID:10224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=17436,i,9679559427531707029,11569987401609132704,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17608 /prefetch:1
      4⤵
      PID:10348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=17772,i,8838994015885927005,10150439296257289850,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17780 /prefetch:1
      4⤵
      PID:10476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=17964,i,5892107189793646261,8351620010093993117,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17972 /prefetch:1
      4⤵
      PID:10608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=18120,i,628671247186365486,10173874884615657226,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=18128 /prefetch:1
      4⤵
      PID:10616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=18312,i,5451816204696587240,5202943903599753766,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=18348 /prefetch:1
      4⤵
      PID:10780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=18532,i,1160274702666212390,11181587570722220160,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=18584 /prefetch:1
      4⤵
      PID:10888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=17756,i,4852184141964845634,1757864157972837555,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=18576 /prefetch:1
      4⤵
      PID:11024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,9662231070147865505,667023969932205770,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14100 /prefetch:14
      4⤵
      PID:10504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13924,i,319927571293397704,13173488749617498226,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:14
      4⤵
      PID:10484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13836,i,16068810254416450776,16112560484214349868,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=18860 /prefetch:14
      4⤵
      PID:10512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,6311485965346459531,3369967355845800980,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12
      4⤵
      PID:10860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=17360,i,8052930012714155901,1250213698034460872,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17344 /prefetch:1
      4⤵
      PID:10124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=12648,i,4662868594508676990,11995801380599935052,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=17232 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=17400,i,1966470747233226538,17371580044994231801,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=14312 /prefetch:1
      4⤵
      PID:11260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=19200,i,7273358842457976430,15739561113958682125,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=19224 /prefetch:1
      4⤵
      PID:11340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=19204,i,5399976826515986214,8835274670464287023,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=19264 /prefetch:1
      4⤵
      PID:11384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=19584,i,4224237418097025734,2905327515929614005,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=19568 /prefetch:1
      4⤵
      PID:11540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=17360,i,18419368459536636277,16169425078253586316,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=19532 /prefetch:1
      4⤵
      PID:11664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=19500,i,14837330416221786155,8771252655725065004,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
      4⤵
      PID:11892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=12652,i,3680301591808273828,10205532504291343383,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20044 /prefetch:1
      4⤵
      PID:11924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=20048,i,5198271234960192122,17035118073037248782,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20140 /prefetch:1
      4⤵
      PID:12152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=20316,i,8378626479214731050,1055125474075203740,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20328 /prefetch:1
      4⤵
      PID:11308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=20452,i,4155682583823995315,14454445184753656907,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20468 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=20632,i,13882938246231644480,564295851224144253,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20520 /prefetch:1
      4⤵
      PID:12192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=20864,i,651302318823322154,10931623819840582092,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20856 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=20064,i,10585454577968911282,4701707481553545727,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22988 /prefetch:1
      4⤵
      PID:14948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=20608,i,6358757988323042377,1438220147317449289,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22948 /prefetch:1
      4⤵
      PID:14956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=21048,i,11823116637527544175,2318833902135804525,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22984 /prefetch:1
      4⤵
      PID:14972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=12008,i,4319502205455595177,3973997980339060841,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22932 /prefetch:1
      4⤵
      PID:14988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=21020,i,14701940949748874119,9850933001442380327,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=20492 /prefetch:1
      4⤵
      PID:14980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11860,i,12687345656605133229,14004042632053920447,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22808 /prefetch:1
      4⤵
      PID:14996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=9920,i,17798921884500793994,12783275451012645211,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:1
      4⤵
      PID:15004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=10032,i,14413035261332833787,11395551767943131164,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22864 /prefetch:1
      4⤵
      PID:15020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=21248,i,15130466568003320470,16774214608200971805,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22804 /prefetch:1
      4⤵
      PID:15036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=11824,i,10203176284849596559,2543379669998335307,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22844 /prefetch:1
      4⤵
      PID:15028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=9676,i,11537875775213871221,16786690067971160064,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22960 /prefetch:1
      4⤵
      PID:15044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=20452,i,17084041018003870189,11530162379863641710,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22920 /prefetch:1
      4⤵
      PID:15052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=7604,i,13567590781033651545,14073845499304687140,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22952 /prefetch:1
      4⤵
      PID:14964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11808,i,5550578000050182352,5259583201228499749,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=22884 /prefetch:1
      4⤵
      PID:15008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=22472,i,3710072075045160233,5037927609653803200,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23104 /prefetch:1
      4⤵
      PID:15060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11928,i,14211428590095673251,12344388161356760542,524288 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23000 /prefetch:14
      4⤵
      PID:15068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=22428,i,11360682731000482540,5712259337762035359,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23100 /prefetch:1
      4⤵
      PID:15076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=22512,i,4788581911876089133,9017988969843736419,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23108 /prefetch:1
      4⤵
      PID:15084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=22564,i,13794198036642259148,15847818581548182570,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23120 /prefetch:1
      4⤵
      PID:15092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=22776,i,15442040143423671338,14049572035304564493,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23172 /prefetch:1
      4⤵
      PID:15104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=22760,i,9646705335598351898,12179949134373595619,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23152 /prefetch:1
      4⤵
      PID:15112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=22744,i,3943709247230674861,1819966950843340465,2097152 --field-trial-handle=2132,i,4103515181120993401,4203245165190551697,262144 --variations-seed-version --mojo-platform-channel-handle=23132 /prefetch:1
      4⤵
      PID:15120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4848

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe
1⤵
PID:5452
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe
  2⤵
  PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe"
      4⤵
      Views/modifies file attributes
      PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe
1⤵
PID:2156
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3s6hfhbh\lwjv8vjo.exe
  2⤵
  PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6052
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe"
      4⤵
      Views/modifies file attributes
      PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3744

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe
1⤵
PID:4224
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ovyfikl6\gidomjgp.exe
  2⤵
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe"
      4⤵
      Views/modifies file attributes
      PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6652

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe
1⤵
PID:6672
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13f16fw2\qatxodo8.exe
  2⤵
  PID:6180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe"
      4⤵
      Views/modifies file attributes
      PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6900

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe
1⤵
PID:6652
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uigc6my1\nw70alqq.exe
  2⤵
  PID:6416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe"
      4⤵
      Views/modifies file attributes
      PID:7252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7708

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe
1⤵
PID:7980
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sixqg2gh\ggfbms7p.exe
  2⤵
  PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe"
      4⤵
      Views/modifies file attributes
      PID:7680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8096

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe
1⤵
PID:7376
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oi8u1zag\sxcundd0.exe
  2⤵
  PID:7272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe"
      4⤵
      Views/modifies file attributes
      PID:8324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8944

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe
1⤵
PID:9104
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0t8z33ca\onii6nwp.exe
  2⤵
  PID:8200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8264
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe"
      4⤵
      Views/modifies file attributes
      PID:8396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8344

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe
1⤵
PID:9648
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\88dbas82\vycc41qm.exe
  2⤵
  PID:9884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10120
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe"
      4⤵
      Views/modifies file attributes
      PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10772

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe
1⤵
PID:11084
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l77f3kug\lpnzroh0.exe
  2⤵
  PID:10328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe"
      4⤵
      Views/modifies file attributes
      PID:10320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:10500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:11124

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe
1⤵
PID:12076
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fye4g8wl\bswe1ykd.exe
  2⤵
  PID:12184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe"
      4⤵
      Views/modifies file attributes
      PID:11300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12144

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe
1⤵
PID:11472
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7opql3hg\zi8u0386.exe
  2⤵
  PID:12384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12768
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe"
      4⤵
      Views/modifies file attributes
      PID:12828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:12884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:12984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:13060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:13124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:13188

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe
1⤵
PID:13260
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26ff0pg3\xkae9agl.exe
  2⤵
  PID:12336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe"
      4⤵
      Views/modifies file attributes
      PID:12504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:12540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:12684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:12824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe
1⤵
PID:13168
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvz60u58\w2b4inpo.exe
  2⤵
  PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:13020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe"
      4⤵
      Views/modifies file attributes
      PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:13688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:13776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:13988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:14036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:14224

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe
1⤵
PID:8800
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0526egek\8ru5djdg.exe
  2⤵
  PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:14940
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe"
      4⤵
      Views/modifies file attributes
      PID:15208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:15464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:15608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:15832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:15920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:15976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe
1⤵
PID:15692
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yl5crx9n\nc1gyor8.exe
  2⤵
  PID:15840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\24t3tt6m\gwusu63g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:16164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\24t3tt6m\gwusu63g.exe"
      4⤵
      Views/modifies file attributes
      PID:16264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:12916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:15672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:15960

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\24t3tt6m\gwusu63g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\24t3tt6m\gwusu63g.exe
1⤵
PID:15616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 281KB
SHA256 48a7dc2101a46abc593e2106037c2a6cc3dac68575ead4281f26763bb48d8d9f
MD5 2692ed90f8933ef5fa9a073deeb48f1b
SHA1 728804c7eca44c4086fcdf110e47850607cfc755
SHA512 342b7e040c105b31ecb90e3051fd0bc330950fd02cab19897928c89c00e0122f7764f94c4bc761cfa92c7bf872a8626ae49f27cea2444bc0ecba6e78ef3337b3
SSDEEP 6144:ANKZ4VFIVbGwFmwY4KxkKEG23DsYj8PGJcuAuTyQ6/k+k7z4MX5ZFk2dVQ:1mgGwFqXkDGwsGJ/m9dkX4K5MkQ
TLSH
T10D54232F3E333A210DD4C6B37EE5A340926B71BE6E75613C1B6B2C7B41DB9098559823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 74KB
SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
MD5 a237cd8ab98a29d2fccc34f96607337c
SHA1 1a796c61601223e2cb9174dd426214d60adaf32d
SHA512 1c46b123da91b8579e9f38b00db49d98e46a5d23625de53061898adce6e5843634f993f6e9cb3520f5f591c7183e82d4804723c4f612c8c98ec4e2591adcb5e1
SSDEEP 1536:1Q1KPT86bxXCpyXy7qfigcceWUhnudSiOt6kskDvIWJ0UoRA4zCZfgQO3E:1Q1KP5VTkMlcfWUhulOTv/2klZfglU
TLSH
T1ED7312EA2E1EE3B0E6AD5D793C0A7131899C173C3ED0F72D505A483A76A9163E441C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 281KB
SHA256 edabc0e0b44df1506e44f507309a512f5875f66ac0b4d9fed141319e15e97df9
MD5 dd32464032bbede508adec67d857ded4
SHA1 fec48107e30ccdcdf48df08d8fa7d10eeb443839
SHA512 ca6b873866559f0ba756be143d0b20c9628f7c9d62640b40caf5db4fa40670f4538f574a4d46d2bb1e10ca8db888882e249a808ab7d7c1f0ef3413137dcd650f
SSDEEP 6144:QzuMspQQw9FM0dn1yTdUc64FmBhFbwenc4BJcnGiBWdtXrh4/3B:QtAQP9ai1odU6mBhOenzBmH+XN4vB
TLSH
T16954236418BD88F5407F91903EBC5AA398B7E4BDD22E0C1FA7E086CADF341623935567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 219KB
SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
MD5 479b6d25a43a71b286ba7a4307e779f9
SHA1 db4fc7ba3747464ae1de6dfec543227dcc15eae3
SHA512 ffaa11c093549e2cb433929b82162bbd6cf480319cd4fdd54f0e57602baedc41f76f4f69672ed65b4395ebfdb400b789969002016d76e30c6203c788ec5ef2e8
SSDEEP 3072:5UYfJtUH1h11Hsi6eSx9Hw7np6yu8SA4QJFu98/SRSKIlboYl28X6ioJaVS0LIbj:+YhIf15L6eSypFu8qQrDKI36io+jEzt
TLSH
T12024238EB03FBDA72B80D707A62C75216B787E8053ED2E3EA7D145E6524081F7B44972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 85KB
SHA256 7cbf591e0f93fb05ee23a4c38b534071077a9e9a2f589fd9b6cceb049d831f6e
MD5 7c471c2b2b2eed67a85c5d8763be4fdf
SHA1 76d7bc2247ae32a48cd8512182c2e18cb05ddf34
SHA512 91f1a962b8f636fa49a3cbe7b699aefcfea1731c73da8fcf541a74af993d91dfad43a0270593ab458a0120571a082dcc29c59f9bd656cf2e6063a60f2c709b8a
SSDEEP 1536:IMUbzKhL8rOCCgRMP2Yki3MX7iDmiCmM3VbLqnjL1UObNvXsjJ40DSmpo0LkqbD:GbzKhLEOClRbBX7XiCNVHkz9EJ40DSmH
TLSH
T1618312094BB7DA6ADDAF1E372CF3315B7AAB0D50A26D84CB0DB3045D015C951CF5A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 90KB
SHA256 4b4e3b04a2bfecf4735f865296da9ffb0b1f918fdf08945cc3b6a7a7ba594d8c
MD5 5dfe97c748d3d4f38642f927d02d6046
SHA1 f4e17619df562bf01a3cf0fef95a3213e090dddd
SHA512 e661fa1fbfcd95a4af98fc99c0db7cdd8015f5019b52f0bf87036d89d12d933373d465754c3388897a8a1d5609871f2e1690877861834c2929ff882f0e7e35c7
SSDEEP 1536:vIY/98URkG5CRn1WdhlP3pAezqhJzFR+0N4tbj/yWGrhB:vIu98rRno7lfHzYpR5onvCB
TLSH
T1E29312E19062F9A809F1791D9D967CAFB4FC7BE25120C390EDE6DF521C647D0C62842B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 47KB
SHA256 c24d3f07e9a4dc5a2a988ebdba10ed762aaf30ab78e197f0fb1012e701d990a4
MD5 81dd12e911f789f95021061a29b179f7
SHA1 768c5ec0aa42c536936ba8a8de9bf94628590c71
SHA512 99d2017409c289aa461ab8ce0eeffa535d2934ae6992c23a654aec7e25501f970883086e36372df370dd280d3646dc54e0d2cf062c820eb7c6f24510e874e863
SSDEEP 768:KE+Yruhj6+T091bHjb8le5Vx31IZBdJy96fToWO4qi1QvyEo5Z75a0wckh9EjbiN:K9Th2h1biePArkEfToSQqJ5ockha/9BK
TLSH
T1EC23F14FC6D361D18671EA3B97A1C319CA50A6C34CD5CE7901DE1BD5B072BDB8E71A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 57KB
SHA256 95d5eab19a39439daca91876753827d3c85c352b641f7c6cddd18a01d08d1c7d
MD5 2b8f549acf5a8db5ad4d9bbe39821d8b
SHA1 e82cb039904df09473037220ed9a40dbe9d831c4
SHA512 77881c52fce967ecf9fedabb51f68bb13f04688009430044e4355bb1541a346c27fcd796745d5d4f56927b707eb33617ff7cbf7e2ac6219d9ca9c074566c29f3
SSDEEP 1536:WfGIFCfLuBhEUCiyxe/+FXQDasblFnYGQwngt0GfMVT:CeLuBhEU+U6AD7blFYGQggt0Gfs
TLSH
T1DD430205FFA24DEBE5BE198D77F73289C8CE5C600AA07EA804544AC02D16F59F5A47E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 34KB
SHA256 f2c95d3a334715733ef99d9b2b650e8f04660258620b623862dd68268cad152a
MD5 1749088b920b583d8d2e4d662d9dfaec
SHA1 ff54252c9718abee10ba398906f68a3a24ac9f63
SHA512 3b9b16134e7828297c3573d5b92f84b05fa18da6077ce16abc8d22ded3705246d2e0b28dd00d77e6110755228b536a78ee7d47dfc12d4f71f7c42d328bff5a89
SSDEEP 768:Wcy8scujrP3kf1V8Z1Ehn0yC71vB3jPq1DZVLM5agzrT0BG:3y8scurP3z0h81p3O1FVLM/Us
TLSH
T105F2F2DA10B794A142312AA63DE5978D5F3F240A27703BB78B65A08034724A4FF4F69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 38KB
SHA256 4f96968390a7589771725cecb9ba532b0173f5b31beadba97d86cabd2ea029e7
MD5 c2e83362968e2a7dd47e8f14eb255eab
SHA1 ccfbe74faae3d0f7025608c8f3248baa78b2b30e
SHA512 c23b635f11bbf8ef292738a3ac7c5ba7b3e8e4fe1acb0ebf7619d53a205495e6e2ca38b45c2299d5d78129bd407a85961f84ea4ca8d8534d7b177e972f565631
SSDEEP 768:PXAPwaiEkN7V6HJPNOnA5o+hHT+VHB61c0u6+ZMcJt8oVqeqGpbfzOi:PwjkdV6H6AK+N+NBou6gMOlqGp35
TLSH
T12803F122F291F1E09F6863F8EB9050D9908BE678C51D6BC62BB6C7D1213C7B4D154A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 69KB
SHA256 d0233a05057d17124c5edd71a464e4e2db1d331dd71f335a8efc9569379b394f
MD5 eff7641471970f1cc5253681ef05c4b4
SHA1 d3a5820d9f57a4d44a88ecb865a55c70fe1d38ef
SHA512 d9e82c185e338517f04538f7a11e0b3d39dd3fe2f48e05ab1aed0a2bae487c6bca3ed66ee940bf1c9a1f40444585c5f3deb05a553205994bdbf133d0ea25090a
SSDEEP 1536:P42/8Z9kTdGm+2XLQO1mOtK08KhoPee3x86O+l0I4Zm8+9H5w:P42UZ9QdGv8MeHtKbme3yO+I8+V5w
TLSH
T1B56302FDC5B3178BD2C7C84EEF056460E000498934A53BA70BD2670DEFFA955A8560A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 105KB
SHA256 48e812d854b3aa7776d401fc6f34fae29b1088e46dbf1dcd78ec13db64d68e9b
MD5 29f9e1c18192a1121fa5fad9615c6d79
SHA1 5248fa7f630b57fa5871becb45dad7b2f58ae8fb
SHA512 84cff919bf262713c97856c5257c4cd228f1a7ccf2ca0f54201860d1295f3ddf0a404d438e4320d192ae692af2541e396682dd23d2c9d4fcb02abd1e17c573e6
SSDEEP 3072:jm0RR8FYstRkmRYjNUUetU+0Q+FgPv47QlQdtxy6ZU:VRR8Fz+UUSmQ+F6wBdDZU
TLSH
T187B31362E7A7B7CCC14D94F6DE8D6952D05C6DD70691EED72182B132CF9630303868EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 21KB
SHA256 a8d4cef7e4495cefca79668bdf0169ec8b19abb437b2bb76e68ace84b0a1c10b
MD5 c5c01009251e0503fabdcdcc9664df93
SHA1 6547b070cb480be57ed8c6c59a303b990b4102bb
SHA512 efd799307bd7f4a990892dc30a3a3ccf42ad6d20e48138290f759a926e5c91f29a252a9b3841e323e82c9984c0b2f5df4abd542ae58c377fbcf6036346e4e755
SSDEEP 384:HIbUbl0dWc7hcmlhsOnlWIPrZ2+LWFvXLwNdTqx06vgFmUaWDzXFejtOb:HIb9Z7pz7lzPrZ2hwNULvglDZe5Ob
TLSH
T133A2E1E3C9294B59FB8FA938B16E19CE6E665348E053C23C80872E81761DFF15D0B46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 76KB
SHA256 bbdb4de36778b9dfaf0d76f72ff5eee62586cd6f885d5f60b21436c64f9897d6
MD5 27133cd77bad23037dd37ea625f629be
SHA1 7d684f9aae9346022129138bad558be1ae13c93a
SHA512 3b42a4bc7f4bfc67133b6771b0bf30bbba215124e508b728ca9f42050887bdb7f98dd8c55c82193ff50ce5847a9e4ccecbbf3d77c50fef5aae177ae0f22a5e6a
SSDEEP 1536:zK5VCBgVlaRCfvydYadgqwEcJweg7MixcejkC+mQBYaNlrW:8hVO35dOEcJaMiFjkCEHrW
TLSH
T1B77301BB417F83CB014E9A5D1F46D099034539BAE6E961F120927AE437EC3B902635FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 92KB
SHA256 06eb39208883d683d1bdced76746506c53f9eb004a26b546c833de9597c68f5e
MD5 71f8141525673794be71853eb305f43a
SHA1 3950a35fef794d40d4cc58948c6eebe7727aef6a
SHA512 fdab2e4fa496ace5b8861c5431e4de89d0b91202e626343d8fa07ecf8e66380cae0cb1b9fac94bc7208ab1a5d819683638069791b364684c7280645656f410cc
SSDEEP 1536:ZrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdyk3:3+dCdU1UKok0HaFA9wRw0YuoqsmGeqOe
TLSH
T1F69312BE8E3D675A000DF32C46DCA14F80AD4AC5D901E3DA07ECAADB4172C195E384D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48e816b35f7bd7aa_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48e816b35f7bd7aa_0
Size 996KB
SHA256 a852a09805ff23de87bee4d4ce1932723fe05cda649362383b13e83f8e7f4fdb
MD5 b353722561034d8efbea62e7ad282bfe
SHA1 ae6ba5d594250ae9650da828856bb7363bfd4467
SHA512 78ac8a306f411940ff7c5c5925d65c383f492d1281d634b96f845e31ce74351ab9bfb87f742a008adcad51612538eccbfe8409fdb9fa57be031810edcd34f5eb
SSDEEP 12288:7mvrBs+80XhXIsJsr+BK00yztVh2e3wn4g2Qo0kc6jWLhD+zxc4pAEwsEOD:7mjBJL7CiBwiGn4g2QoLrjTtc4pAnC
TLSH
T15A25F61917A0A966CE3613F651A38917B33540483FC3E72371E5B7392C293F79E8A94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b216d82a2c3934d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b216d82a2c3934d_0
Size 1023KB
SHA256 b9f106a498f85129be3365c7ad664f3de9a941df84ca006fddaa91ab60d3321f
MD5 70d353ce26360eba209846b3267b1c34
SHA1 83e25336277eff60b055b92d059e0a754802ab6d
SHA512 4d31c46834a6b99486af210b2c2e13e572c3eea945c478f460e6e4772e0d2f87d431e905b32fa908e564401ff09c839ad95812be1d206fca6bfaae7159c1920b
SSDEEP 12288:45iwYUtNtmVv4gRip73GCC0B9dHf4T5tJlGtk4fIajOdGxGrglfk:4gUt6VvXRqTGZ0BDHf4NtJ0/fIoWcbG
TLSH
T17A25171507609916CE7613F941A38A17A33581083FC3E727A2E5B7362C693F25F9EC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cdf0dca52f5f368_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cdf0dca52f5f368_0
Size 567B
SHA256 db54139e033820d9b1cab2d90255f86c10191764add5ef2996834ae700e5a6c9
MD5 79bdda12779d6d9a2551a76c8b876f5f
SHA1 3a05d528b96d5931a2257aa6b4d4b37a4ff116d9
SHA512 c4e0252720e13706267b9411164921ba83ecc531e51588d6f34d5611472014752e5c578f0e918f641dc6a55b569ed6958a5590f53e02d8e767f81f8970a6509c
TLSH
T1B9F0265B4105B440E73E49F2C7B75343895390994AAD4A6F810C25D33187C29BC18AE0
MD5 SHA1 SHA512 TLSH

Submit Download

8a4486842f74f5a2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a4486842f74f5a2_0
Size 388KB
SHA256 f9a67a2ca061f8c528c820dd25be7324df678f852c909f0fe84342077248a950
MD5 72859586b85e4ac7b15b56a59fb9a79c
SHA1 a8dbeb2ce5b659d1da0f7508aa607a54e2a70797
SHA512 f7767b8711bb7cf0bdaa63568cac6d5657996cd1e76c8fe5a417e5a0543d3fe2fa29b208d797826cd8dc8e5220af95468754bb500834113f597ee5bcba0f31e6
SSDEEP 6144:nxDgh0GG6LDq7mwtvNe/nf2P5xf8TZGA5RnY8d/c93wAyszgPOiURs:xDuAsexp8TESYW0L
TLSH
T17284B6151B909A26CE7653F65262C963B73591083FD3D31732E5A3393C293F29F8A84E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a88d480442e40c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a88d480442e40c4_0
Size 283B
SHA256 fe121ca58ce686e2a2a6e231f58732bed234b8408f38ad395fafc59bcd09b3a4
MD5 bb5e0d34b1c50b72d1253ca9127003a0
SHA1 927139b840483bdd1b346b72371b3e465cbeedfa
SHA512 bc921abf7515c1078b23eb0dcc7805067626a6a89be9aa52d0105ae322d4eeb5bfc3df77b4f7ee79cf122e84fa5e2e4a387ee49dee223049fc02febf335ddfcb
TLSH
T123D02B3F5809A525EB5A6AF4E6B39149D522C959886D8686801071732105674CB49641
MD5 SHA1 SHA512 TLSH

Submit Download

950fee63b5fe6284_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950fee63b5fe6284_0
Size 270B
SHA256 6c02c7d150a5c9545e5beeb42f1380d59f6c97f48aa307d91446b08a44ae9263
MD5 485c5850339f6c30f055634ad4a735b0
SHA1 310ea416fec9b79f02db10ef5852367f4ee8914f
SHA512 b4fddd8c273647a5030c949612613da1b994b3e3b301dd8612354db8796f1d8df78bbde50e18fdc6ae22628211a741e0ca44dc207324a7838d04125fef990091
TLSH
T1B6D02BBF0148A415DD34C9F0E9BBA045C8F7444D8D9C40A4511564B3E515971A5D4510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ee46efe8c1b6e50ae0157b9cea7e93ade59af4f315f5b0ef87986a525fe4514
MD5 f29a2050f07f15c8388f51f48ee6caf7
SHA1 155a5fc9c5fab5cbc43ae94bf660948318cf96d9
SHA512 06712ee9319355e058f7599eb147960df93b1ce7592f9f89022e82258a3fa33d7d4022fe67d1639fc79ed859c208380a03afd6c1a699b93f68a8178da58a54c4
TLSH
T1E481C49E93A11AC1E797A0B250F8494873F652160A079F770354AF337A4FF55E0EE083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9a7b610aeeb6009bf314e668131e2272b7283b3809d1c9565745542f472013f7
MD5 0d145ebf758f310b216c6f97ac0e5be8
SHA1 4e27f3c7178a9a7436f5b51768e7e14837933d78
SHA512 53a8d46ee940335f1f4933103c786cd8d29582536499b3a72ab6577d266919039d8cfaec0ea46cdaefa472f440667e9f666250995eee2e5067f66eaf1c462f2a
TLSH
T1AF81E99E03A156D2E797A0B250F0594833FA92660A075E7343946F33364FF65D1EE1C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad38d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ad38d.TMP
Size 3KB
SHA256 07eedb0c5be226d15c9961290901c036e513462a07e6bc76222a0de87b605ae8
MD5 985529016fb403ce4775dcd80a4797a3
SHA1 1254c3e0bd9ccb49df8f81f64a005b57f469143b
SHA512 2b995c97b6d6489a7c401c0673d7c595a102b5823e2d036b291d88838683055a7aae8d616713e2a4d4fb4e5f086726b3569e2c1a55e6940e1f4265138f8c1aec
TLSH
T1C851B89E03221AC0E79760B664E4558937F6960A0A075E335754AF337A4BF19E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fb3882d77cbcdad6fefeeb47403fd1afcd0908c4c34e319404c1dcd753b8f629
MD5 a0c7f6a4f5d59e3bcf0a18cd9da55568
SHA1 98c0aa33e77366839d77fc020709110235963506
SHA512 52fa2bee24d7e1962de2988ad2934d9b5fc1692d29b6f2ee7880f749ba7984135cfd619fb247aee6d671c3a8a52115c2f1564cbeb106281dba6413bdca3ed0c7
SSDEEP 96:DMOimLNTdHKOaVNjhG0VzMj4GVPigh9vNwBQiusbpW:DHiYNTdHKOaVNjhG0V84G5igh5NkQiur
TLSH
T105C1B9F7C7E8862DDC2156F0EB156E2BCE290914932C3D5AC8D5AF5BA3E2470E141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b30312337234cc8bb436d857c45beb41f6ff92742374728a14f91e919fb303ad
MD5 dfb055378b493be1e791ee710ef9eec9
SHA1 e0814fc7eb68bb50d91e3b35733b4831cb31ba3c
SHA512 1cb88008dfec4dc7b36fa4595e5f071c70d8c46447bb8437e5e708508b28d572989192da58ad09fa4cfb88ff6a4120089d98996cbacaa37143bbd3f3223b13c0
SSDEEP 192:sxR9RiCP6/fNsP0FZjwAzAazoD8pMA/pF6Hg6+WNs1m4Fsp9hVhYBmTuOa+GeIgB:sxR9HS/fNsP0rV7dQ56ReVhVa0B
TLSH
T18052D716AA38AD7B8CD7D218FA15BB13D2F95032A1D11E54A7FC9A1C00F66ED320785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3be26f73c3e00da3ddb045371ebead66bb0006c43a33b8d5ff0f55b02c2bc9c7
MD5 40f3c233c081d46b3d066d5a1126086a
SHA1 d14d859319a713df01d561f55caaab3338579048
SHA512 53bc8e1a6eba892a4b461554483f785660a03d4656b08fe959bf799a3398eacf3e07dc885c9af8961f018ded0c6791851676d7b18ceee9c3e3a60b4e494dc242
SSDEEP 192:sxRGRiCP6/fNsT5Dde5lSyNzoD8pi/g6+WNmsp/YCuuOa+GeIgVicJ:sxRGHS/fNsT5c5lxi/5f/Ma0T
TLSH
T1D342C6166E28AD3B4CC7E21DBB55BF53D6F92032A1D11E58E6FC961C04FA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 49a148d3bcd7a15ed631fbe5572ab3ea3271f8cdd333f0c0e4b9f80cb140ddb0
MD5 782fcf1c0a41d93205d94798d28d424a
SHA1 870d467f8c111cb71e68d808d91418d33c118db3
SHA512 1f38747a3e36ca41275856b52e2e0c329cab90baf418680502980a5e84c8837c3687cdd6ec1a142c3b50a1187dce10714aa0cb4b8b8985fe5dfc7dc254589b68
SSDEEP 192:sxR9RiCP6/fNsP5FZjwAzAnzoD8pi/g6+WNmsp/YCuuOa+GeIgDLicJ:sxR9HS/fNsP5rVIi/5f/Ma09
TLSH
T12042D716AA28AD7B8CD7D21CBB557F53D2F96032A0D11F58A6FC961C04F76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4b1cdc246dddb5e243cf4970d944fbfb1e2766e55f083b86ff7370acac62716a
MD5 245001a5e73f6ac5e8920e1bb171a666
SHA1 a5365c6f1a4b9770b0888cb7568fdb48ceda22ff
SHA512 e79d4461bb9de385c148e0ec66bc27cfecef03c8abf58fba87d9a1ea160ab61ccc8659b8dd0148fd8d5b736d8943cb421bbb23dfd4602aa12db522c1876b73ac
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1QqcrroZ2Y:jC+vA7E7JQWgQ+f4+u1jaeVcYkY
TLSH
T157C2EA7B640CCB7F4F804ADDEC197E9B6DA802CB5698CD5047FED41C02C67EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52603e0a-0443-4012-a179-0857ba3b12b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\52603e0a-0443-4012-a179-0857ba3b12b6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cbf94755432aaa2558652c18def3eca877452a3f4ea4e5d40f73554969257534
MD5 c0ed4faf690d3d2a22b894cd8f2520f3
SHA1 f8422a1f790eb51e18355253684cf883cc745c9b
SHA512 a4376b671e04b57b63e83f0a089be788f9344dced629115b0568f4812533adb03696a96ee88a9fa65f65e1ad59afcc1e07145ffb104b39e58edc02cc70b309d1
SSDEEP 768:wh3V9HjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:wh3fjV8+p3Z6n4yOTLR
TLSH
T10DF2BF71E9A59D734CF9D644B1463743AFF820639AD01DD8D4DDAB1D10862AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d21e41f9756c58ab24da665dae60bc40eaf2ee1cdc2c6b21d2a4af34ff181113
MD5 432c8fa8b4169915e1b1044e996ab2d9
SHA1 2064faa04939c2f72c4cf595714d888c7d71af94
SHA512 a9cc549264b62629937e559c3c4d0af7ffc2721d180d659ee5ffe8bac4191f949fcea4e5661ebd3224696aed8f322fd4e6bc29c95e6402aec174affe62fd7ba1
SSDEEP 768:w63irHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:w63AjV8+p3Z6n4yOTLR
TLSH
T17FF2AF71E9A5DD734CFAD644B1463743AFF820639AD01ED8D4DDAB1D10862AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2abbfbdb6c18544b9d22a935741a44f30cd1ef82f14941f9674047758ce4b4c4
MD5 846ca7c5dc9a470e64dfe2fca2eb8d20
SHA1 cfffd734ec04b9d7aea383b324b8ba6c1ec02292
SHA512 b6d69357f2e3c056ccf95f7ffca84a33ca1045899df71f2aff5c23f8b99382d4d9ba947a772e08d2b96f472b501ac02ed3778f584418cc377c52d310e1724770
SSDEEP 768:wW3efHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:wW3cjV8+p3Z6n4yOTLR
TLSH
T13EF2BF71E9A5DD734CFAD644B1463743AFF820639AD01ED8D4DDAB1D10862AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c5b52522ee256336d8b0de63d0e203012bf0da9d4f42439dd81121fb8f7981ef
MD5 824db780e4634470e430360d1c2022c4
SHA1 f7846e26875f4a383d83203e2a67c7e194afff53
SHA512 25ede638453ac4004e5e92ef0f246c664ba250786983923b112957a2394d8a27f9f5556539ba112db1db36e5e2a65af4caad23fdaa4336cbb281e20725151b77
SSDEEP 768:ws3NFHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:ws3HjV8+p3Z6n4yOTLR
TLSH
T16DF2BF71E9A5DD734CFAD644B1463743AFF820639AD01ED8D4DDAB1D10862AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bd823480766508bebb783fb2c8652ad5d7a90fa02388bdb1e83e75ff44df9dc1
MD5 2345db4ff1259b19e96340c44ff57015
SHA1 3f7edc9251beac89f4bd534818a64aea8e8ba47c
SHA512 e4e05a69cbc134d3dcc1c7182b97249d8a5217a39f9b1e60257f197bc3eb53f3a93d8cf53879b76017aae00d7130bc8af8a42c40d4f763be9fdc66ad6913e2e5
SSDEEP 768:Krv+4UNbdD3/xHjNp8+p3bd66j+4BRv86aLIW42bwClW:Kbsbp31jL8+p3Z6n4yO0wT
TLSH
T1E703BF72F5A8ED739CEAC644B14677837FF821A399C10ED4D4D96B4E005A29E370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1070e9511300a44c529e9eefcec2ff64ca53c700eb9b1c8596df39965e631776
MD5 9b595bd63fb93a4410e46d90368fe7e2
SHA1 caccc03a125d2562f305fea4629ad90333caa3ec
SHA512 683e0ab1c63a2411e60eaa6017e6fcc0c62821de3c951b80c7b3f2b01b68acfac464150a3da05bf05e6df820fbc2b984730bf3caebca823b32f883d87c671592
SSDEEP 768:mFQs3gwgpOmjjp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:ts3Cj18+p3Z6n4yOTLR
TLSH
T1C5039E72E894DE779CFAD785F34576439EE410A38AD45DD8D9C8AE4C10831EE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 154ead9e6d41ac638b4269c1e65656df506496cbd1cf3f50b92187a50b629f93
MD5 fca71c5b6aafefcbcc6ce459fb7c8708
SHA1 4dca65deb4d44ff36966cd8146b2249df1ef2dfd
SHA512 1ac0e8752d9f3565f27f1b6169c6df2163a07a91444062c11e9eb0cdebbaf1f0bfc63f3413d90264ba47f321cd1fa40a3074e4f9e833bae48d9d47a9ed0cc12b
SSDEEP 768:mFHF3gwgTOmjGp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:qF3mjw8+p3Z6n4yOTLR
TLSH
T18F039E72E894DE779CFAD785F34576439EE410A38AD45DD8E9C8AE0C10871EE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cfcca1b3bebf2b4a86115296d95df244c9044c92abceb1c5c93164ce7cb8e28b
MD5 54578286912936938f8a1b177b40a079
SHA1 50eb2930202009c24a5fe6509ab20e9e8d670e1a
SHA512 664ba3d68cc98d026982f247694f8a9fcbec722da8edea812f2d6a73f089946b0f83b46c1349ffd5fd904131f5c99ac6ac1a1e71f91f76acdc52153e6ea09b6f
SSDEEP 768:o/3yvHjVp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:o/3wjj8+p3Z6n4yOTLR
TLSH
T135F2BF71E9A5DD734CFAD644F18637436FF820639AD01ED8D4DDAB1D10822AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 54ff8e097a6421a9415c431ddc1e71b86c368fb479b4319f14d7590111c8402d
MD5 865af078f244d5ce585c9823042e3f7f
SHA1 1448a27ce887eaa02e094d61925e52ccb00ad858
SHA512 ea5983cc2adac9a62a5e4b2607a6fd8ccbae29f9c8a56e1d1a766f3574792c05580ed049680b37b7f4200f8ae1d5d3b9c25596c5c0ef4295daf0810fa7c83f43
SSDEEP 768:oF3m3HjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:oF3wjV8+p3Z6n4yOTLR
TLSH
T147F2BF71E9A5DD734CFAD604B18637436FF820639AD01DD8D5DDAB1D10861AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b433e91ae814d3bd6a194c481302d3458c9801d9923622f198185468dc3cbdab
MD5 1fcbddab6133fba815dcf27765b23e8d
SHA1 15963523b644d1acd6142322f35e35684e2f1df0
SHA512 745b3a6e778591ed15140b38a4c8062d4f7d82831523dfd9d3d0856662f8a4ed014222769ed0b9fc15cf990d669c546b59a9cb19d2598d6db237f257ddf62e1e
SSDEEP 768:o53bFHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:o53FjV8+p3Z6n4yOTLR
TLSH
T15DF2BF71E9A5DD734CFAD604B1463743AFF820639AD01ED8D4DDAB1D10862AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 62f661844173274e44582303e9560b6fddc60176fe031687d7afbd15ea97c0d0
MD5 7be01844ed8ff96d253e37acea170ac8
SHA1 214416f51a8680d6d4e0917dc6daf66fd3bc349e
SHA512 6c2b019053027175e162e4319000184c950a5fb65694dbc1ba85328c1ffc79ff1e634f266e3a7729773a3c46e0d913bb18851ec09813032df0e3142ae89d7669
SSDEEP 768:oT3otHjVp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:oT38jj8+p3Z6n4yOTLR
TLSH
T142F2BF71E9A5DD734CFAD604B1463743AFF820639AD01ED8D4DDAB1D10862AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 107b2dfb5809c96f166d4782e9c8d95a0350328a3a1cda3f086b67a8fb754304
MD5 2705773ef84d900c7f9b120b1748f8ca
SHA1 adbe3f91acf1174c276b512c40114053fa9743d9
SHA512 7c392ca3579013f374777018229fc1dc9e4e7758d959ef36844c687d78586841acca44f31379f2d05e21d38148870f9dcf8538d898cb7997a190dff450315014
SSDEEP 768:oR3UBHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:oR30jV8+p3Z6n4yOTLR
TLSH
T170F2BF71E9A5DD734CF9D644B14637436FF820639AD01ED8D4DDAB1D10861AF2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8b13c9d143f9a783e717ff92cbda527fcfff1e3c486553058e9cabbfac64c3c6
MD5 e44a0b68deb3c7a2e3874560702158ab
SHA1 965884cba47e1cc127c01eb224893c14555eabe0
SHA512 99152424447c615a8bec1fabd21b92355bad8894396329e2ea7bbbb28cf3c75e97b7186acb3c7c0d92706353fb380a44b7ebea404e909e750a99370f7d094efb
SSDEEP 768:o638vHjDp8+p3bd66j+4BRv86aLIW4hy6Dq4W4:o63qjV8+p3Z6n4yOTLR
TLSH
T1FDF2BF71E9A5DD734CFAD604B1463743AFF820639AD01ED8D4DDAB1D10862AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6781261796cfa76c717f902f91c6b26c5a63bbcd53b163ca0367f8db2cafb172
MD5 9eee4a7d3b4efa7b6750ad976ccb266b
SHA1 a775d8faaf1bba62d69406c2425fe57c427e95b6
SHA512 b556938d6c8d0d4c4e33b8eb9756cc6e99be851a264149e6cd8863d3708e39cdd4ab0afde3f4329b2951aa888d38fa4f27e181740381503b24a651cceb7b383d
SSDEEP 768:Irv+4UNbdD3tceNp8+p3bd66j+4BRv86aLIiT2bwCl1:Ibsbp3hL8+p3Z6n4yx0ww
TLSH
T19003CF73F89899739CF6C644B2467A437FF811A396C10EC4D5DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ec9fd5ac6d14120ae633c604677f4c6642718a27ae1792cd77a8e8665276662e
MD5 1301cfc7967eadf006184fefd1bcf127
SHA1 4b8cb81ed676c772888ad559ac93c33a38916ee6
SHA512 3be60a0b6a6202ff462da78cfcb5e2a418ced52e29011f97473782335dc1c4a9c1cb6eadb3f2a1ef081fbf392503bd4e6b3371b38b68ba6dccffdb7c3681f452
SSDEEP 768:Arv+4UNbdo3+FHjxp8+p3bd66j+4BRv86aLIW4C:Absbi3+jv8+p3Z6n4yOC
TLSH
T12D03BF71F8ADED738CFAD644B14776837FB820A395C10EE8D8D96B4D015619E2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 031772ae47991e4f8804090d346154ee807a5fd206bd033143d333d63f246a31
MD5 ada6075c0103f801b2f554716e0357e1
SHA1 dc4690d8f8874325b32a56155a33375f8a7d3938
SHA512 9fb6bc1f848ef3a37bd63e0924133f1ae224b627320ded6156ea63adfbcc8ac3ab490a79f9157893d83d04d0a39b0efc0b7c545b9189fe6bf7215a7ff24e5bee
SSDEEP 768:Mrv+4UNbdo3XdHjxp8+p3bd66j+4BRv86aLIW4C:Mbsbi3Jjv8+p3Z6n4yOC
TLSH
T12803BF71F8A9ED738CFAD644B14776437FF820A395C10EE8D4D96B4D01561AE2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60122\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7831d6c-f725-4150-bbec-a4da0de7381d.tmp

Path C:\Users\Admin\AppData\Local\Temp\e7831d6c-f725-4150-bbec-a4da0de7381d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2884_888412819\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7j3q9wtp.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3u8f3hms\7j3q9wtp.exe
Size 5.4MB
SHA256 34c720b98fa5a286f8ff821a2a909cfbb17e389764ad7ceae3ec06583fecb42f
MD5 f30ee82dd4994838d656516a746cc89d
SHA1 94227f6c6930cc3f1716238eb18d786e0cf0ebaa
SHA512 de99a18ea3713a5f5a1cfda24bed1d008b6875e8c038f5b1e03beafda4b345bf9830ae3bd51f0bddcfa7beead09862dd01c3be7f013450c797249dd362e81773
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6ul:AsTICteErownP0oTcMsABqljko
TLSH
T125463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads