120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555

Analysis

max time kernel
59s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
Size 5.4MB
Sample260817-d5rdtssfjd
SHA256 120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555
MD5 3f100ea3a66f3eab1933188627151787
SHA1 3806609210c36fb5d24360f75e954438b1685419
SHA512 e064eb214522c12f6c7e20791d68d1b1212802459241906b46dba3235ce9dcb2b7c6983b9487ec2400b904205c75431062b11385bb37cd1de90f8f68af8d486c
SSDEEP 98304:8JgtojfICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllfHnMs2i6LRe:nYICteErownP0oTcMsABqliTtLk
TLSH
T15C463314B3A808E2FAB3D13981665621E473B4254BF0D1CB43AC97662F677D0AE7FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\643qjg.exe	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\643qjg.exe	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe

Executes dropped EXE 2 IoCs

pid	Process
3440	rk2wk80h.exe
4512	rk2wk80h.exe

Loads dropped DLL 13 IoCs

pid	Process
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
4512	rk2wk80h.exe
4512	rk2wk80h.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\btz6qbsg\\rk2wk80h.exe"	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
392	ifconfig.me
1351	ifconfig.me
1814	ifconfig.me
1993	ifconfig.me
2036	ifconfig.me
3324	ifconfig.me
3356	ifconfig.me
92	ifconfig.me
385	ifconfig.me
1106	ifconfig.me
1182	ifconfig.me
297	ifconfig.me
426	ifconfig.me
1495	ifconfig.me
1702	ifconfig.me
3574	ifconfig.me
179	ifconfig.me
752	ifconfig.me
1709	ifconfig.me
1823	ifconfig.me
3188	ifconfig.me
917	ifconfig.me
204	ifconfig.me
1	ifconfig.me
50	ifconfig.me
252	ifconfig.me
469	ifconfig.me
588	ifconfig.me
1149	ifconfig.me
743	ifconfig.me
931	ifconfig.me
1377	ifconfig.me
2826	ifconfig.me
2845	ifconfig.me
3014	ifconfig.me
3305	ifconfig.me
3477	ifconfig.me
160	ifconfig.me
441	ifconfig.me
564	ifconfig.me
635	ifconfig.me
2999	ifconfig.me
3064	ifconfig.me
1064	ifconfig.me
186	ifconfig.me
193	ifconfig.me
462	ifconfig.me
645	ifconfig.me
698	ifconfig.me
948	ifconfig.me
1674	ifconfig.me
348	ifconfig.me
380	ifconfig.me
409	ifconfig.me
79	ifconfig.me
223	ifconfig.me
285	ifconfig.me
506	ifconfig.me
1957	ifconfig.me
307	ifconfig.me
1031	ifconfig.me
1152	ifconfig.me
1523	ifconfig.me
2444	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6776	cmd.exe
1608	cmd.exe
7640	cmd.exe
7016	cmd.exe
7872	cmd.exe
3324	cmd.exe
5400	cmd.exe
2072	cmd.exe
2244	cmd.exe
6824	cmd.exe
6848	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1820	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4188	msedge.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1712	4788	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	89
PID 1712 wrote to memory of 3324	1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	90
PID 3324 wrote to memory of 1208	3324	cmd.exe	124
PID 1712 wrote to memory of 4188	1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	94
PID 1712 wrote to memory of 4472	1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	96
PID 4188 wrote to memory of 2532	4188	msedge.exe	97
PID 3440 wrote to memory of 4512	3440	rk2wk80h.exe	98
PID 1712 wrote to memory of 2072	1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	131
PID 1712 wrote to memory of 3816	1712	120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe	100
PID 4188 wrote to memory of 1820	4188	msedge.exe	101
PID 4188 wrote to memory of 1840	4188	msedge.exe	102
PID 4188 wrote to memory of 1840	4188	msedge.exe	102
PID 4188 wrote to memory of 1840	4188	msedge.exe	102
PID 4188 wrote to memory of 1380	4188	msedge.exe	103
PID 4188 wrote to memory of 1380	4188	msedge.exe	103

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2160	attrib.exe
5236	attrib.exe
6700	attrib.exe
7692	attrib.exe
3928	attrib.exe
1208	attrib.exe
5564	attrib.exe
6844	attrib.exe
7012	attrib.exe
7240	attrib.exe
4868	attrib.exe

C:\Users\Admin\AppData\Local\Temp\120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
"C:\Users\Admin\AppData\Local\Temp\120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe
  "C:\Users\Admin\AppData\Local\Temp\120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe"
      4⤵
      Views/modifies file attributes
      PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffeffd2c188,0x7ffeffd2c194,0x7ffeffd2c1a0
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,6584708446320266473,6602291829956370690,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,10918902398039286519,16717296368836289029,262144 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,15264295355092703723,14102320562184036177,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,12384912297029555042,2784683963866750997,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,5035250154245074449,11340082310041684282,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,11019969677850588692,7050792756369741707,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,9119042477875003281,10547071368619445010,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4460,i,14496268913440342306,15265778255722184,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4844,i,4905229414786939960,4924849134150640329,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5036,i,1980923324771396978,11488788362720825688,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3988,i,729515993029709193,18391305555545971927,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,4120254173713682485,12785283015460152304,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6096,i,10113856039681797444,608441611023031396,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6248,i,1616989792843466797,17188283305211070157,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6412,i,14455212060500411972,12770034736072805961,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6408,i,15405984325798993841,11095660208530842207,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,15827518387111214718,11897307525855512400,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,15827518387111214718,11897307525855512400,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4104,i,6076225779415140129,4845721728549640165,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5376,i,4254365433275867938,15161378441007810204,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6840,i,2467429115294670189,7196706076713236199,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5044,i,12625419117823452779,17234010840503941740,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6896,i,17792161913269354825,11115962665429476118,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6884,i,11346835734674727034,17183625010362400400,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6848,i,14837120159293549295,3375059639847054515,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7020,i,12212721019023812663,3594813733081103304,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8112 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6988,i,2949051326757042628,9716255724933816595,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,12879298482158612276,13496222996411055603,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7112,i,11705212321705071800,17115899000078845518,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7152,i,2336851953836378460,3236205629109238416,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:1
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6948,i,3294567895490947439,550227092325080351,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7208,i,3059507924732210763,14952030749282819614,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,18177242704335070749,8641451291193574,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7272,i,6504781505085595626,8477244879705010373,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7368,i,656490739427517682,13069779690707046897,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7744,i,4769822227634084040,5928777805906946199,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7808,i,4462078515415530518,9116676363656459209,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7844,i,9975990956732009719,15540373574111779603,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7800,i,8388510328654797283,2438998335130558327,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7244,i,15208362613026569844,17864142408018667283,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7856,i,3067144208896499842,10567624153879826085,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:1
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7436,i,971390468196379631,708295872474727006,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7920,i,17852126901874625034,11192928395285851265,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7908,i,12262588462376220526,345182258256834227,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,2385307174282161752,17272774450786089035,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:12
      4⤵
      PID:7388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4448,i,5631242481055250765,16221408218457103085,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
      4⤵
      PID:7396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11156,i,2353066156218672227,3572706425732483502,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=3428,i,3001491153449591998,532090898595461262,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11424,i,4329362304011665248,9741822676154187850,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7800,i,2639445079619939567,11207150338178601304,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11444,i,15212859636796837699,17731064498993174259,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:7436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11488,i,11215872605336741061,14909417683702533347,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
      4⤵
      PID:7452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11448,i,13507576079344542982,5280136753801361529,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:1
      4⤵
      PID:7444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15464867913316961968,16897056100190667065,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:8296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11556,i,5350314085611517334,6878324304062667611,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11600,i,17287674470678431672,1626043606096381457,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:8320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11604,i,18107046035764116919,3256225952311758125,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:8328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11636,i,14662583020353339414,14550266509054175339,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
      4⤵
      PID:8336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11652,i,7023958332367740099,5912925656304741177,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
      4⤵
      PID:8344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=11664,i,4003105309969788757,4070458228221878138,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12220 /prefetch:1
      4⤵
      PID:8360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=11692,i,2403738699560826617,2975257611868369507,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12276 /prefetch:1
      4⤵
      PID:8368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=11728,i,12913328187666319084,459592218609114513,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12252 /prefetch:1
      4⤵
      PID:8376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11724,i,4740429462026934099,1118137890332247104,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:1
      4⤵
      PID:8384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12020,i,8887503810692784429,11006747592412898612,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:8392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=4656,i,14630180890440324405,2930885218808826107,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12056 /prefetch:1
      4⤵
      PID:8400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=4508,i,17975331909185692185,16758585367438384017,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:8408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=4696,i,13165397718286383261,12521290579690038194,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:8416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=4672,i,14894749981858348050,14889916484230476884,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:1
      4⤵
      PID:8424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=4496,i,10350207556836329730,2604307034571067121,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:8432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4608,i,15275340408118364337,4674654472065242630,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:8440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=11804,i,4126546626224975809,4727141823710040320,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12176 /prefetch:1
      4⤵
      PID:8448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=11808,i,16699667375514609859,10624680287588654622,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:8456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=11796,i,9168331342307553063,7473739986317470566,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:8464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=12028,i,7730928046947206068,2594624837085511348,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:8472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8892,i,10437053366585673440,16227616116606865137,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12788 /prefetch:1
      4⤵
      PID:8480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8888,i,17823081011312094221,6741256013863120819,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
      4⤵
      PID:8488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=11720,i,15559316641440995047,4933242487612896230,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=12792 /prefetch:1
      4⤵
      PID:8660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=6884,i,2885285716866494797,11528823764497916960,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13080 /prefetch:1
      4⤵
      PID:8592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=11316,i,6428146092101055227,16189731660902262187,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13128 /prefetch:1
      4⤵
      PID:8616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8772,i,14642503176658522299,15134450638300308368,524288 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13188 /prefetch:14
      4⤵
      PID:8564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=2104,i,14640565160079019613,17712149088173145568,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13624 /prefetch:1
      4⤵
      PID:8876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=8096,i,14514304046292929163,10291904520799781332,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13632 /prefetch:1
      4⤵
      PID:8884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=8728,i,5855754134996744261,14615209730591911414,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13628 /prefetch:1
      4⤵
      PID:8892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=9332,i,9495888193155118457,15518637088215926405,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13644 /prefetch:1
      4⤵
      PID:8900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=9320,i,15911217997872800799,13565932999359682706,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13676 /prefetch:1
      4⤵
      PID:8908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=3384,i,11984366274363150594,10662442757485675361,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13656 /prefetch:1
      4⤵
      PID:8916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=9416,i,16928807632124784034,1470614597345271008,2097152 --field-trial-handle=2776,i,1504000648558717188,2996621247010307450,262144 --variations-seed-version --mojo-platform-channel-handle=13696 /prefetch:1
      4⤵
      PID:8924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1200

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5400
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe"
      4⤵
      Views/modifies file attributes
      PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe
1⤵
PID:5816
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dneliigr\pcqusx50.exe
  2⤵
  PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe"
      4⤵
      Views/modifies file attributes
      PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2876

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe
1⤵
PID:5052
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rue2cwe7\mny14n10.exe
  2⤵
  PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe"
      4⤵
      Views/modifies file attributes
      PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4176

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe
1⤵
PID:4296
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eplvs8ef\7tb45fby.exe
  2⤵
  PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6776
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe"
      4⤵
      Views/modifies file attributes
      PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4868

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe
1⤵
PID:3060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0iv7b674\b643i3lf.exe
  2⤵
  PID:6732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe"
      4⤵
      Views/modifies file attributes
      PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6772

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe
1⤵
PID:6980
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rtn0b3lk\bd8enva6.exe
  2⤵
  PID:7120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1608
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe"
      4⤵
      Views/modifies file attributes
      PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7016

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe
1⤵
PID:204
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z2vibws5\8abiv6sx.exe
  2⤵
  PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe"
      4⤵
      Views/modifies file attributes
      PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4824

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe
1⤵
PID:7524
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcohb3lb\woqmhx6k.exe
  2⤵
  PID:7596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7640
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe"
      4⤵
      Views/modifies file attributes
      PID:7692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe
1⤵
PID:8084
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gbca8exx\c8kq8roq.exe
  2⤵
  PID:8172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7016
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe"
      4⤵
      Views/modifies file attributes
      PID:7240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7936

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe
1⤵
PID:7728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uxhwsn1\ca9s7aed.exe
  2⤵
  PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c4fkvem3\q2y7xkkf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7872
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c4fkvem3\q2y7xkkf.exe"
      4⤵
      Views/modifies file attributes
      PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 280KB
SHA256 64c1adf6c61703eb1e84c401780360ca353f2ea7f57262330dd9622f1d1bd6b6
MD5 acbdb68936b1e8ec9384b0125c76f808
SHA1 80e7f3a77fb7f26c092b0f5d972f76bf50f2ff4d
SHA512 6ebb834f713d705a7d2abda964b4d54c6ce9cc43b845bf78ec814852efb9ac7a5e2e56535d9ce875442afe9aa48d5232d43f323fb2e86bb980da01c5716d4264
SSDEEP 6144:oZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMoyRFu51YJk1I:y4MSb7e+BnnPVEOiDy0yjHsRk51r1I
TLSH
T11A54236620977F6AE4785EBE5CDF47A59136A324468D8FC0A42F0534467DB68E3C3CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 43fc4e22b0625b2b5935d173913c3ee0651dbebcbfac5188e320ea125738dcc6
MD5 25a55905d866f47cc0c51c97f1d4a0ae
SHA1 dedb8b26b38cc3d622b1c143c26d376ad3d6389c
SHA512 1c35330d57e0d77488316e8fcf30909d5e986cb674751c7faab5ae4f56f9ecef97545300c7c5bf613bc554800329995bd476b4d68969e3612efe9e805fd5d9e1
TLSH
T10E71C8540B6308E1E3F4687255E9F055FFF9B81E060B2E81528D7EB4AA86F0750ED5D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c951.TMP
Size 3KB
SHA256 173a568f93a24bb35aaf9979a7175d66604a5dac515555c178a1edf1b96785e2
MD5 5f664afef3206b11280ac5e36adae39b
SHA1 6e9c05ee39a97aff6c72b1aae38ff20e051d7617
SHA512 de69fa3fd723a8080d9be95d980aca074d1910279326a4904f4a9503fb6d1564abf259c59c533f8e5e89579a14b0c79c1c373a55b66edb6c649fb3bbd371e49d
TLSH
T1DD61D8540B6208E1D3F468B251EAF059FFF9B81E060B2E81804D7DB4AA86F0791ED1E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d5741e9bcdd38fe6f9431206c540775f9962d391c4c3b3f434eade5b13460065
MD5 28e6655e310d06c3e99dcdb50e1a86f5
SHA1 bbf32e9d8d923b2637f1faca30efcc2a04d26622
SHA512 5dfa7caa7635187bf1e509e9553c4404431e5a937787b7c23be3944355144c4905d511eec568647883c3f5c6593662940e3866264f576bec7031967b29efc5ad
SSDEEP 192:sxRWRZCE/fdsMrHFSaPzoA8pK2BpbFqHg6+WNsJu99CfYBaVrZ6lGdwIgVMJ:sxRWeE/fdsMrlSamBo5Tafr6KMW
TLSH
T10842C8566928AD775CD7E328FB15BB53D3F91032A1901E49FBFC8A1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c15ed39d5644303d49f05164de70b8b7067097a48a27c8fcc364178999724372
MD5 a45d9430856dd3397ce2b05189e5b0c2
SHA1 f77cd8bd5bc4b551e20bcf2db5ef79fd0990d4aa
SHA512 d921f078535ddfa481829b81c2ac2b77a0b61355eb5974128d5abede3697ef741db9a5dce0ebe52d94c7e31d1f53bbd5773a4948997e4a2d296bf3ad0f9d6fd7
SSDEEP 192:sxRJRZCE/fdsWOHFSajzoA8pKUNs6FqHg6+WNsjjzUi94cBYBaNrZ6lGdwIgDu+c:sxRJeE/fdsWOlSaSZo5EVdBn6KMPc
TLSH
T19B52D756A928AD775CD7E328FA15BB53E3F51036A1D01E49BBFC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c1e182d03eaa55dfc5672a1592c94e4cc8cfb6a7f287dec57539dcf0d1842f2
MD5 891151ab1ec0514ce2d5bb26a46e28cf
SHA1 030f0cc22f64a248a0d19ac607e7d43028b051ae
SHA512 150a4efbaa28ff920834075cd2622a1fc125061a97cda0153573dc49053f38149f46a25de7e9b695193137ba1f56894e4c31d2fd529e977cf908c6393bb21afc
SSDEEP 192:sxRJRZCE/fdsWOHFSaozoA8pKHMsnFqHg6+WNsjjzUi94cBYBaNrZ6lGdwIgDu+c:sxRJeE/fdsWOlSaxio5EVdBn6KMPc
TLSH
T1B452D856A928AD775CD7E328FA15BB53E3F51036A1D01E49BBFC8A1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7caeba964ca84104a2eb95235c42cc2a9388199d83a49ae1aed5fadfad21afb0
MD5 a2c672399ee7377cc3bd724f52fa28dc
SHA1 f4cd6c8db051d4c4a0d303a5d23bcd9cb0f0b77a
SHA512 b156c66ae3cf2c8338e8865f6d06a7dfb82b9a5e0c3d4e8022af1bd2325a2e32923190dd5b50d49340cbd4bbe73affac7ebde420fef4c2e8570a35bd022a4318
SSDEEP 192:sxRJRZCE/fdsWrHFSapzoA8pK5issFqHg6+WNsjjz4cBYBaPrZ6lGdwIgD8EJ:sxRJeE/fdsWrlSa0po5EPB96KMf
TLSH
T1D442D856AA286D775CD7E328FA15BB53D3F91036A1D05E48BBFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 019e72de6ac552fa23decefd344efe15c3a4e4ea80d5b71e4e98beeb8839be5f
MD5 8f984b5b39ebf4dc2771452ea6fb6ae6
SHA1 500f4fcdfae9205ce3850eca2d1828a52052017c
SHA512 42fee787bd1c9405128371a578956ed122f9dd3075ee4f02547399348d75d9664630fd27aa29bb5f5d9937e1302b1f0ce1f5d780b3c21420afcfc73e5a450cf6
SSDEEP 768:Fb1pPD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVzJ8IDroSLXQ:Fb1pP1E7otWgikfq4u1jaoyIweQ
TLSH
T111C2DA3B740CCA7E5F804ADDE8197E9B6DA802CB96D8CD8047FE951C02C6BFE91154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 993fc03ea9f8ec6524960ddd6132d2894114b736497fe2e31e11f9ae03e1beb9
MD5 2281ac361bda8c0eba6805db30ed6b73
SHA1 536ef23df34eae73da60c404afc6ac437399b0dc
SHA512 9f62c089b2d6fdcb929f02bf93d6c4b440dfd6e6ff2a910ff330af0ab55fa3157281f9e2798b5af270dd289356829ca184744ec8806a509d3681b67d78f610b0
SSDEEP 768:9rv+4UNbdC3GKFBqobGG0gpZu4aWADIidy8LqIeVH1S1C:9bsbw3DpZzaNsuVLbEH1d
TLSH
T10D03CF36E859DA739CF79284B2877A077EF891A3C6880AD488DD1F8E41DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b8a416eee2fe50a5e3a02221dd6f67d36a434766e081a2cf22eede1917b4cf14
MD5 0e7fcf0a1ff1a1d3a53c49d48ac0d5a5
SHA1 2630ffca9162bd11fbf8e92bad31e5b25591ec85
SHA512 62829ab7e3e244763f4394e1ce3152cb753a1f6f25b844fc25ada74b52537c0b26a870fe4a200a9ff02d652e8af152acca606d3c3c9d1f5af3de01d1ae35ee06
SSDEEP 768:rrv+4UNbdh3LpMABqobGG0UAtZu4aWADIidy8LuKeVH1S1C:rbsbr3L8tZzaNsuVLJEH1h
TLSH
T15F13CF71AC69DE735CF7A244B2837A47BFF861A384880AD4C8D91B8E45CB5AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a8081d800153d72125ddc16ff99eb055c54a41c01d13aa6db3928f1e0bc03e48
MD5 72d96e724cc96e7ee72220a677f50668
SHA1 6efddef929c0e5abb75a7e275d7bd049bc6c0734
SHA512 a2e3aa897a6276024f337c611ac70efe5e5fc87a3373832e6dbf5fab8da3a1c71e30866750b4e9585ae5f48fd328fbfa7c3a278b78943ba0f9b2f208703e85c7
SSDEEP 768:B03kpxkBqobGG0UxtZu4aWADIidy8LuK8pJ/rhpC:B03k2tZzaNsuVLJoJ/rhpC
TLSH
T1A2F2BF74BC569E7798AAA344B2833A47AEFCA1B3D4C809C5D8ED5B4E04C35AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8e5c2ab36ece00c514237f383d39f664580160944d79494d81af5ccc40188eaa
MD5 bcce1dc5b62e00f5bfe9673ac4c8b4ca
SHA1 84f460898429ff6184cd4eff825daf21895f734d
SHA512 69ea385bc7f9676f1f0fcd7f9eec70e8caa9dbdc8c17d2e6dd16436db47e16ef46aaad78a9bcb047061a45f21164749c86cb8efd77da45832e54ead0996641b8
SSDEEP 768:Hrv+4UNbdC3PkYBqobGG0U9tZu4aWADIidy8LbKeVH1S1C:Hbsbw3ztZzaNsuVLuEH1d
TLSH
T1D003CF35A85ADE735CF7A284B1877A47BEF861A3C4890AD4C8DD1B8E448B4AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4102c7159fecf5a85d42e00faeef626ea7086dca346d1c797f9f388c4f023e13
MD5 b2c74085bc5243ef5d91e99479d596a6
SHA1 439c059bc8a8f4754cbe587b31be079147debf97
SHA512 6cf51498b1a230c46f3b6044ea93eaacb8580c67fbe4e03bdeaf743eb750f77aa6c2a173c629fe4aa08b9347facb7161b04cbeccb8dede02024271e98b3ebe84
SSDEEP 768:r33np/6BqobGG0UxtZu4aWADIidy8LuK8pJ/rhpC:r33n6tZzaNsuVLJoJ/rhpC
TLSH
T189F2BF74BC559E7798AAB344B2833A47AEF8A1B3D4C809C9D8ED5B0E04C35AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6bd617de996e7482b21f0a1f91ba5c42fe4113e258a9bc9f4e28e953967998e5
MD5 411bccc51fcfa710f697dd4ff95636da
SHA1 8f8c648099d49bd63cfe6092d584607df87e7fc6
SHA512 851c48dc5c1413a1a78e5343ad871367e4f88ad45944f1325c6bdc7b5c42c604423c0a17705e42deb6a827d3a6c1d72e298045b81de40dd01bf3bd758f170640
SSDEEP 768:3rv+4UNbdC3EfeBqobGG0U9tZu4aWADIidy8LbKeVH1S1l:3bsbw3FtZzaNsuVLuEH1e
TLSH
T13603BF35A859DE735CF7A384B2873A47AEF851A384880AD4C8DD1F8E45874AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ceb2b04-f572-4f42-a115-919291281ce3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ceb2b04-f572-4f42-a115-919291281ce3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\base_library.zip
Size 711KB
SHA256 7d9be40a1db9085521d2d34992bf6b07d3b452f1d77801c7384005f2f081a445
MD5 f41fcbad9910020346c6f76d8d7cb00b
SHA1 a0b3c2df633fd5b9568cfe12e4803a7574a0d7d7
SHA512 df4a79122bba1948fad8541e3b8e594e98f1c7132b525f57f33578b1f2288607cc9824fe12f408906058c9a4719384b02c6a2eb50d7f11eb0ec41f8b46d2ec51
SSDEEP 12288:JV2osQNRs54PK4I1sdvV0c1axhk1bbfyEmoQDS0hLr7GP:JV2osQNRs54PK4I1sdvV0c1shEfyEmon
TLSH
T171F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rk2wk80h.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\btz6qbsg\rk2wk80h.exe
Size 5.4MB
SHA256 120367bdb145554138d288b333e48dd0842bbeed90d28b0fff5d15859ae27555
MD5 3f100ea3a66f3eab1933188627151787
SHA1 3806609210c36fb5d24360f75e954438b1685419
SHA512 e064eb214522c12f6c7e20791d68d1b1212802459241906b46dba3235ce9dcb2b7c6983b9487ec2400b904205c75431062b11385bb37cd1de90f8f68af8d486c
SSDEEP 98304:8JgtojfICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllfHnMs2i6LRe:nYICteErownP0oTcMsABqliTtLk
TLSH
T15C463314B3A808E2FAB3D13981665621E473B4254BF0D1CB43AC97662F677D0AE7FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads