bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6

Analysis

max time kernel
4s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
Size 5.4MB
Sample260817-vt57aacf33
SHA256 bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6
MD5 c6a8ebebf9dbdfa7d2bceedd4f4a025f
SHA1 33a2edbc63286149dc57680c5d045c4be04b3b0c
SHA512 f2763fbad3562d1ab6a5ae2c07b96b5d1c155efa9dd5704f2881b0e6e8de44938ed40ba191e305f00832220b3eec2ac6723bde104e07b19ff424eccab180ecb5
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrM:k7ICteErownP0oTcMsABqlkgczo
TLSH
T143463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uolrsb.exe	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uolrsb.exe	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe

Executes dropped EXE 2 IoCs

pid	Process
4712	zl1efzct.exe
4604	zl1efzct.exe

Loads dropped DLL 22 IoCs

pid	Process
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe
4604	zl1efzct.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\k5rddgaf\\zl1efzct.exe"	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
233	ifconfig.me
795	ifconfig.me
1296	ifconfig.me
1308	ifconfig.me
1641	ifconfig.me
2966	ifconfig.me
3422	ifconfig.me
3451	ifconfig.me
382	ifconfig.me
1060	ifconfig.me
1474	ifconfig.me
1747	ifconfig.me
2666	ifconfig.me
2728	ifconfig.me
3690	ifconfig.me
178	ifconfig.me
519	ifconfig.me
560	ifconfig.me
1532	ifconfig.me
1725	ifconfig.me
1760	ifconfig.me
1777	ifconfig.me
3189	ifconfig.me
59	ifconfig.me
113	ifconfig.me
225	ifconfig.me
505	ifconfig.me
567	ifconfig.me
1292	ifconfig.me
2619	ifconfig.me
2855	ifconfig.me
243	ifconfig.me
747	ifconfig.me
848	ifconfig.me
1352	ifconfig.me
1392	ifconfig.me
1505	ifconfig.me
2022	ifconfig.me
3148	ifconfig.me
138	ifconfig.me
220	ifconfig.me
495	ifconfig.me
712	ifconfig.me
897	ifconfig.me
1455	ifconfig.me
1548	ifconfig.me
1757	ifconfig.me
35	ifconfig.me
39	ifconfig.me
267	ifconfig.me
1128	ifconfig.me
1367	ifconfig.me
2464	ifconfig.me
3491	ifconfig.me
3686	ifconfig.me
268	ifconfig.me
314	ifconfig.me
322	ifconfig.me
719	ifconfig.me
1581	ifconfig.me
1790	ifconfig.me
3223	ifconfig.me
385	ifconfig.me
1327	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5752	cmd.exe
5464	cmd.exe
5396	cmd.exe
5560	cmd.exe
3020	cmd.exe
2004	cmd.exe
5808	cmd.exe
6188	cmd.exe
6164	cmd.exe
636	cmd.exe
7712	cmd.exe
1900	cmd.exe
3368	cmd.exe
4932	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1492	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4276	2444	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe	85
PID 4276 wrote to memory of 1900	4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe	86
PID 1900 wrote to memory of 4888	1900	cmd.exe	88
PID 4712 wrote to memory of 4604	4712	zl1efzct.exe	91
PID 4276 wrote to memory of 1492	4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe	92
PID 1492 wrote to memory of 780	1492	msedge.exe	93
PID 4276 wrote to memory of 1928	4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe	125
PID 4604 wrote to memory of 3368	4604	zl1efzct.exe	95
PID 4276 wrote to memory of 1592	4276	bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe	97
PID 1492 wrote to memory of 4188	1492	msedge.exe	99
PID 1492 wrote to memory of 4836	1492	msedge.exe	100
PID 1492 wrote to memory of 4836	1492	msedge.exe	100
PID 1492 wrote to memory of 4836	1492	msedge.exe	100
PID 1492 wrote to memory of 1860	1492	msedge.exe	101
PID 1492 wrote to memory of 1860	1492	msedge.exe	101
PID 1492 wrote to memory of 1712	1492	msedge.exe	128
PID 1492 wrote to memory of 1712	1492	msedge.exe	128
PID 1492 wrote to memory of 1944	1492	msedge.exe	103
PID 1492 wrote to memory of 1712	1492	msedge.exe	128
PID 1492 wrote to memory of 1944	1492	msedge.exe	103
PID 1492 wrote to memory of 1944	1492	msedge.exe	103
PID 3368 wrote to memory of 2116	3368	cmd.exe	104
PID 1492 wrote to memory of 5040	1492	msedge.exe	247
PID 1492 wrote to memory of 5040	1492	msedge.exe	247
PID 1492 wrote to memory of 5040	1492	msedge.exe	247
PID 1492 wrote to memory of 1372	1492	msedge.exe	106
PID 1492 wrote to memory of 1372	1492	msedge.exe	106
PID 1492 wrote to memory of 1372	1492	msedge.exe	106

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4888	attrib.exe
2116	attrib.exe
6080	attrib.exe
8	attrib.exe
6312	attrib.exe
8932	attrib.exe
4704	attrib.exe
5184	attrib.exe
5800	attrib.exe
5688	attrib.exe
5624	attrib.exe
5320	attrib.exe
6340	attrib.exe
7072	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
"C:\Users\Admin\AppData\Local\Temp\bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe
  "C:\Users\Admin\AppData\Local\Temp\bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe"
      4⤵
      Views/modifies file attributes
      PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffb29b9c188,0x7ffb29b9c194,0x7ffb29b9c1a0
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,3513454898890776353,14380089780968724497,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
      4⤵
      System Time Discovery
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,12458687096244426492,666390485376524854,262144 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,11130435688264984370,7208152215675920585,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,14476494815071224037,1746038169501626424,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,5000472208822441883,4345722101883465087,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,1407438296434400626,17661705905116672878,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,6292424751751670184,1884326056616932228,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4532,i,4048101769705539563,9150583907127696840,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4912,i,5054948087898622687,7482910401874079764,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5484,i,14955520618559478809,15072396056406294656,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5608,i,10188401041227086339,10580956575362049472,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,17884483240788564756,11804483838602958463,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5884,i,15075519317530741862,6688344774168576781,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6088,i,12357425825755685858,6203777270494436781,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6224,i,5840141559213976886,9319022159703773864,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6456,i,12756863494326449504,5306021289551680184,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5352,i,54503746241745174,7299556383972635368,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6664,i,6515379581502989246,15669960319428304391,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6816,i,11057504784668754281,15806022737075241386,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6968,i,13509807321404599282,12209091338722615451,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7004,i,14221459212539868395,10306061558962959294,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,16717148787213818783,17962822066806592807,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,14435152811699773163,14964752478028345368,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7676,i,12356893381505842575,506723399220322469,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7928,i,5471401601297616328,15884574587379782635,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6668,i,14634716510692456127,11724785344041595712,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,13786784558083102054,15559310709913413505,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,13786784558083102054,15559310709913413505,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6968,i,10774560551869431102,5856418443024624527,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8344,i,8919262713316585725,16632900219068741737,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8212,i,9383172395600276629,3054265637380071812,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8304,i,11207574959653651605,2449761545206613559,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8216,i,991439640155540567,11552959033020394640,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4632,i,15355471355354555385,3912830644191057744,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4744,i,6795732104809780745,4970030000413708929,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8284,i,6567992371934416075,12901640470312321676,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4700,i,7418019290298711045,934662922521837730,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8416,i,10293041701755577112,14671621313197594902,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8504,i,14061913516395271959,17567710188979620864,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8580,i,6460972074696944172,8859272962223427270,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=9796 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4720,i,8653784460454626400,5103043405307925807,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8624,i,9637811519823284813,8111912146345506844,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=9868 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8720,i,2673329469623977423,14371512064569828788,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4464,i,8700616688055385085,5819870996922633679,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=9968 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8740,i,9751645657159535489,2456622805886666955,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10016 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4388,i,7407733100808964574,13783968649439501806,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4268,i,2268395413804712559,1152064712767092247,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4444,i,13803248655816705051,2380875615432072228,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=9948 /prefetch:1
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4384,i,11516670022988952631,17854124610098425904,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8788,i,16777208973643706878,469350171213934328,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8808,i,17171902045050280980,10549300733974085294,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10244 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8904,i,4365715388750972905,17200475626341541650,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10272 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5028,i,4132342228029353171,3785181602497913581,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10320 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=5044,i,12486049989100248908,16458285263305771157,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10380 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=5828,i,1966131049763147615,7716356190971594946,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10408 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4900,i,16218547176596626844,10858525662148668077,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10452 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5636,i,5814568341068923078,9964064203790193553,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10488 /prefetch:1
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9016,i,13301941987925527093,1281581967014081160,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10548 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6608,i,16386685710389679959,6694909136298982716,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10620 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5544,i,17593000044332538662,6351143092837830614,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10608 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9044,i,17795334634185863900,13487636995539812606,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5900,i,14328870039143939588,13624840071501611222,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10596 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9136,i,323650345607221402,323891276397866295,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=10504 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9164,i,7663413847616172561,4432895735260176554,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:7796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9252,i,584404435490039754,12662843635449301690,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:7804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9268,i,14923717518487542811,4405019278089868918,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:7812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9472,i,11632938920771572796,17202554694527474659,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11672 /prefetch:1
      4⤵
      PID:7820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9496,i,7998170483681422035,11582107031962219912,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11728 /prefetch:1
      4⤵
      PID:7828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=6904,i,9637581927590011780,13401827936138004202,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:1
      4⤵
      PID:7836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=6908,i,14806635986425845309,9395033188538243757,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11800 /prefetch:1
      4⤵
      PID:7844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=6804,i,13123994490950967712,9210542529080013781,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11836 /prefetch:1
      4⤵
      PID:7852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9480,i,1432426290342228456,11211681031329679323,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11872 /prefetch:1
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9692,i,7946988426152590998,14682586729184494468,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11908 /prefetch:1
      4⤵
      PID:7868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9724,i,13685547183006289929,7967044238355989117,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11944 /prefetch:1
      4⤵
      PID:7876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9736,i,7715859582876411527,17478656846485259161,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11980 /prefetch:1
      4⤵
      PID:7884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6788,i,8557808261098574624,11920925311122378893,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=12016 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10812,i,13023812023473902183,11510472362704053859,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15136 /prefetch:1
      4⤵
      PID:7900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10840,i,11582703299007041152,10362776983087286280,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15168 /prefetch:1
      4⤵
      PID:7908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10848,i,16166714155767313462,14339481054639671748,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15204 /prefetch:1
      4⤵
      PID:7916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10896,i,14126279508963737443,6053813927982675950,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15240 /prefetch:1
      4⤵
      PID:7924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10924,i,9026988248683225240,8902671585069119738,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15276 /prefetch:1
      4⤵
      PID:7932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10964,i,6151722685636861049,3233032973382984727,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15312 /prefetch:1
      4⤵
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10972,i,16246027940006366118,12036687202899498083,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15348 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=11032,i,17132782964558043996,16764168308847144644,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15388 /prefetch:1
      4⤵
      PID:7956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10984,i,12568196545858905859,17512868135866188376,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15424 /prefetch:1
      4⤵
      PID:7964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11064,i,1070342756134688010,3459001512450387927,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15460 /prefetch:1
      4⤵
      PID:7972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=11100,i,15182006099114392237,9373934827813585248,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15496 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=11120,i,13962958635464479598,10458246684418560773,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15532 /prefetch:1
      4⤵
      PID:7988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11084,i,9590225241083058427,7173326531673714394,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15568 /prefetch:1
      4⤵
      PID:7996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=11156,i,3996614922985853925,16383677820502756191,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15604 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11184,i,18332564971498057721,7103286904374047669,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15640 /prefetch:1
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=11212,i,3368308840784064378,10416530669092311780,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15676 /prefetch:1
      4⤵
      PID:8020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11244,i,739673869605504512,15664647125063998894,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15712 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11192,i,13719504161098171883,9775145477810617743,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15748 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11332,i,2498450697950562348,2080630609893594035,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15784 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11308,i,8188326254620315202,6285480532541057626,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15820 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11368,i,18091029501206267653,11834050785534974341,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15856 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11384,i,1836134602135223571,16945632010117647076,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15892 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11432,i,14211893513335909190,2181600939928975810,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15928 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11436,i,13935816433491045553,12440157233322844976,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15964 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11408,i,3040546172153916238,8385865534176218544,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16000 /prefetch:8
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11444,i,12570249988088864481,1766254023139359059,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16052 /prefetch:8
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11460,i,17427785622318798289,675590680224272906,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16096 /prefetch:8
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=4580,i,54667651678744139,13909376013111805097,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11500,i,11225845552729239544,13544059160379520503,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16144 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11484,i,2508417405294259010,16785950502811865644,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16140 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11548,i,14681373024624634017,1461018727797796399,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16168 /prefetch:1
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11496,i,9322523571736140543,3054861667852790307,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16156 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11572,i,11706319074607361310,8896529806569881351,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16188 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=1836,i,6728047408325958545,16080498902779685470,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16288 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=11656,i,10211596268799631664,9805564722439544348,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16248 /prefetch:1
      4⤵
      PID:7080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11680,i,5512732379019886359,16941917234179965473,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16268 /prefetch:1
      4⤵
      PID:8188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=11712,i,16777773968556374607,13661972426293372841,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16308 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11616,i,4150489001404770439,8171437216734872575,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16208 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11628,i,10028433613618874992,1956656010903761819,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=16228 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=6620,i,1191431182240229988,2492380275620838064,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=21088 /prefetch:1
      4⤵
      PID:9176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=10832,i,17037457558474171982,14704134713503215659,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=15000 /prefetch:1
      4⤵
      PID:9496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=17204,i,12764871604413830565,9492384422603160827,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=11216 /prefetch:1
      4⤵
      PID:9904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=20344,i,16397737055781697298,4232212818826655277,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=21716 /prefetch:1
      4⤵
      PID:10116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=21956,i,12062238041179460444,9077719893759349152,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=21960 /prefetch:8
      4⤵
      PID:8844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --metrics-shmem-handle=7120,i,10747630090800230030,11128706111317522938,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22168 /prefetch:1
      4⤵
      PID:10128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,4414765134806564412,9536243813552803642,524288 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22172 /prefetch:8
      4⤵
      PID:9852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=6076,i,12489134404008432661,5968476716550820930,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22188 /prefetch:1
      4⤵
      PID:9720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=9768,i,17253644074252624919,1421294102808561467,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22204 /prefetch:1
      4⤵
      PID:9464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=6668,i,12890476868857897007,1740769126540105353,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22224 /prefetch:1
      4⤵
      PID:10108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=1600,i,434678720182899870,15480044580633004646,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22236 /prefetch:1
      4⤵
      PID:8580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=7332,i,11094461571028422305,16914982769572738118,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
      4⤵
      PID:10544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=8416,i,9198428731423247470,339325335155481041,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=21536 /prefetch:1
      4⤵
      PID:10672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --metrics-shmem-handle=10196,i,2995399252604682517,1188139022936169917,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=22672 /prefetch:1
      4⤵
      PID:10848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --always-read-main-dll --metrics-shmem-handle=8720,i,5468065495323325445,4691292897416525659,2097152 --field-trial-handle=2188,i,7488285712418466612,17684682002607669633,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:1
      4⤵
      PID:10932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe"
      4⤵
      Views/modifies file attributes
      PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe
1⤵
PID:3060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hvuo6cbb\g38t1m06.exe
  2⤵
  PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe"
      4⤵
      Views/modifies file attributes
      PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5504

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe
1⤵
PID:3196
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h30ule9l\9bu5ic7j.exe
  2⤵
  PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2004
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe"
      4⤵
      Views/modifies file attributes
      PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6012

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe
1⤵
PID:5648
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wfl0od0q\yu22kwb9.exe
  2⤵
  PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5808
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe"
      4⤵
      Views/modifies file attributes
      PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:888

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe
1⤵
PID:5216
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uk7ohphd\2868pml4.exe
  2⤵
  PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5752
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe"
      4⤵
      Views/modifies file attributes
      PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe
1⤵
PID:6012
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucd3t0su\tku73jrb.exe
  2⤵
  PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe"
      4⤵
      Views/modifies file attributes
      PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe
1⤵
PID:6088
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sacojlnr\uy1iitlv.exe
  2⤵
  PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5396
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe"
      4⤵
      Views/modifies file attributes
      PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe
1⤵
PID:5892
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xt154pz\p4lf4oe8.exe
  2⤵
  PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe"
      4⤵
      Views/modifies file attributes
      PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5340

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe
1⤵
PID:5192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iafajv1e\7ruqib7b.exe
  2⤵
  PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe"
      4⤵
      Views/modifies file attributes
      PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6456

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe
1⤵
PID:5340
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r4w66raw\zjpszwci.exe
  2⤵
  PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe"
      4⤵
      Views/modifies file attributes
      PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7016

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe
1⤵
PID:6992
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b53dwsvi\d8qi0d94.exe
  2⤵
  PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe"
      4⤵
      Views/modifies file attributes
      PID:6340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6372

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe
1⤵
PID:6232
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wv133s5v\lqk51dxq.exe
  2⤵
  PID:6880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe"
      4⤵
      Views/modifies file attributes
      PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9860

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe
1⤵
PID:7684
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bw02wf92\vgedn52a.exe
  2⤵
  PID:7776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrbp6afd\nt7zjzv6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7712
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrbp6afd\nt7zjzv6.exe"
      4⤵
      Views/modifies file attributes
      PID:8932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 280KB
SHA256 116caf093749c2e465d1de3576c079ebcf73cdd51283000054e82218cde88569
MD5 cadeb452f59265a41c0faa94b574fc53
SHA1 701cb7cc4374f0e6b766ae145c16d12e2b229a86
SHA512 69f242eb2ebe3ee8387795d02f5f1ea4e586431949fff3bc3423f0bf7e1e27c6704e364c5b80c499275118951d3bc8fc01ffc676d7ec25bbc54627df5a78b531
SSDEEP 6144:zZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMolQKdKX:14MSb7e+BnnPVEOiDy0yjH6X
TLSH
T17C54229610CBBF7AFC380E7D1CDF82A551327658579C8EC0E52A061846BEE98E3C6971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 43KB
SHA256 23527dd91c3842a9922b483c5d8c066e81ef9daddebf843beeb9060eef46b206
MD5 9919aa488e5957c9a473565c4de111ed
SHA1 8c72a709adf61bb299edd9fb5176e99fe032d079
SHA512 f5d48682bfc604e8e8742864c0890b0f6d277a495e69cb64a915fd1525461fca2e20fa350a7a80cfbaea134c9292010120d401a06a3ced96564dfd3aea5ad736
SSDEEP 768:Lhy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30//oLDWb2KnBrM5:LhyqeUG44t6gecNW+o30/Ea2
TLSH
T1E713F297A7114E2B3F3DA3CD581DE045AE48BAD0EA014CC18E7D69DAF1F60D3C54956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 67KB
SHA256 638b172264227fb49b4e9742f47e89e194c83f2fea2727e9e087fec664778846
MD5 5ea68132ca85b3e930bb15fc6a21c0ae
SHA1 14dbbaa2886d9c8fc1d99a32c859037bd5f14a6c
SHA512 e8d424849214196fe072e2f0995ab22a111dd2dda8a4ceeb29b97f3abc26061c82676148c3dc7e4099151138242d0f9b6537ebb2a698080542f254213fd3c482
SSDEEP 1536:z4trsJKL6dlOj+a/gPGe6QCeEL7lhB8CCpjVVvzUXFuG:kt4JLlBfPGe6jXnqjVV2sG
TLSH
T1026312F2B13423086B2FDC0F1AE36ED7F751523038642EA445506A657C7E7EB1838A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 86KB
SHA256 ab2b0450d3db9468bf7b35e0608018fa8050efa44d7da16bb699a54ad3dcbb72
MD5 e91a88e81dcc4fc6af21a2ba7329b8a7
SHA1 2500410ce0ad3c6271978a5f5433bdeba1f860d8
SHA512 38639ad4c4e749f9461d5dea497e1f9c48b9ae4f23a64a7df719ba86f05c5c0af140e69ad7567b36c3c8059ba61f531dbe115f37c6fde41ff3fba0be4dedc3d2
SSDEEP 1536:tWKxFg7/5QIHoKQVfaUX4EnrSCn7uX9eaADgv9FT/QX+lJdU5PsQv3iWMY/iurM2:tXomVfaUXrdG9CcVFTQOc53uYiUM2
TLSH
T1F193127225D671FE74F550EEF560592F39853C6323DE422202AD0D9F874A27EE932BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 280KB
SHA256 c01b1d80e64d36c37014cbedc15ccdcf20e826e07cfdaa2094c6d4e470d2c3b4
MD5 e41b573b17e43967fe3e55c14d5dfe85
SHA1 459afe1e3faf34a5a4698bfb602961f1f296ead7
SHA512 f769ac941ae6ba94b361a03c8c3796f3b811d5a0e4c2aacfc23ebc1ee767daf6d5fadbae4c4d27928d59f5daaa5daee91358b0caf9469e1438ee2786e8a46741
SSDEEP 6144:amiJ2UKW82ExgTbtMXV5WlYdI/CsUcBrRmlwrqfQ+XealtgaO:aALWqxGyV5WlOI2cXmlwG4oeagR
TLSH
T12D5423720D90C077A60628E96F8426B0F119E6C17C52D8DAF1EBD4D035ABCD7E678B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 25KB
SHA256 69410563d91a0235de025ebb0e5ce0778f1a69da79759cc6e7a4c9a202b1d0d1
MD5 e57d06d2bedbc69506500f3257344451
SHA1 25a092cfa2b246c8e059736aa795ecba023222d5
SHA512 ea1ba78f63f39281f596bd9424b2e5d39fd69bf663afecc2fecba10df3c6c720822116cf6db4cb24199494321d060f034452d66cc2280f80e6c5fd3090e5d314
SSDEEP 384:0ovUox5ADx82SW6B8X77qNTvd5LWXNrlFafiC4pDkS8cVT/667lyGBvQ:HD5AA0vqlbL627KtxflH4
TLSH
T1AAC2E1097FB40128CEA3FC130C5D515C01EC8425952B6CB393E1763D4A7AAEF1CA6BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 478c19e1e7b7c4c18700a380306242131e8705f253faf3fa1d6012eb80d4902f
MD5 512d1ab70ada6aa36c062c2de1363a5e
SHA1 fd61eb5154e9006da579b5a720d580767af43359
SHA512 b7a264685260f794703d5051d87bd6232dca69a4063dea7d7a2ecb68494587297b8874da6f13944e560ed46524aba07ceb747ddf2b2525f2dfa055c1df8f87f1
SSDEEP 192:sxZu6RWyM/jK1Ml8MjY/fQsiApKEdpLl5juFq/W6+WNigY1F9r9mMZYBuoaxIgyJ:sxZbg7Y/fQsiApt+ibEXvZpO
TLSH
T1C452E812AA345A778DEBD219F951BF57D2F5056396910E44AEFCC92C04E3AEC6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 526957dfce390b8da69f003ad0a69a0a252cffe1b772387e17ed8af82ed137e9
MD5 707a8af2cde7bd3f071529cfab30fa13
SHA1 edd4cd5af116d25ace0a9a2cf0a56462dcac8b22
SHA512 f7a6a02aa2392c1ef94680f2706706d8971fb142b9a55cab1460bbb73d6c50e234f7f1750b272a67d06d5e0860a2c58985d3e25183649bf2c64bb52119ce5c54
SSDEEP 768:sq8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAALl6opdnros/kSUnj:sq8iJANWvx76ru1jabALocd0wUj
TLSH
T11EE20A3B680CCB7E4F844E9CEC2A6F966ED801CB5B944D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b6a25224c87c0e79c28713fea5b8e12db63c4be180b4e4575a466a4a3715ad0
MD5 cdc11491c6dd7c00978adfb4e03d07ad
SHA1 11655a0f55146894b0ff15871c4fc32481ed79bb
SHA512 2ebe23d9df90a28bf6552e7be08a502e3ed0e8bd7fdf78b49a24ecf7ccdf3656486a54b909ef78bdfba49201c5dc8e23d7869578ee3ef4911d12737ade894855
SSDEEP 48:KwfIlKoK6IfKTiELyp4IXKRGcVVIxKWM8ryD:KwfyKoK6gKTiaK4YKRG2V6KWMyg
TLSH
T141A1210275FB42152C7E2A1C926587264B42BAB33018E43B7BF904F10E6BE245DFE4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b8cf73d4ddd66d2f75ea2577215c7f32f4d869aeec7a25710d736baa5122a6eb
MD5 3d3cbdb8198241d5c02d3ec35062c0ae
SHA1 80e977cdfa5c2d5bda39ef9a13a330584baed4fd
SHA512 f1ccf9ad68d1d9f29a32e0644c111426548216bd11a6b5c9459da8ad2cef9dee31da33024a721e3314d73760079654e49b648fb2b54fdc7dc44fb4a039d9aa96
SSDEEP 192:z9QsNG3QuJpqmnNqQmiU1/qYeqk03bb9zUNEjecIYqCQyJZIK1Fq:zOsNG39nPw0YhkqbFUiSi4n
TLSH
T1C64229702878AC375DEBA506F44737535FB850BBCE856F84D9E99B2C01C729C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fe9ceb7280202abd8b3444517bb437a51bde28913fe44c730023175b2a297c35
MD5 47228973d30f7ace6165d1867d848051
SHA1 8a00b569f85dd4a550158c0cd94771a117e539b4
SHA512 58717cc4163d8142e440dfaee5e86ee2392db5ec5f069f6d9f011398161ccb2f038193a032799fec7f7db724e946be12a47531e233d58d0fcf7ab6b717938cf0
SSDEEP 192:uu9LsNGLQuJpqmnr5QmiU16qYX6k03bb9zUNEjdLIYqCQyJZIK1Fq:nZsNGL9nPzBYKkqbFUi+i4n
TLSH
T1504239712878AC375DEBA506B44737935FB860BBCEC51F84D9E99B1C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6bdfaaeec38ccf77f82f22d5e097bcb4d5c6c7a605dde04c3a757bb231afb3e1
MD5 c6822575019a40339cdea923302791e2
SHA1 86f54516c9930d610aa256c82745908841bb8568
SHA512 cfc3d15ffe7816303c8170d65b3949e6300fdefb0143fffa4dd124e0ba2b0b9786e2c42ca63c09f9221c60399ed1ce4370c71d544a43a0a822a2c701bd77ed80
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5R5DFBhPwivh50xy0SFYK4AxYYCbz:gONZ6kDfQmiUyT7Z903bb9XQiXCCU6
TLSH
T1F602F93568786CBB8EE3AE49B48777275FA4113BEAD52F84D9E81A1C00D765C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c3032e0e00b177fec3643a4dddd45d7e5b01b99d34be756a11e9f086f4a9e3d6
MD5 15c845cd521066fcc546f041f646d3cf
SHA1 2709d9b2d470269754614bfd5ccefca45b74989c
SHA512 7cada640e17cc9a1b5051984382941d09a89741db4fc59dc7eefe85ea52ac2f2909f5bbab90383682d0677e81d2335c15fd79a4444e13c6dc15da591e1f24b47
SSDEEP 192:zPsNGzQuJpqmnmQmiU1cqY11k03bb9zUNEjecIYqCQyJZIK1Ft:zPsNGz9nPCTYPkqbFUiSi4Q
TLSH
T16D423A702878AC379DE7A546F44737934FB850BBCD856F85D9E99B1C01C72882B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 930339b11ad5eb3522d207395eee89bc42f908209e0a38a3826f20a1e9566e96
MD5 71b2c3078feb8f373a2298c7a8ff6781
SHA1 d78124e33f106748eedb496072ebb576050919f8
SHA512 05036cdad7aae78e15dfa976fad28db4cc7c0603f3e18993385fc473666fd23ad680140a166763e58e58493cd1e1b623bd280ba3d59348b34cc139a34c29683e
SSDEEP 192:z7sNG5fQuJpqmnWdQmiU1JqYl1k03bb9zUNEjecIYqCQyJZIK1Fq:z7sNG5f9nPWbiYTkqbFUiSi4n
TLSH
T1BE4229702838AC375DE7A506F58737935FB860BBCD855F84D9E99B2C01C729C2B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 40f574a846e1e934345d73bb2edfd20243597cee5f4cb780b83ea2c9c65e49e0
MD5 712016bc8eab722a994877d918c6a343
SHA1 9a3d82c6e53d77ce47775c27670d795689a7f1bc
SHA512 d10188365efd3a500090ad921b4d215d9e9073a81720fe7e15925ad39f0f04c98d13b16ceddd0aeed5331bd9ec5a3244f868e14f43f88be2a187012f1cf29913
SSDEEP 192:zCsNG3QuJpqmnSQmiU1WqYGyk03bb9zUNEjecIYqCQyJZIK1Fq:zCsNG39nPOBYhkqbFUiSi4n
TLSH
T1304229702878AC375DE7A506F48737535FB850BBCE855F84D9E99B2C01C729C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee77ee715ce75b12519d3d699d036804bcaa553a116abf58d1ca65ec60308b47
MD5 f180ea0a73213a02e293afa95a97f8b4
SHA1 1f2275aa439a0afb3f1bff423122bc29f8f3bf3d
SHA512 e85277f761274826c2f31c8634b89c429ecf237ceecbb6c7512872388c0086fa219d772ed8b9c6e4e9ccd65e5ec2b97b728c6f8e498d926d7005db98a88f09b5
SSDEEP 192:zasNG3QuJpqmnSQmiU1mqYD/k03bb9zUNEjecIYqCQyJZIK1Fq:zasNG39nPOdYDkqbFUiSi4n
TLSH
T1DF4229702878AC375DEBA506F58737535FB850BBCE855F84D9E99B2C01C72982B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d3efd310ca3816809359698653160f66629900cadf4c77f05dcf4cc94a82e834
MD5 c7fa02c4a1ced9101c5009f3f1756838
SHA1 d1cfc4b86fae2d3e0b672fd59854e831c9ae093a
SHA512 c0afb3bce5542a1113ae4eee830176a8ab940bb9742e66f69fe3a6b185f0c5f8e1dc3613b8e9eae27f88bbd9f19b7a4fc572d6593cfc8b38a374e79f079bbd02
SSDEEP 192:zasNG3QuJpqmn5QmiU1ZqYUUk03bb9zUNEjecIYqCQyJZIK1Fq:zasNG39nPXuYNkqbFUiSi4n
TLSH
T19C4229702878AC375DEBA506F58737535FB850BBCE855F84D9E99B2C01C72982B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9df32396c45eee1293010503c7bf00fbd483eadd0d5ec64094d57aff67123da5
MD5 eb8b654d7bbf6c08a36206c8a2640d6a
SHA1 085970d5658e23a94cca7f4d902a9fd11a56d6e1
SHA512 0dd944b700c9d7f6a19d4929424ad25ac4a99f8b5eadd15d4ff15feb1878c065f8d563bfcd9867aca6db953ca4054db841f8f77d43a57da1a3b4a77c4b862e0a
SSDEEP 192:z9AsNG3QuJpqmn2QmiU1SqYI9k03bb9zUNEjdLIYqCQyJZIK1Fq:zSsNG39nPSdYwkqbFUi+i4n
TLSH
T16F423A702878AC376DEBA506F54737535FB860BBCE855F84D9E99B1C01C73982B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8fbdd676c0f17e5d3b369909d2f05503f419eaec866fac59079597c77a8caa26
MD5 345e70f8748b6f77273b4cdc6e7f8f43
SHA1 f1b054784b50456255f9ba5bf9b0153a09745991
SHA512 e6cdb1d3a3ddb4451fd6138bf47eba5d3d4bcad4745c472ec9c3e51ad8620c266c4cb57c8e416e748f2ebabe76f16eee1d4638c686eeabeb3f987098801e5cee
SSDEEP 192:uu9AsNG3QuJpqmn2QmiU1zqYZAk03bb9zUNEjdLIYqCQyJZIK1Fq:nSsNG39nPS0YGkqbFUi+i4n
TLSH
T19F423A702878AC376DEBA506F54737935FB860BBCE855F84D9E99B1C01C73982B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 854ebf0f0089304fd153fa56225543036d5501fadf78db6d090c72b01508478c
MD5 87ccf42e3a6bd05ce6a011037dea6364
SHA1 93811d5be613a2090db749597c590253c8bee9fc
SHA512 be4793e9ef57d698c40ad5702bf7e56d9c36d0ae3dfe6decd8dfa1eb7b1be16286a5cbb768cc287efb3c19164413dc9ba1133463c752ca44ef3cc8239fb108fe
SSDEEP 192:uu9WsNGLQuJpqmnkQmiU1ZqY0hk03bb9zUNEjdLIYqCQyJZIK1Fq:nAsNGL9nP0SYIkqbFUi+i4n
TLSH
T10C4239712878AC375DEBA506B44737935FB860BBCEC51F84D9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b035d787fb87b2ec73fcaa39be3090375957cc760f7cb6e597b51b24766e325c
MD5 4af0718295d1cf667bdaefad344b0d2b
SHA1 5895800f8bf2b85826a3d2a43ad3201e1f68ce85
SHA512 d98f9dc6aca0c55bbf946d1858bd806d67c1a19766fe699c76e85122c68f46bd0d017b0da8969bd0b902044a3e724b7554374d0fc9ad6c42326e7e15d58816b6
SSDEEP 192:uu9WsNGLQuJpqmnbQmiU18qYzstk03bb9zUNEjdLIYqCQyJZIK1Fq:nwsNGL9nPNLYzMkqbFUi+i4n
TLSH
T1924239712878AC365DEBA506B44737935FB860BBCEC55F84D9E99B2C01CB398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 55bf1a13dcb1ea5213598bc5a57d53860c76042bf0c64df379c9d7298d5fae2e
MD5 915c1ceccb8ce318b077aa23a4dc1769
SHA1 6af39a1b16cf0a1b289f1649b0ee9bd54a3956ae
SHA512 f2db7689ce9c6ec74e0acd4ba61530e4d44ec93bec4a22a6e4190a8643b0dcce70d4077c9272a6c5a942fc02279c3cdf23c2f3ac836e31443890a9075d8d9fd7
SSDEEP 192:uu9WsNGLQuJpqmnHQmiU1BqYFUk03bb9zUNEjdLIYqCQyJZIK1Fq:nwsNGL9nPp+YqkqbFUi+i4n
TLSH
T1E34239712838AC375DEBA506B44737935FB860BBCEC51F84D9E99B2C01CB398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bf64f2b3a5d7d4e7c95fbd28da0b26b1fcbf63c1326c204db0a0b11ec210f1c4
MD5 728a7d2cf54947acbf214347f9a687f3
SHA1 f5541c82150fa6d11d92d14b3337a91f66f506e1
SHA512 978202bcf749ef51c136f500453d13a79182df62acfbae966967d8582d46a4d7a8b4ff437c5a2c637eba640102ec8ff982738b0246e0b67d023110ffe5075678
SSDEEP 192:uu96sNGLQuJpqmnrBQmiU15qYjuk03bb9zUNEjdLIYqCQyJZIK1Fq:nwsNGL9nPbyY6kqbFUi+i4n
TLSH
T1884239712878AC365DEBA506F44737935FB860BBCEC51F84E9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3fa1b853840a8e629fd307463caa1604f18c13ab52afe7439653489e401db884
MD5 562f0ab77c8aeec36fe11f7882c2d6ed
SHA1 2079c2e0f9cfd8174220cbd9f3f0f088ffa9f9c7
SHA512 74090f5cbac6fa641e4722369516538cef3c04bd9e89fcf5b1015f56b45bbe3b6fe1c97a40c54b14cb0414f3fd54af40b2e38c178df30cf816e47d89c5652cad
SSDEEP 192:uu9tsNGLQuJpqmnrLFQmiU10qYCLk03bb9zUNEjdLIYqCQyJZIK1Fq:nfsNGL9nPnjPY0kqbFUi+i4n
TLSH
T1B24239712878AC365DEBA506B44737935FB860BBCEC51F84D9E99B2C01C7398270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fb7e08e9741ef1552f313eb13c408f676083e1cb31d62c134211cb4462d20c2d
MD5 5d8420d6d2c81a670c233a177ab5e259
SHA1 8a29286bfac7543af7c3163a6c10689418cc3290
SHA512 c7ea6dbe611e63a6b2be79e049a75e1cc3b5b71b150f613e72630cdd065d05c4262ac717138fc1ccb5806701acdabc18670fdc411ecc4aec9415602a0eaff485
SSDEEP 192:uu9tsNGLQuJpqmnrqQmiU1TqYRYk03bb9zUNEjdLIYqCQyJZIK1Fq:nfsNGL9nPKUYWkqbFUi+i4n
TLSH
T1F34239712878AC375DEBA506B44737935FB850BBCEC55F84D9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0228c34c85eb375973a67d546684d38b8d1c50b726bed87492ff274ab56eadbe
MD5 7918a8ff8079dad6a4b53adb8f3e38c2
SHA1 8103d63ce7ae2dc33ef80eb3d08016573a544480
SHA512 d8925f6cb97dbc56c3a99938e6ae6bad0a8aa753e2a38948db8bd3fd2eb5826f2f27074a3fd04927358365aa61b141597c1852530e09cd1ce4225bd6bf4c0c98
SSDEEP 192:uu9WsNGLQuJpqmnrwQmiU12qYWXk03bb9zUNEjdLIYqCQyJZIK1Fq:ngsNGL9nPEVYYkqbFUi+i4n
TLSH
T15B4239712878AC365DEBA506F44737935FB860BBCEC51F84D9E99B2C01C73982B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e63be4e567d6900a78364b1df1a1920b610f5afeb0abebc0c7265561ed3ab64c
MD5 a1a74ee7e6009dc600aacc51b6fa7130
SHA1 c984dded7be70d15aa77e997743c026749d5bc13
SHA512 b8877977c1073e80b79fa366977c58cdf0833bc0b3e4c6d2af69401ffde00e5d6ee1a942048f36972f05bff8d58a89e60f933887b3f18db414f7c39400604c49
SSDEEP 192:uuxWsNG+QuJpqmnE3QmiU1pqY5gk03bb9zUNEjdLIYqCQyJZIK1Fq:nksNG+9nPEZmYikqbFUi+i4n
TLSH
T1565239702838AC375DEBA506B54737935FB850BBCEC51F84D9E99B2C01C73982B0B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4cc2bbeb75e30d546d21b7ed972b66f9a61f0182c82d3c656d32ae1a2a6928bd
MD5 f93b65a8f62866ce53cf786d219a9631
SHA1 09a00419d2ad5fc0cda643bcad07c053a325a2b8
SHA512 6b1682c55cdda037293d63b851e6503dcf64bfac6ed1be68f4284b83a58dbabab53ff6065788b1a6a6c46a075d90a60c17efce4bd1b531a0f904018241c346c7
SSDEEP 192:uuxIsNG+QuJpqmnE3QmiU1iqYKzk03bb9zUNEjdLIYqCQyJZIK1Fq:nusNG+9nPEZpYokqbFUi+i4n
TLSH
T1935239702838AC365DEBA506B54737935FB860BBCEC55F84D9E99B2C01C739C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1a6637ebff21bbb07ca366c54d94ed22cc5ceef09055211717893b3339dd7dd8
MD5 bd64b1a5a2c79d0458c682ee1d28a5ac
SHA1 5d82652ebdf5ec9489ffe4ea33088b6e09494af5
SHA512 0e1f6ff8c3d00c192001497a6b209f8232630cc7759e7e35be285eba5a5afbfa6250930cb87e3661be0ca7cb48bf57b2c3a72a5bb71a7f6e324c52fcc84cddd7
SSDEEP 192:uuxZsNG+QuJpqmnTQmiU1PqYO/k03bb9zUNEjdLIYqCQyJZIK1Fq:nnsNG+9nPFMYYkqbFUi+i4n
TLSH
T138523A702838AC375DEBA506B54737535FB850BBCEC51F84D9E99B2C01C7398270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 20defd158f2bc47d8c4d8699af637496dc6eeb27b3ae01f434a7b1281ecf3f28
MD5 36d67f88daf160ef7c8c5f58d747889c
SHA1 2a12793623fa3494150e6b62dc9aad3975fa29c3
SHA512 7569d75bb7ae569b13605f0d2462d07bb71e63d3ad173f06d953417e0125a3619217e450e0c36946afcd6c0bda4d4f4f3ea316d4f653e5bdab3d7df161bcbf42
SSDEEP 192:uuxZsNG+QuJpqmnZqQmiU1QqYtsk03bb9zUNEjdLIYqCQyJZIK1Fq:nnsNG+9nP8nY+kqbFUi+i4n
TLSH
T19A523A702838AC375DEBA506B54737935FB850BBCEC55F84D9E99B1C01C7398270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 75d063f0edf10141fc8f3b9d8dac84585ffa79e13e4469e6b21005815b5dbe5d
MD5 b62db43d02644cf05dfc9e6351414034
SHA1 ed26bcfae31e6edc57c45f568d25d09443667124
SHA512 d64ff5a6ca7ef00068e42d4a41405178ce4828ea4fd1118204d4015942acfc3cd0f89e3fa7535dceae521c807656ac693070512461010cbff754a91ed2e8bc35
SSDEEP 192:uux2sNG+QuJpqmnZqQmiU1rqYqjk03bb9zUNEjdLIYqCQyJZIK1Fq:nosNG+9nP8AYwkqbFUi+i4n
TLSH
T1CA523A702838AC375DEBA506B54737935FB850BBCEC51F84D9E99B1C01C7398270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 68b9c8817e0d73cc761bc5d71b777895eb97a451a954798b7f3cf97408f49478
MD5 947a8de98613621d9a444466510bbff5
SHA1 9dca3af9f9e23560fadbd46f65a0520a084b7277
SHA512 5bb64e6f901918ce1d10f831a153c6d4c2195a48181ef4b574473caa4921fc642d51d4782e9cb452a61b4db2c529b9b545838eb63260b1cc9e67f6a0968001e1
SSDEEP 192:uux2sNG+QuJpqmneQmiU1yqhZQk03bb9zUNEjdLIYqCQyJZIK1Fq:nosNG+9nPaJhWkqbFUi+i4n
TLSH
T16A5229702878AC366DEBA506B54636535FB860BBCEC51F84D9E99B2C01C7398270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f13372fa42da9597a43224a27797ab304ca9882d60f21367293d16a44aa6dc49
MD5 210e809bf94c02eb90acb43b77846602
SHA1 fbc1a698c4667d0767f87f2bda3a883af2dce614
SHA512 ec0b24e5b0b863ebffe526ee5b92cde06570915a79ce0c53ad28403fb625a1aba967d712cd886fd5aea82bf99fa6e34638fdb972d70d9aa2ae8d5fe586acc8a3
SSDEEP 192:z9QsNG3QuJpqmn5QmiU1UqY9tk03bb9zUNEjecIYqCQyJZIK1Fq:zOsNG39nPX7YzkqbFUiSi4n
TLSH
T1264229702878AC375DEBA506F54737535FB850BBCE855F84D9E99B2C01C72982B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8a3a2c701a16f761aa4f8260e01f88af055bfe4ca8631934c89575a60a8d1bd3
MD5 7d97784e07d75cba2303bbdfe788f0e9
SHA1 38d7d317f2ecef8ca7beb4f30efbc3b626aa3df0
SHA512 3c2a4d4f39a03316cffc8f5367034e6f7803534a9310979aa0e4a455dfc2f7650893621c564db131e49e44957e975f33062760b2a733010343090f944f1c9313
SSDEEP 192:z9AsNG3QuJpqmnnQmiU1/qYVkk03bb9zUNEjdLIYqCQyJZIK1Fq:zSsNG39nPJAYekqbFUi+i4n
TLSH
T16D4239702878AC376DEBA506F54737535FB850BBCEC55F84D9E99B2C01C72982B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8d116155ce92393d82bd216f01053ed02e16ba979409b7b299bd1cfe509673e4
MD5 9a70f7e82edea9ab3100609017326e8b
SHA1 d226bb47292b43fa93d5d801fd34fdcb81e8c729
SHA512 6719a85617804941126a76abb792babdf961a6d49744b179430955040aad30e750f2e21a69b8ed21638d911b121477108f0ddfa4d9534cbac8a8d30f8c7397dc
SSDEEP 192:uu9qsNGLQuJpqmnkQmiU1aqYX6k03bb9zUNEjdLIYqCQyJZIK1Fq:ngsNGL9nP0VYKkqbFUi+i4n
TLSH
T1B44239712878AC376DEBA506B54737935FB860BBCEC51F84D9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2f1c92ff982d7ac43b4509aa04de88b31d4a480c0f5078f011e47cc7dd59f34d
MD5 4e327e4867ab6f9e312cbd92eff260f2
SHA1 850ce7fd9c480af48b298d3678890ee02de4f016
SHA512 2c3dbfc16eaac9ac18edadaa1a901b43b105c0266337b7191f347a94258cace28a8518d38b059d32f8990a6104b868e5eaf0c941f236395f13e6e9c8b8239c10
SSDEEP 192:zPsNGzQuJpqmnWdQmiU1hqYogk03bb9zUNEjecIYqCQyJZIK1Ft:zPsNGz9nPWbmYPkqbFUiSi4Q
TLSH
T11F423A702879AC379DE7A546F54737934FB860BBCD856F84D9E99B1C01C73882B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b9517cbc1f8539a5ba3fc24ec59075cac8aabf875279183f34ff9f2ddda68d62
MD5 6e96df5c46daf805093c862d35d2303f
SHA1 e37f7557972e6ad00e46f43661d0f6ee885575b2
SHA512 92c246eda6831c33e30851848973e2b1505a4ed52a4caae2f11f08ec58ef6501a5f2a288606945a8453920711fb5ac44003027f00ddeb1fd147116de4c903f41
SSDEEP 192:uu9EsNGLQuJpqmnrqQmiU1yqYTek03bb9zUNEjdLIYqCQyJZIK1Fq:nesNGL9nPK9YSkqbFUi+i4n
TLSH
T14A4229712878AC375DEBA506F44736935FB860BBCEC51F84D9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7fb5845106057e2d85857d4f35a162063febb078fe1b2ed75a18af7f0b1e8acb
MD5 0e83a35bcc08f3defdef7ec29aa56f59
SHA1 9ca52b5f144af16a6aa1d67b0919e24247ef15cf
SHA512 cc7bbfc292a9f068121e5e9fb2c9cbbdcc76205123e76c6303d7a13e038e094957dcc56067224fdb3b633aac371437e048e2c6900aad3b4070fb412a5e5c32a7
SSDEEP 192:uu9WsNGLQuJpqmnE3QmiU1DqYHqk03bb9zUNEjdLIYqCQyJZIK1Fq:ngsNGL9nPEZYYKkqbFUi+i4n
TLSH
T1E84239712838AC365DEBA506B44737935FB850BBCEC51F84D9E99B2C01C7398270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e0991da308878862170d6eee4048caae8176b0142676fe0577768d629a5ac495
MD5 b2eba9d99ff8564c26572b2cd9a94758
SHA1 e73473a7bfb506d4eb0b9b3f565e2cce138b703f
SHA512 23311d3752d33c87fce08eec51d868ad62fc2f040a10e220ea8643cca2260553f1bc85dc8c72cfb325811c684f9a442a49d0b2aa46e7b11dbef62bd9eef7b4f0
SSDEEP 192:uu9WsNG+QuJpqmnE3QmiU1kqYodk03bb9zUNEjdLIYqCQyJZIK1Fq:ngsNG+9nPEZTYckqbFUi+i4n
TLSH
T1A04229712838AC375DEBA506B44737935FB850BBCEC51F84D9E99B1C01C73982B0B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39f7af6441c1b4c79d5f485f623e77eaf25eb30da74847a7fe7c182fe024e8e1
MD5 c64d57a25ea1644d94668a6561ea5f68
SHA1 050c3b0549391bae4cf99465a113460f80dfa0fa
SHA512 ed758b83e6e1bc3acfbe5ec99bce9a7434701303dc0ecb4c2a8269b7db9579fc81fea386e2badb33fe8f1206adcd4a21a5acda801df19bf2fb2b0869fe927538
SSDEEP 192:3ONH6kHQmiUyM7z903bb9zUNEjRcRYqCQyU6:3ONH6oHz9qbFUiyiU6
TLSH
T156121870647DAC376ED3B505B48737679FA82077DE85AF85D5E4461C04C728C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 09afc41839d2ae2cfeeec2e3dc233e67b64fe09c85ed2774067b3ca010c8a437
MD5 0827354fa74307bf1c0211b8fb859ac8
SHA1 388c6d1d281f4d9901dd0c6099b8ba9a5d0c8098
SHA512 d1aab0db6f9dd04910f0b9f8c32c7172c20eb51db18092dbfbb06499d605c528edc8d344340e05a6bd75fdd4f617e84b3e8550a8458e3405d95dbef336a18f57
SSDEEP 192:uu9EsNGLQuJpqmnryQmiU1BqYkRk03bb9zUNEjdLIYqCQyJZIK1Fq:nesNGL9nPCqYEkqbFUi+i4n
TLSH
T1944229712878AC365DEBA506F44736935FB850BBCEC51F84D9E99B2C01C73982B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 03753ff392323e8d1fca5f47c6143836ef9fdbd6722867abd00f25f7a72b670e
MD5 c876af453107dc428e61c36b4d94d171
SHA1 6b747cb3d3efbef449077db65a89bdf4068f5c01
SHA512 d6bd7f1ec61c0eca66f4f17127cbf6acab5569ca04b13a6c5bede2079d75cb4861ad1cbf0a9176999baafd4cb4a6f7a3ffdfa75bb3ae0ae6d342367e83be98ad
SSDEEP 192:zPONG6kmnAQmiU12qYP8Uk03bb9zUNEjRcIYqCQyU9:zPONG6ZAhYPHkqbFUiriU9
TLSH
T14E2219706879AC379DE3B545F48737939FA81077DE856F85D9E54A2C00C73882B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7dfce338d0f9cd7220f6838619de6b06ffd1db90a5a055f6ac75e4655edbbfea
MD5 b2d6c6f29d48b4230be4b16ae1d1dd2d
SHA1 961ec838efbb8c77c863c269d5bf613ca955c3e4
SHA512 bd069a0bf26b7abf583cb417e457d1c5dd4f4379a252cb0197b239b79eec2e436ed0d13752cd4c2f36d29423ad4cfded9fb275414b2f8afe2042be2579392bd5
SSDEEP 192:uu9osNGLQuJpqmnrNQmiU19qY4tk03bb9zUNEjdLIYqCQyJZIK1Fq:nKsNGL9nPviY0kqbFUi+i4n
TLSH
T193423A712878AC365DEBA506F44737935FB850BBCEC55F84D9E99B1C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8964ae692fe48e3624b9336564bab25a9eea520b99760a11263438ca2dd519e0
MD5 3e49abfde4a899d463c7a2528bfb7366
SHA1 814c475ebf43f5c140b56847f444c30e84d54eeb
SHA512 9c3318f43fdf8003f905a94e20b44f27810565d8217551079dca854aa0d0ec367453a111046dbe04dcd88701db378f177300f11ecf5c95a72eb7b8f2b92e70ca
SSDEEP 192:uu9WsNGLQuJpqmnUQmiU1mqYjuk03bb9zUNEjdLIYqCQyJZIK1Fq:nAsNGL9nPkxYKkqbFUi+i4n
TLSH
T1324239712878AC366DEBA506B54737935FB860BBCEC51F84D9E99B2C01C7398270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e4f300fac24a70007274bf70cafe9d60803310a99bbbf234859bb4dd7b60fed0
MD5 90cb4f4fa0acd92fcdb9e07acab91085
SHA1 4ab8cf4bf5f5e093a4037e6ac13c3b5d4ead97da
SHA512 8414665dd6345bcb07b0c5478af52585bcb1bfda301a9d74e278d8bce50145aea1fd21a442f8c247de7c90c496442508e2e2f39297da8709d74157042b726a81
SSDEEP 192:uu9LsNGLQuJpqmnrBQmiU1nqYmnk03bb9zUNEjdLIYqCQyJZIK1Fq:nZsNGL9nPbEY0kqbFUi+i4n
TLSH
T1F64239712878AC365DEBA506F44737935FB860BBCEC51F84D9E99B2C01C7398270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 998beef0cb82fdd84eabcff4abdd21048ab38e407ffa847c44213601ea1a9810
MD5 9ca56cba73f7a59c571ea8ce0a56fa84
SHA1 e1c46d83296aae151eae6fbac5429696ba0bf741
SHA512 93852efd71463842eb7678a4ee656c9fff8c3ecb5103f19cdfb3d096c99e20b7cc650655a7186d40b8af09898c887a2bcc4638fa74c5b07d4666fcc64c222fff
SSDEEP 192:zPsNGVQuJpqmnmQmiU1tqYT/k03bb9zUNEjRcIYqCQyU8:zPsNGV9nPCWYzkqbFUiriU8
TLSH
T1AA3218716878AC375DE3A505F48737939FA8207BDE856F84E9E9562C00C729C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 29fb387a93666a5dee040b6bafae156cb5cea99e6fb998a447f0e0294904ccc9
MD5 1b2a3f858723b4b2182621346618b6aa
SHA1 8404116ae7348377dc8ec68b971e3b49fadc393a
SHA512 7de70166d08fb1b6560914830cbecd9536e0f58b5b6abab9a5ec6f14f9d8142f665aa82aaf06d3066851e8f2fab81bc8bd142e29b4c1688cb19a18f44fc28853
SSDEEP 192:zPONG6kmnAQmiU1DqYBZk03bb9zUNEjRcIYqCQyU9:zPONG6ZAkYfkqbFUiriU9
TLSH
T1082219706879AC379DE3B545F48737939FA81077DE856F85D9E54A2C00C73882B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

317c21f9-1bc5-46e2-b3e7-f6c89cb73d85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\317c21f9-1bc5-46e2-b3e7-f6c89cb73d85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33ca1ba04974140b5969c55e5f9a0f6c392494dd269cb71c36eb2779cdf6aac6
MD5 0f52caaf931b1a3abadd2a2f9bacd357
SHA1 a594e1e9fd8f63a834b7dd8f3015e926d2c60def
SHA512 594663bd883b71477d9e19947e11eadc1300d49df7ed43587380ab67823cfdf5c77900d9a0f5e013f3933b1c4dcc526081e31b46eca57d730a224fa72c50f97d
TLSH
T1F241098DA6E91048B3736E5AAFF2646E44BBB9771F46D45D00110E4F0622B41C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24442\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zl1efzct.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k5rddgaf\zl1efzct.exe
Size 5.4MB
SHA256 bf34bee1b75a7724125904ed77f0b3b0b725eee30bf45aa71c0cf43befaeb4b6
MD5 c6a8ebebf9dbdfa7d2bceedd4f4a025f
SHA1 33a2edbc63286149dc57680c5d045c4be04b3b0c
SHA512 f2763fbad3562d1ab6a5ae2c07b96b5d1c155efa9dd5704f2881b0e6e8de44938ed40ba191e305f00832220b3eec2ac6723bde104e07b19ff424eccab180ecb5
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrM:k7ICteErownP0oTcMsABqlkgczo
TLSH
T143463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5008-920-0x0000022F1CD70000-0x0000022F1CE1D000-memory.dmp

Download

memory/5708-880-0x000002177BF90000-0x000002177C0A4000-memory.dmp

Download

memory/5776-760-0x000001D0FFDC0000-0x000001D0FFE6D000-memory.dmp

Download

memory/5776-759-0x000001D0FF9B0000-0x000001D0FFCFD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads