0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f

Analysis

max time kernel
57s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
Size 5.4MB
Sample260816-23z5ysbp21
SHA256 0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f
MD5 39a391f80e789d320a285406391f81eb
SHA1 6534dbb06378a1c86e0348a852767b79b4e7edaf
SHA512 0e47da73db1d2a2c7502c5408ec1e6be9fff1ef28b2f8c4addd21f12a575057fa526041ee0f928528d8452feeb36602752ff543e00839c47cb038df507745cc2
SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66hH:n4ICteErownP0oTcMsABqlTm6x
TLSH
T183463348B3E809E1FAB3D539856A5221D472B42547B0D1CF03AC9A662F677E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4s0a2t.exe	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4s0a2t.exe	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe

Loads dropped DLL 11 IoCs

pid	Process
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\fonkravh\\kht11pv7.exe"	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2230	ifconfig.me
173	ifconfig.me
270	ifconfig.me
750	ifconfig.me
1515	ifconfig.me
2207	ifconfig.me
2376	ifconfig.me
1351	ifconfig.me
1840	ifconfig.me
107	ifconfig.me
129	ifconfig.me
156	ifconfig.me
416	ifconfig.me
1740	ifconfig.me
1	ifconfig.me
937	ifconfig.me
949	ifconfig.me
1342	ifconfig.me
1420	ifconfig.me
1965	ifconfig.me
246	ifconfig.me
282	ifconfig.me
420	ifconfig.me
1919	ifconfig.me
2006	ifconfig.me
1343	ifconfig.me
158	ifconfig.me
216	ifconfig.me
470	ifconfig.me
802	ifconfig.me
1006	ifconfig.me
1460	ifconfig.me
168	ifconfig.me
259	ifconfig.me
312	ifconfig.me
1069	ifconfig.me
1328	ifconfig.me
1751	ifconfig.me
490	ifconfig.me
1552	ifconfig.me
104	ifconfig.me
793	ifconfig.me
963	ifconfig.me
1580	ifconfig.me
1648	ifconfig.me
1975	ifconfig.me
51	ifconfig.me
193	ifconfig.me
807	ifconfig.me
897	ifconfig.me
1594	ifconfig.me
1990	ifconfig.me
93	ifconfig.me
235	ifconfig.me
271	ifconfig.me
609	ifconfig.me
1158	ifconfig.me
1791	ifconfig.me
97	ifconfig.me
1106	ifconfig.me
280	ifconfig.me
360	ifconfig.me
693	ifconfig.me
1247	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
9516	cmd.exe
2232	cmd.exe
6956	cmd.exe
7200	cmd.exe
5892	cmd.exe
6160	cmd.exe
3664	cmd.exe
6724	cmd.exe
4480	cmd.exe
7160	cmd.exe
3740	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2840	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4876	msedge.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2256	980	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	89
PID 2256 wrote to memory of 2232	2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	90
PID 2232 wrote to memory of 1628	2232	cmd.exe	92
PID 2256 wrote to memory of 4876	2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	93
PID 2256 wrote to memory of 3316	2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	95
PID 4876 wrote to memory of 4608	4876	msedge.exe	94
PID 2256 wrote to memory of 1340	2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	96
PID 2256 wrote to memory of 3964	2256	0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe	98
PID 4876 wrote to memory of 300	4876	msedge.exe	100
PID 4876 wrote to memory of 2840	4876	msedge.exe	99
PID 4876 wrote to memory of 300	4876	msedge.exe	100
PID 4876 wrote to memory of 300	4876	msedge.exe	100
PID 4876 wrote to memory of 1148	4876	msedge.exe	101
PID 4876 wrote to memory of 1148	4876	msedge.exe	101

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1584	attrib.exe
6852	attrib.exe
3748	attrib.exe
1324	attrib.exe
9632	attrib.exe
1628	attrib.exe
6264	attrib.exe
7056	attrib.exe
6924	attrib.exe
6616	attrib.exe
7292	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
"C:\Users\Admin\AppData\Local\Temp\0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\Temp\0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe
  "C:\Users\Admin\AppData\Local\Temp\0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe"
      4⤵
      Views/modifies file attributes
      PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffcff33c188,0x7ffcff33c194,0x7ffcff33c1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11709364571178669031,5294257962807526173,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,12145320373109040251,9503739075010618249,262144 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,12250370205774984727,17733541296704706253,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,116914164260944579,11498921105550075064,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,6315285614149454454,6450187344698038863,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,13245237584867116626,11289886803670599168,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,7159636238897135163,9395644866410491183,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4424,i,796061729741081641,837611715198942578,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4704,i,8027294643221414472,7434132567256424404,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4924,i,14167919814371121368,15925460749295740559,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5732,i,12093568305925511358,1610839203227934306,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,8927009788247419752,13839507529639247571,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6100,i,10958983924544133848,3229073944798160932,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6300,i,1994877167336785276,10765792525596165610,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6452,i,9918619690992392728,2224108170138528692,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,17426881744868459721,15241623252422953681,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,6239425475682119120,12804252286477516896,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,14162817358650841943,14431065801953422928,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,14162817358650841943,14431065801953422928,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7208,i,13946427353352166204,17184745657988501298,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7276,i,8352754773115888203,5143904142177127599,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7588,i,13619106698542058464,2338106477613166018,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:1
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7764,i,3210837243468409572,4701028812412974187,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7940,i,3505899789498758520,475534540550325897,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8068,i,10447586884307880283,16684575217804711694,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8256,i,16277594809629732275,17208454688221111351,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8392,i,6261259876186709578,9674848497772524234,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7452,i,12972860356785531337,231841715400602194,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8840,i,15888907798406954771,11701968329878573662,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8560,i,16280666450359683617,14881615381452757185,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,9923291665778616672,4170975662613560249,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:14
      4⤵
      PID:7808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8784,i,13399575724734921726,16808997290927237524,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8412,i,7487874256905608827,8826590677805940973,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8980,i,2200767346955102894,16957618329298092360,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
      4⤵
      PID:7904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9424,i,3183671915086986990,1778378412339181853,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:7912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4968,i,6863957559468799315,5739313044627501317,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:7856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9440,i,8751952417676946944,2273834348029029398,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4972,i,8659434691024110573,5719898293906764516,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:7864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5008,i,9914700065455938360,7086284666560828108,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:7840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8892,i,8994063393282298486,14190948638669442015,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9212,i,718180120448633171,9944646678920416072,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5916,i,14742996815583912951,9094105917266168523,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:7848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=4928,i,5840200517393824191,8105180736625107792,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
      4⤵
      PID:7876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8936,i,5883083013094847082,12145681156656404731,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9352,i,1979468412760099981,3793959468743636023,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10232 /prefetch:1
      4⤵
      PID:7936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8912,i,16136990817971428000,17877741475318136277,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
      4⤵
      PID:7928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5028,i,18441146800374949298,10929370837008378933,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
      4⤵
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9368,i,230804680306685516,17970152566431726249,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10236 /prefetch:1
      4⤵
      PID:7920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8756,i,5376364426041201108,15831128888024197577,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10336 /prefetch:1
      4⤵
      PID:7960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9408,i,6771311692948940429,11296142451056126504,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10220 /prefetch:1
      4⤵
      PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9272,i,17982680795801104523,8239309907421698505,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10200 /prefetch:1
      4⤵
      PID:7968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4916,i,6278286404195015557,3754887720563300176,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10340 /prefetch:1
      4⤵
      PID:7976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9296,i,15071797863378430566,4690051150938560340,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10196 /prefetch:1
      4⤵
      PID:7952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5108,i,9375343688391709307,14754203501270664303,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10380 /prefetch:1
      4⤵
      PID:7984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=5096,i,13395450160336427540,7135522367484549489,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10428 /prefetch:1
      4⤵
      PID:7992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=5084,i,4784152155581994842,2828027673684329452,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:1
      4⤵
      PID:8000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5128,i,9440425350472094217,2732963609163139046,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:1
      4⤵
      PID:8008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5064,i,1600264342752260568,15620519171169210974,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10444 /prefetch:1
      4⤵
      PID:8016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8748,i,3680577724589587380,2041209295615631143,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:1
      4⤵
      PID:8024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8652,i,7795451516283141410,9461339973802630895,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:1
      4⤵
      PID:8032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8704,i,150260293003300752,14795534913231769816,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10632 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=4340,i,7853665975330171183,9658950897523009493,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10636 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7644,i,9452636433353663315,9499834318290847585,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8624,i,1791151752383063905,15696944609266655401,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8628,i,16632953833306305587,1354941570054332433,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9588,i,9671842141872823101,10283140772843417373,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10600 /prefetch:1
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9600,i,1983690353217192052,2827569962729347019,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10956 /prefetch:1
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7628,i,3300034415352217740,2492077756187041597,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10720 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9628,i,6213438818878367984,17255207842506706297,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11032 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9632,i,1818725726039569382,12227745165088506982,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10960 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9784,i,3522490055738471720,5350841098128395504,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=7392,i,6089203605863231328,7454485137643666176,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:1
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9608,i,18025055669798191043,1748942667007324174,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10700 /prefetch:1
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7432,i,3110520597375439078,12801108122200239832,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10808 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9660,i,4677051139863250070,9444087572251029951,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10672 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=7900,i,6939036561551413687,6467610255101122862,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10900 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9756,i,4681857248133260046,5399130678732133000,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10864 /prefetch:1
      4⤵
      PID:8188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=7692,i,1162096973125261400,17518069278563225061,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10952 /prefetch:1
      4⤵
      PID:7192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9764,i,2464699697564438677,5154461511128012285,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9804,i,480521403204647133,15850845359436070489,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10664 /prefetch:1
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8224,i,7873493170314930147,7320279694911970460,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10544 /prefetch:1
      4⤵
      PID:7248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=9988,i,3923244074338545142,7692381380138528102,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11124 /prefetch:1
      4⤵
      PID:7312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10060,i,18336292964443536290,9376849833287075229,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11268 /prefetch:1
      4⤵
      PID:7288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10004,i,6250083484663987865,5725599528493253052,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11160 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=9868,i,7665928001036896235,10611511938679532945,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11068 /prefetch:1
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9916,i,11654471116255587065,17820826213272207207,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:1
      4⤵
      PID:7208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9840,i,13239435656296174386,8138761156848775297,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=9960,i,4454959058778245487,11606146948816516275,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:1
      4⤵
      PID:7304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10088,i,17732251888377081033,10177706057673590221,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:1
      4⤵
      PID:7224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10176,i,5858900893552326685,9955820398280050573,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:7360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10036,i,17666116063374355880,10963662525425975000,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11256 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10120,i,244224397838004241,6472779165345532190,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18504,i,17453255821532607618,14240697759743323193,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
      4⤵
      PID:10120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18508,i,2338242337990964264,6926680448758738497,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=12804 /prefetch:14
      4⤵
      PID:10128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18512,i,13035335622325161361,682657088957741905,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=11208 /prefetch:14
      4⤵
      PID:10136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18528,i,6295916686682413623,891902016789603799,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:12
      4⤵
      PID:10144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=16528,i,16479460158786656194,12379592868625078891,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:10160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=18424,i,12138646195067556954,7971062757452636043,524288 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:14
      4⤵
      PID:9872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10000,i,13409284785578024668,15882948574850791188,2097152 --field-trial-handle=2492,i,15847660370471944090,1329272703726014,262144 --variations-seed-version --mojo-platform-channel-handle=18272 /prefetch:1
      4⤵
      PID:9580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe
1⤵
PID:5624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe
  2⤵
  PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5892
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe"
      4⤵
      Views/modifies file attributes
      PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:804

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe
1⤵
PID:5704
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxhtiyc7\022k1467.exe
  2⤵
  PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe"
      4⤵
      Views/modifies file attributes
      PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe
1⤵
PID:6632
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fl1eloh1\6m68tw78.exe
  2⤵
  PID:6812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6956
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe"
      4⤵
      Views/modifies file attributes
      PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6588

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe
1⤵
PID:6640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qqpu0hfs\rmfmbp4q.exe
  2⤵
  PID:6368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3664
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe"
      4⤵
      Views/modifies file attributes
      PID:6924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6872

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe
1⤵
PID:6528
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7i1ezo99\8bi2wnjv.exe
  2⤵
  PID:6680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe"
      4⤵
      Views/modifies file attributes
      PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3140

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe
1⤵
PID:6476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vr3reo6v\rmjbr3x2.exe
  2⤵
  PID:6852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4480
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe"
      4⤵
      Views/modifies file attributes
      PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6448

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe
1⤵
PID:7072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2rfbde9\jbh2t04w.exe
  2⤵
  PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe"
      4⤵
      Views/modifies file attributes
      PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7128

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe
1⤵
PID:2224
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80q2bt99\nlr0gbdo.exe
  2⤵
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe"
      4⤵
      Views/modifies file attributes
      PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6188

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe
1⤵
PID:5008
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rxi8h0uk\ylmoacr0.exe
  2⤵
  PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7200
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe"
      4⤵
      Views/modifies file attributes
      PID:7292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7616

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe
1⤵
PID:7604
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zc6xcv4j\oolksqc2.exe
  2⤵
  PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snzdjmjz\rm6qvbze.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\snzdjmjz\rm6qvbze.exe"
      4⤵
      Views/modifies file attributes
      PID:9632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 69KB
SHA256 4ff7209de81681d6d7e38aebc78653798b3d808ef0e32cdd021bb69513dfba2d
MD5 7daece975e1859e0ed59170906b8da36
SHA1 25b9a34a7da22ec84e566ce3b78bce2d04b16978
SHA512 82f5085b3f6d21cbccbf31aa98842e9e29a5a77b0701f049ff937ab739275447290cec59f6c8f041027fc77c1a303e87ae2097b2efbcd056c3aee453dfadd6d3
SSDEEP 1536:/tD95yacit2VPPZDukTLaswd/CNkXyYh0JcQKeqaD5ZrvQspi3jU:/t95yacY2Zwk3twd6UGpDfpR
TLSH
T19663129ACC0DDDC01FAF2DBFBC9FD4749DEE295217847C8B605651260309A212EC2B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 49KB
SHA256 2aef8458e2a4eaf0d0cec34a9939d402406f20e5afd0e1a42f6ac1e7c8789ff9
MD5 a976b6efb9dfe18b3334e99603a44504
SHA1 f160fb13ee881279edacd2146834f32874a87b7c
SHA512 9f3ef51ffcf2e6c686a1b9d951992e641257ccc7c858c197af3db0fcfad819957f8bb981d3052f17090ff16823f90bfaa90b45d1dea36695daa95b794aa9db3b
SSDEEP 768:bWz3QZ3zow5u100+YComrZUnsW5ZLXRTcuC+bdpjIeNj5ZYaLB/IkcMQSyEeF:qzK3J0yrZUnNX9Y1+LhVq0l7cyfeF
TLSH
T1FB33F299439AEF58B258CE8ABF96910070BBB960F519F0C0052ED5CF95B296425FC923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 280KB
SHA256 6a75555c3db9edf922d8aa3293bdb9dab48a65985839ce2a35b82bf91d60bac6
MD5 3945e15ee565be6f6355a0c6d501b640
SHA1 56cb7775b7d31606541af5b7cc5b95b5ca9a2285
SHA512 8d4e1f70052eddd19caf8676144e845828e8f27ffae53a6cd4672de607d4ea1c8bd8e6f2e3ff449d5600e598709614e7ea640dad1bdd98ab6c421f46c54b8825
SSDEEP 6144:yZAlMSb7e+BnnR9VEOfFoD9RuXURIxVEbVcLVXR:Q4MSb7e+BnnPVEOiDnuXURIqVcLVB
TLSH
T1E454239A700EBA7ADC3AEF2C5CDF8956D323E225A20D2F995D2D0D04427A550B3D7C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2c6b34e7716075e198184590f2d399d948caa29f0d25bae7ef105c8914d7fdd9
MD5 40f1aafd6c310971c6d7776bfde146c2
SHA1 4a2ac59f683e8667706caa71a5fd00b325236b2f
SHA512 3c879142c5d3d19873f13175987bf3a41c2cab82771c7fa402c2201de6a488fe98b4998030d0ba30d03c5f26106b556b304c483ff96f0bb12a91a36659cba560
SSDEEP 192:sxRNRfCE/fYsJjm+wGYzoA8pKQBCFcHg6+WNsGkFIPzT4rzhWfYBbHw6CYnGKhEG:sxRNYE/fYsJjm+ph0y56igrcfvtG
TLSH
T12E52B8166938AD3B5CD6E219FA65BB56E3F5603291D01E48FBFC8A1C00E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7d049e167fe16e927e86c080dd5f7f4aea4ec90778447ed756318f691533de62
MD5 9aa44b9051b65ec3d196d3d3c92dcbcd
SHA1 573a35ddd1026683199aae941b80504517a9c3f1
SHA512 d8a01ec9d45204ffedbaab371382ca3d2144ea14d0f8fcfa9f2585bd0a9450f811035b0780192fc99ab16c54ddd9bac5d1d0ebcd9bc6b4d06d75f4f828c752da
SSDEEP 192:sxRyRfCE/fYsYjm6wGszoA8pKsebFcHg6+WNsGkFw+9nVxt7/YBE/UCYnGKhEIgr:sxRyYE/fYsYjm6pd8y56/rr/dtr
TLSH
T1D452C9166938AE3B5CD7E619FA25BB53D3F56036A5D01E48BBFC8A1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 74f49c11d98fd1869ec7f61a7a2609a4380bb197e9ff798c5bfa5411f757ebe0
MD5 163ba8f5e9f49b99c05c1ecb6ddfbd2c
SHA1 3ecee682bd999ec08c48db32409042202e7144f6
SHA512 b7b2651e2269d7c1193e47e91ca0de88a215a4e3d747aceb2cc8547241603a7a32e267d4149896cdcd19b19cb686f724ec8fd50e4ab17894563e1efddf482516
SSDEEP 192:sxRNRfCE/fYsJjm6wGHzoA8pKZQbFcHg6+WNsGkFIPznVxhWfYBbH/UCYnGKhEIr:sxRNYE/fYsJjm6puxy56ip6fWtG
TLSH
T15E52D91669386A3B5CD6E219FA25BB57E3F56032A1D01E48BBFC8A1C00E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a6d9d9e558b3e0070f1b233446d707a24b0274825435c269985cfe1ec400baa1
MD5 57a4927f88754dc88a3557c2ac93537c
SHA1 17a685c47b26ecc89fd50e6962a737f4492c854c
SHA512 8e66a235a723c6199a27e7f5e208c487de15cd7368cecf9b0be650241968c17c850676f93b573d42754286402025b42d51e76e3135a208789704a502bff848d1
SSDEEP 768:j26HCo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVLVuwaro9+e0Ura:j26HCUE7MRWgs2f02u1jak4wRRa
TLSH
T134C2DA6B640CCBBF4F804ADDDC197E9B6D6802CB9698CD8047FE951C02C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aaad2f4c8d933d6426e2315f40a9a20693088d5ac173b0efa36cdcef3d26f104
MD5 0fb349146cc815f39e22d74434ec738e
SHA1 b47257de09c38072f3aec4cf950141ca1a7774e7
SHA512 147fa1896315140f9f467c114fddd29613a2509a5bbd1182154453098c85a80f4b358e24368dc8155625221b3597fb4bf6889e82fad523eadf2a6e5cf257fdd7
SSDEEP 768:hrv+4UNbdz322/TBOWRZYONXyer1IRCzniB+eVH1SK7:hbsbV3fmSIqnpEH1l
TLSH
T1E903BF36A4A89E338DE2A3C5B14777437FB86057C6800790EDDE2F4E06AB59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4f344d6045f3265fdc7c26c7538f319e55192945e46d1cb8e4fbcd57e51ef909
MD5 47b37d5550fef21c6c68891a597d3c69
SHA1 4e83b464facd9314d71ad2f68a9c29d32a474ecd
SHA512 34ee30331343a77e027a35c74d87859074f88e50e4c7a517073ae079eb58926cce14803d1905237118e58242cabb90a92242337ad2822194fcd6fd7801165bec
SSDEEP 768:po3ltk/TBOWRZRYONXyer1IRCzni9EPi9PFtZ:po3l+YSIqnTPqtZ
TLSH
T1FDF2AF30E5A99D235CE6F396B1463382BFF82467D4845B54EAED9B0D0593A1E070B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2b8f28ac5a325576699507cb70c38599f5a60b435d8cf330ca90a138a572ec6c
MD5 5ad0368f5d8c87eea2673a39175d91e9
SHA1 a286bd96f91ec52449724fa806e1bfcde8ea8a4c
SHA512 ec28d0c53d39d9de815f6f9000141c4d1989a45b2d663beab41e0a686482dc8586bf53cdca02fb9bcbeecf5c30807f23850deb681b93efe8210d1e169a09baf1
SSDEEP 768:brv+4UNbdB3AUg/TBOWRZRuONXyer1IRCzni9Esn:bbsbL3APuSIqnTsn
TLSH
T10B03BF31E1A99E334CE6A295B14777837FB820A7C4800B60EEEA5F8D059765E170F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5ba72693286ff8b7422a64c7c477204a624007cd00ca4b0e6c7b3a9a3f413d53
MD5 64f706e4dc156b9d6d00ab5f11884bbe
SHA1 7937970c48ee199890b0e954aafc34ef2329ef01
SHA512 bc625f2b78f68c265e66aab289edd1743269e61d521e3d0cb934b13bff83bc0f7e6921e0c363c8ab7e528189851079bf170bc7078aab6e4822e16dba10e65738
SSDEEP 768:Orv+4UNbdz3LS/TBOWRZREONXyer1IRCzniwEeVH1SK7:ObsbV3OESIqnIEH1l
TLSH
T17D03BF31E1A9DE334DE2A395B14773837FB8206B89800B90EDEA5F4E059759E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5ef0940b3805b7caf0d1f4c45cc71063a100e0601bb36897d1ec84f195ff18c8
MD5 00b51983a3ec027f1d839bde3f0f7efe
SHA1 d6d0830d8e589865a65e1b117950603bc9d35bc7
SHA512 1459c0b38351d0ee52998fa42a96fe83eb5bd91018aec5c4be90876a2688075f64fadd5814415b7573e9c9524b8838fb51202a9fdf268c3030ab89e8d82c3fc4
SSDEEP 768:frv+4UNbdz3DGg/TBOWRZREONXyer1IRCzni9EeVH1SKk:fbsbV3xESIqnTEH1m
TLSH
T1A903AE31E1A9DE334CE6A395B14773837FB8206B89800B90EDDA5F4E059759E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c6ee7c4022a3064f3ffa36b6d77cc13f9d09ef10067661bf611a32af43ee7336
MD5 62971c86cc6cef8dea8b90cb602b44b5
SHA1 97a1f8bb17316655b9d6e3f26e9c1070d5e0920b
SHA512 f854533017ece84cc09c2ac5449733b25266ce689bcd2f4cc9cf19b735107b8d5ecfca19b27eee3df762c11f08f4d362fb6c2c4d1c21215ca268ea2438da18f1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59db24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59db24.TMP
Size 392B
SHA256 9c29b4e1bae4ecbac312f9d04b2893ddd13071c565747e10f053e340d143bd17
MD5 05ca42ef4ceb658317a1c559a9dee829
SHA1 a30b7c12d769711b1348ee08e2e833f6f0f1605d
SHA512 91ff8cbc9cd4aeb7ab37f521c183459b660de41d3c0c34b87be452232c0c99f537a9ae5adb0b7162a441ccdf491d0d6c1f3b9c1a03d7d39334ccabbcc0897a72
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\base_library.zip
Size 711KB
SHA256 6b853f31baf3750be8d368a99caf893be25df4efa0e218f9219b38d553487b3c
MD5 25c3a0fe34d770a24264cf668292b6e8
SHA1 4b26fbd2925c3ef03310564633b79fad34dfbec2
SHA512 5425961ce98a7869c839f5da75c7e4296068494acd80beaa3d0a30c1bd5f14e5d7efca8892680c57d7bf4c9f7affb9b1bce4aafdd272923db35c16f99ff33874
SSDEEP 12288:vax4huLoQDSgfyELzmIXdjV0cb2osQNRs54PK4I1/k1ie:vsPoQDSgfyEeIXdjV0cb2osQNRs54PKc
TLSH
T129F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9802\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_1837527782\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kht11pv7.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fonkravh\kht11pv7.exe
Size 5.4MB
SHA256 0e0cf9af23d9266e08d541700ea4190eaab407ccbefc6f379ef3d19d7aabc97f
MD5 39a391f80e789d320a285406391f81eb
SHA1 6534dbb06378a1c86e0348a852767b79b4e7edaf
SHA512 0e47da73db1d2a2c7502c5408ec1e6be9fff1ef28b2f8c4addd21f12a575057fa526041ee0f928528d8452feeb36602752ff543e00839c47cb038df507745cc2
SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66hH:n4ICteErownP0oTcMsABqlTm6x
TLSH
T183463348B3E809E1FAB3D539856A5221D472B42547B0D1CF03AC9A662F677E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads