370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3

Analysis

max time kernel
4s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
Size 5.4MB
Sample260818-dset9swtes
SHA256 370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3
MD5 71bba235980e730352e0d9b9b3059e3c
SHA1 087b22336d832432ca8c83c5ca1e21ee7750be71
SHA512 47f005e91c1f888aa92c1e96a55c4ebb4f8681261c3f4aa03c998a47b316f3b52afce257d9f02634b98895e9dfbb522d897490e3f6a0ab06c56d0444a9349123
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMTH:9XhICteErownP0oTcMsABqlDQk4
TLSH
T13C463308B3A80DE1FAB3D13981665221D573B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19ppz4.exe	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19ppz4.exe	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe

Loads dropped DLL 11 IoCs

pid	Process
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\7wjj49lx\\drlkijkd.exe"	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
139	ifconfig.me
380	ifconfig.me
549	ifconfig.me
562	ifconfig.me
742	ifconfig.me
1043	ifconfig.me
1359	ifconfig.me
1882	ifconfig.me
337	ifconfig.me
986	ifconfig.me
227	ifconfig.me
262	ifconfig.me
294	ifconfig.me
408	ifconfig.me
760	ifconfig.me
2156	ifconfig.me
81	ifconfig.me
244	ifconfig.me
257	ifconfig.me
1080	ifconfig.me
1908	ifconfig.me
775	ifconfig.me
132	ifconfig.me
216	ifconfig.me
445	ifconfig.me
458	ifconfig.me
493	ifconfig.me
1069	ifconfig.me
1527	ifconfig.me
855	ifconfig.me
44	ifconfig.me
191	ifconfig.me
226	ifconfig.me
295	ifconfig.me
503	ifconfig.me
596	ifconfig.me
1848	ifconfig.me
392	ifconfig.me
407	ifconfig.me
556	ifconfig.me
901	ifconfig.me
2158	ifconfig.me
2386	ifconfig.me
1939	ifconfig.me
2142	ifconfig.me
2222	ifconfig.me
2338	ifconfig.me
2382	ifconfig.me
187	ifconfig.me
335	ifconfig.me
2031	ifconfig.me
355	ifconfig.me
103	ifconfig.me
439	ifconfig.me
510	ifconfig.me
281	ifconfig.me
489	ifconfig.me
551	ifconfig.me
813	ifconfig.me
82	ifconfig.me
185	ifconfig.me
293	ifconfig.me
563	ifconfig.me
1842	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5480	cmd.exe
6524	cmd.exe
3384	cmd.exe
2340	cmd.exe
6640	cmd.exe
5764	cmd.exe
5668	cmd.exe
5356	cmd.exe
6296	cmd.exe
9456	cmd.exe
4884	cmd.exe
5972	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4972	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1264	2696	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	90
PID 1264 wrote to memory of 4884	1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	91
PID 4884 wrote to memory of 5480	4884	cmd.exe	93
PID 1264 wrote to memory of 4972	1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	94
PID 1264 wrote to memory of 4852	1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	95
PID 4972 wrote to memory of 6104	4972	msedge.exe	96
PID 1264 wrote to memory of 240	1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	97
PID 1264 wrote to memory of 3808	1264	370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe	99
PID 4972 wrote to memory of 4372	4972	msedge.exe	100
PID 4972 wrote to memory of 2520	4972	msedge.exe	101
PID 4972 wrote to memory of 1452	4972	msedge.exe	102
PID 4972 wrote to memory of 2520	4972	msedge.exe	101
PID 4972 wrote to memory of 2520	4972	msedge.exe	101
PID 4972 wrote to memory of 1452	4972	msedge.exe	102
PID 4972 wrote to memory of 4588	4972	msedge.exe	139
PID 4972 wrote to memory of 4588	4972	msedge.exe	139
PID 4972 wrote to memory of 4588	4972	msedge.exe	139
PID 4972 wrote to memory of 4892	4972	msedge.exe	105
PID 4972 wrote to memory of 4892	4972	msedge.exe	105
PID 4972 wrote to memory of 4892	4972	msedge.exe	105
PID 4972 wrote to memory of 1904	4972	msedge.exe	106
PID 4972 wrote to memory of 1904	4972	msedge.exe	106
PID 4972 wrote to memory of 1904	4972	msedge.exe	106

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4588	attrib.exe
6616	attrib.exe
6388	attrib.exe
5660	attrib.exe
4648	attrib.exe
2484	attrib.exe
5480	attrib.exe
4576	attrib.exe
256	attrib.exe
1348	attrib.exe
6212	attrib.exe
6824	attrib.exe

C:\Users\Admin\AppData\Local\Temp\370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
"C:\Users\Admin\AppData\Local\Temp\370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe
  "C:\Users\Admin\AppData\Local\Temp\370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe"
      4⤵
      Views/modifies file attributes
      PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffe4d76c188,0x7ffe4d76c194,0x7ffe4d76c1a0
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,5833685692836344136,2742997010624881023,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
      4⤵
      System Time Discovery
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,10815408328474077603,5421772516515289069,262144 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,3850875454950719736,12091594451627698768,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,2332233331200744862,14758808354451762810,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,3302994347132892288,16917153223025894084,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3876,i,12623818006242877953,416323383789890741,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:9
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3836,i,6747258587878347841,11910921445218248945,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4072,i,125249458898111096,10761121444730949313,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4588,i,6643212638343520428,13764923942650776068,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4884,i,5519926679205574182,5955685800650666772,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,7600166763356675056,14120917283251662017,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17934729880390157867,267893097727163454,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6136,i,10954154807747543313,10113133931266997717,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6276,i,6065675041323362812,9827078536102584125,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3557172739758177182,3156172484485495887,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6369937288172519944,4524867937749549107,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6572,i,2058276705561051548,981691780613632544,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,15200191318570156293,8316330449512763669,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,15200191318570156293,8316330449512763669,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7472,i,12287540604825603552,17512550417116554954,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7576,i,11102520997415767510,18206081265920152314,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
      4⤵
      PID:6756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7544,i,5377168682430037249,17363927883242823089,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7744,i,6778979824934050078,16644272786569714442,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7668,i,8000599476778477127,8008176872117009781,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:1
      4⤵
      PID:6776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7400,i,10817881484255934061,13402120442058530322,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
      4⤵
      PID:6808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7800,i,11724452802730018066,17959743606113673649,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7600,i,15477939614095216503,13710164383460802439,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:6768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7788,i,18190710495555325119,5362464433539593656,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7820,i,7105617237974113641,10930506781564169807,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7844,i,10032015802265507330,14711009974429480986,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7956,i,11399923632294321214,5712851392999746928,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:14
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7876,i,6770506386397394082,8798713066461572228,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7724,i,11551230054106741369,8721243647473101169,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8152,i,17220227825474341768,10001440614359057463,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8220,i,3487281067058751367,6802388784884954999,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8232,i,11244080804288757066,14834741120870904824,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8272,i,16431100189492307304,5610635058290542534,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7904,i,3324681397621804635,3152283152358311107,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8328,i,7123138133083563563,16179942213536593236,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7936,i,2531143039523493111,17913960328277893182,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8412,i,8875729322805193357,15764435207786528598,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8344,i,14055394896665075441,7562045361715980606,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4772,i,15720075454891667781,13969920977608991800,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:1
      4⤵
      PID:7092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8308,i,17381645445810953067,16484062204823458418,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9236 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6068,i,3956365855463503186,9926784152406976159,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6084,i,4626155344143678342,8555707406855038018,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9380 /prefetch:1
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5968,i,4891122339479272024,1200883410448257565,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
      4⤵
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8324,i,17791098188177800484,817684693733217738,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4832,i,6633664816300917189,13576070881619934814,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
      4⤵
      PID:7072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4748,i,17383018641186854579,9340598625799579518,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9312 /prefetch:1
      4⤵
      PID:7076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4816,i,3495468594168099030,1712091628909197002,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:1
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4836,i,6160207195093465586,762654271505819272,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=4956,i,12813462901381218985,17138047021872117644,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10300 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8472,i,18163358560206648673,7006015209769345193,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8424,i,8114669290134347735,3160661616918987384,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=3832,i,1890914537172065866,9123953964881781274,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10292 /prefetch:1
      4⤵
      PID:6620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4796,i,13246527503635627860,499498215729059413,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8540,i,1153857642799936656,1126924500772125084,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8584,i,10013782553891123408,3443070322648920974,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8512,i,2073563319695568657,894882328421017293,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10208 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8632,i,2857588029012254350,3149987154404231442,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:1
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8520,i,4405685971509722544,4880079454541986470,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10524 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8688,i,13825774277150579200,8937965529339707285,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10544 /prefetch:1
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8620,i,7531083333707485943,14698740461649926649,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8680,i,6693208392722896883,7767420133380682165,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10672 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8444,i,7688999766600553744,16679584093491670088,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9512,i,7201407736265143933,18130366140550785811,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=11392 /prefetch:1
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9860,i,6999419226334124140,1939412100560811869,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13840 /prefetch:1
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9876,i,13701524704607756875,9611706437076228801,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13844 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9896,i,5712645038810529812,1743233609617293041,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13848 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9884,i,18377108116852671470,2545399094364638086,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13832 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9940,i,6795822949226641834,365242620524318102,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13880 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9952,i,1256716298245987703,4089918842959485119,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13916 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10004,i,13007722630375457905,17992648176187030445,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13920 /prefetch:1
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10028,i,221618132815546446,14597871447802628640,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14088 /prefetch:1
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10056,i,16872384884430598920,819170666041849214,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14092 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4092,i,112303428278481230,9128242581161141635,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14048 /prefetch:1
      4⤵
      PID:7236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4184,i,17543122697429121500,208638835103205003,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13940 /prefetch:1
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=7452,i,14915835476043300300,4732755026453583657,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=13976 /prefetch:1
      4⤵
      PID:7252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=7764,i,15845292957389927621,9636691152480975926,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14036 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10156,i,10307232976397333767,9144034795286804825,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14044 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=7552,i,6154210303219803404,7421466002369790363,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14324 /prefetch:1
      4⤵
      PID:7276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10188,i,1635914503852020615,11757718925562879893,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14328 /prefetch:1
      4⤵
      PID:7284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10220,i,10757678102372797368,11783420582203093699,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14368 /prefetch:1
      4⤵
      PID:7292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10348,i,13501104121657653377,15371113798688685978,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14372 /prefetch:1
      4⤵
      PID:7300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10368,i,1928100187437773621,7987973114720958349,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14492 /prefetch:1
      4⤵
      PID:7316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=4228,i,3886626365030807503,8094232739699116002,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14376 /prefetch:1
      4⤵
      PID:7308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10248,i,5684930784333115793,13776631978466068430,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14576 /prefetch:1
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10352,i,9522108675230455752,93880274728623166,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14568 /prefetch:1
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10324,i,9195840328535727538,3391635776582541067,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14496 /prefetch:1
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10272,i,16102197822951801408,7333781301163444498,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14564 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10456,i,8974628097752699497,6333409472442399792,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14448 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10440,i,11135589943796810987,10440623321648083673,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14544 /prefetch:1
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,3605484110203467486,3384299125498775945,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=19068 /prefetch:14
      4⤵
      PID:8160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,10009406525269274874,2395904034413089136,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=19108 /prefetch:14
      4⤵
      PID:8168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,3634123940420985271,3549005875034798902,524288 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=19056 /prefetch:14
      4⤵
      PID:8176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=14252,i,3783637948652271723,17147461486379752091,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
      4⤵
      PID:8208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11112,i,3022574110427310243,3276728440487696513,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
      4⤵
      PID:7716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=18980,i,9332766519567144524,16446390221180177026,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=14292 /prefetch:1
      4⤵
      PID:7528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=18460,i,10388858532139931234,3000033814896762638,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=18912 /prefetch:1
      4⤵
      PID:8308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=19236,i,17491278150636286741,1942023686366154586,2097152 --field-trial-handle=2196,i,10583541165685237729,7574583606934142924,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
      4⤵
      PID:9332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe
1⤵
PID:5332
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe
  2⤵
  PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5972
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe"
      4⤵
      Views/modifies file attributes
      PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe
1⤵
PID:1044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rdjfv6im\mnbh79vn.exe
  2⤵
  PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5480
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe"
      4⤵
      Views/modifies file attributes
      PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5764

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe
1⤵
PID:2852
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4knprdo6\sbwljeyb.exe
  2⤵
  PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe"
      4⤵
      Views/modifies file attributes
      PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4416

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe
1⤵
PID:1412
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\609n3rij\54097xaj.exe
  2⤵
  PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5668
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe"
      4⤵
      Views/modifies file attributes
      PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6352

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe
1⤵
PID:6420
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3dgng96\qih5dzb3.exe
  2⤵
  PID:6492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe"
      4⤵
      Views/modifies file attributes
      PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6852

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe
1⤵
PID:7044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2hnmlx6u\s026xptb.exe
  2⤵
  PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5356
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe"
      4⤵
      Views/modifies file attributes
      PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6640

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe
1⤵
PID:7164
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pc2vn8m\0xykb1nu.exe
  2⤵
  PID:6248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6296
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe"
      4⤵
      Views/modifies file attributes
      PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6324

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe
1⤵
PID:6440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pmwit62h\jew48qb1.exe
  2⤵
  PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3384
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe"
      4⤵
      Views/modifies file attributes
      PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe
1⤵
PID:6460
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jdzj3nw2\d35bh1bz.exe
  2⤵
  PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe"
      4⤵
      Views/modifies file attributes
      PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6324

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe
1⤵
PID:6236
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tla0ihmn\rqu2aifl.exe
  2⤵
  PID:6648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6640
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe"
      4⤵
      Views/modifies file attributes
      PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9404

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe
1⤵
PID:9720
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\puy2si7u\x60m8y7c.exe
  2⤵
  PID:9832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5o3obqj5\1swq039a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5o3obqj5\1swq039a.exe"
      4⤵
      Views/modifies file attributes
      PID:6824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 766KB
SHA256 daece585b8b6bf59c84b3e3917643415368e8a0709f1ac44b2d48217cbdc0988
MD5 c09f93219fd384771b04e9de54905b24
SHA1 c0369f2aeac893bb34438de157056e8288e06bb0
SHA512 065006e91a4e9399ec4243899bbb593ed734c3ec589d5ac7099b5c4214f0e3ae7dbc05ee674d8a5e69646be4bd5b1deba1b15b6575ebf6e5e7b1d4d840baa62b
SSDEEP 12288:f9sPj59yoLADkjDMTKzp/fb8Lr6YCcRrZ4aITn8QGf702EXW7L4LqMuXmRZo2Y+N:f9mqoLAyMezR4P6Yjlc6f702EXW7ULgy
TLSH
T1BDF42354ED22C370C8092D914AD63A1536527A8AF20AFBD67D49FCE733916B3BE7D084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f39bcc4f-649b-4251-95c0-f428b4a41058.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f39bcc4f-649b-4251-95c0-f428b4a41058.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b70badaddab9157d2cb49c0c4abb2799d5a71d556f1e0b388bd9cfd16d4f90f
MD5 eecbebb8692ab8ac4c30deaeff58d42a
SHA1 40e6b17f86c43798526a4b3497fdd8677926d45e
SHA512 ede590362223d32423eba9141dadb1be286b2736d4f992cc7df0cde60482fa0d0859ad3be79fc58b30b962ca3f7d366b5830ea97d49dba88c87ef3c5ffec0280
SSDEEP 192:sxRmRICY/f0s8xEprQ5RzoA8pK1hpFwHg6+WNsVx9G2fYBB4UJhcGHIgVPmJ:sxRm1Y/f0s8e5sO541fRWv9y
TLSH
T11B42C8166938AD3B4CD7E219FB15BF53D3F91122B1D06E48AAFC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a7e79524c95f0e7730c0c283c4e9f2a34724797b633a6b74cfa5906783510138
MD5 5d767069dd51248302e4408c310a3b83
SHA1 834f6363896925edcb432e398b6ad8e4931bd781
SHA512 9fb2fe49849fe9241cf6c7100dfa7726ae91cfaaa0c50d1091f284ab2162b98a891d9439690fbcac7a5582d612f1e96f0367be4f6cd9c7fce10d17da78b34d09
SSDEEP 192:sxRPRICY/f0sJxcprQ5EzoA8pKga91FwHg6+WNsVxlZOzPkBpG/YBBBExMcGHIgb:sxRP1Y/f0sJimYO54Gwm/c/voy
TLSH
T1D752D95669386D3B4CDBE219FA15BF53E3F51122B1D06F44BAFC8A1C04E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a580f2ddeb81dc85fd4c87776631c68767e737660a0f1b134d295895164b4c78
MD5 c6e8d7e835ae0aad4560fa4ba2f4ad9c
SHA1 dcd839f3630af7304225339394874eee81c8ecb6
SHA512 27029a509787772aadf5779d8be5795153ba84986da906b7f65639eeab3ca175083420d19905056d518a01315039f8cfb3fa605fdf0e2e0e9cbd49aef1dbc0e5
SSDEEP 192:sxR5RICY/f0sJxEprQ5rzoA8pKxOpFwHg6+WNsVxlYHdG2npG/YBBeUJMcGHIgD3:sxR51Y/f0sJeD1O54+Vs/D5voy
TLSH
T17652D9166938AD3B4CDBE219FB15BF53E3F51122B1D06E44AAFCCA1C04E66DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4e7f903949627fa19d472963749073cbac3cb8c7d1f1c90696138bfdef8a5a46
MD5 d594059510ec690a0923b04dbe97d468
SHA1 85cf41e33824608f2644521f1ab287e416028ae7
SHA512 7b49e095ced9765f41845102a80ef74ccc5839401c0613ac77718a2578e57d5a611d836b04845e768001702b35cf7d5aa8829ce5373a5619f377b04c7c3f1fb6
SSDEEP 768:wb8dHg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyu46JrohGq5uu:wb8dHsE7r6Wgouf6Mu1jaFV6iNv
TLSH
T1BEC2DA7B740CCB7E4F800ADDAC19BE9F6DA802CB9AD8CD4447FE951C02C6BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b5f212c4a8af68922f3ff68cf11ea2b52de4cd49c14cc5b46850c04d3d592318
MD5 042518f31827d0404fce3fec9025da11
SHA1 1fd1c61727899820653658353419d6514831e9c6
SHA512 35714cde33a33abd77043f7e6888eb277fc9d3d4a2e2de5c382aa1528bc804cb13ff4e347a2191dee7046a57999945c4afebc13645cb3d08c411be74e566f862
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkveTnCr3di:CoZs4q26neDsgU1gC/wgziItHU1gkeC1
TLSH
T12F913340747702843C7EB55DC5B8896AD6C27863317C78AB7BE845924F67E024EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2d2189b0e003f8d646a94df4be9ccdf43886c759d93043a15762bcd6989ee60d
MD5 e26e69f227b5fe283e28e05df377c45e
SHA1 f71c59fc02ca790d419301568ac31b0b312bcbb4
SHA512 4b2b9f7ef6b800bca2a235c61ff4300ebb42bca92e38ace0da96c5b11792969a0fa7313ea80e2d1e5355e08fbe7b38613bf486e06f31c9588fc8fcc269a57a0e
SSDEEP 768:6rv+4UNbds3vkDZIO0ZaNzc4ReyIsXoeVH1S5D:6bsbS3Qtc44bs4EH1Y
TLSH
T14F03CF32E8788937ACE66785B14B76537EF8912782D81BD0C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 694ac4a7c783be66101bb00c6e30c3e7df8c5941d806d57bedcccf55e5a28304
MD5 caf6613f381b7c43c121b1f493ac96db
SHA1 c1d0839ab47cfc5aa5da68cdc318468f781f747b
SHA512 1ed284175e3a3fdd3c5f6ad148628d3c31331c7dc42bf41ae8fd5b2fbcb6f164e5193297fd843bf7abc960eb3f74f36a00b09323e8543befc6dbb659bd837446
SSDEEP 768:Jrv+4UNbdZ33dxpDZIO0Z/WNzc4ReyIsP1Vcz:JbsbD33dPtc44bsNm
TLSH
T14903BE32F938DD73ACEAA285B10B36937EF4116785C91B94C9D95F4C090719E172F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb478e7bc02a3e51bb08e6b63c6855bd6fdbd4690109e8486270475738df4cdd
MD5 db1b1d68c9ae018a333e0c4bb6bb1990
SHA1 985ded43e9436a6a5fce23ded69e2572124e7ef3
SHA512 e974e0ef28aede71b5742751e30f78a6e2a67dcf470095ffcce1698be6bb151a6b106671bd99f75c56acc6ab6139c2d408b9f68e742353e25f03be3b8c4c97f3
SSDEEP 768:Vrv+4UNbdZ3IdqFDZIO0Z/WNzc4ReyIsP1Vcq:VbsbD3Idutc44bsN/
TLSH
T1F003BE32F9389D73ACEAA285B10B76937EF4116784C41B94D9D95F4C09071EE171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 522519304197a8ffad07e822eed29bd46efab93731d9585f5aaf7e2452606631
MD5 a6af9bad2e8908972fdf553f25b170b8
SHA1 9e11ba37c647affe601058c7013ddd2fb9cb04ee
SHA512 3f053df2ebc86efeae62ce3e762b56947ce9edfafdc0cc30e599343f7596fe3caf5effa1a01278e44a4412202c016f16c7319a173a026cd05e1d1cbc1d8c3d54
SSDEEP 768:23IzhT3IdJNDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23I53IdDtc44bsNxm6VJ
TLSH
T15EF2BE72F8749DA7ECAA7241B61B3293BEF0122784D82E98D9DA5F0C084319E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ae42562896932e973de767926bb82fe7bf345271d0d51c94f1f54715084a8415
MD5 a1b2574166012833fead6ac957a4ebc2
SHA1 e426a36c1e12a763e3e620da709647feb598bb8c
SHA512 c40f846e0a02e2c06348765ddb18cdf05d46f63f9970bb98bf7ca57869329ac5ef38a09fd20b8ba9d009a46a11f30708bc87d26545ffb5d723b14097f5781d84
SSDEEP 768:0w3IzhT3bd6DDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:53I53bdYtc44bsNxm6VJ
TLSH
T1EDF2BE71F8349DA7ECAAB241B61B3293BEF01127C4D82E98D9DA5F0C084329E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 aa68a752f9fc4aefb73221389b86630e91b06eab24025f475a8dfc08a2a3d77c
MD5 d19fe1386eefd84ca590b371791c0c2a
SHA1 253568ebbe26e83803ec432bb61e45962a1292c1
SHA512 3392847017bed5af1ec582a499146706c4718b2e68cb74061ab3ff5d3156c875644af7674e7ee538f383b44aca162dd2fce1b66b609839d938f27276fef45760
SSDEEP 768:Rrv+4UNbds3YXDZIO0Z/hNzc4ReyIs21eVH1S5D:RbsbS3Btc44bsiEH1Y
TLSH
T15703BE32E878CD23ACEA6745B14B72937EF8622B85840F94C9DA5F0C4A071DE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32b5abc31185c820b2437ce8c7c0f20899050aa2451eb1a1b3033186b3016baa
MD5 e78b5969b411feaed568c209e0b7f1af
SHA1 75598d86a129fbb6558b70ec1c88c4f16701476d
SHA512 21739a1430b73d7a558e56c37307b1df868710b52cbf478c013fe8b8703e7db0c2d57b5688fcc5f6613e853397f21da5cf61627e7939e5bcf0c70c9d85008e6e
SSDEEP 768:23Izhd3IdvrDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23I33Idjtc44bsNxm6VJ
TLSH
T189F2BE75F8348DA7ECAAB241B61B3293BEF0112784D82E98D9DA5F0C084319E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 607dd67031a0babd3397694b7c4e64a79d8b8fb77e23177da3ed28f41759bc43
MD5 b7467b3328ea0ddf81041f84b1d99b12
SHA1 bc415460c244e65cf66bdfd0da96457311791d01
SHA512 1ed1037bb30e9fe80f5c098b2da45bb3d8e77260e8da6490cee6eae3c74c4d87fe657816fd3da8045b4e0d561f6bb60710bcbf19fc83a31ad98c3b44f8e9f8f6
SSDEEP 768:23IzhI3IdB/DZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23Ie3IdJtc44bsNxm6VJ
TLSH
T165F2BE72F8748DA7ECAA7241B61B3293BEF01227C4D82E98D9DA5F0C094319E175F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5d825696749bbbf23bb54cea3aa0b94818fa705052d28d816702c06f8d575975
MD5 9e7c2478fd541cf829af3ef05aa90168
SHA1 73733ad5ad836e8b22d007c9f4f9490e011110f4
SHA512 ebfa6cb8ca41439a37dae18c8381fd8089788064eb3e26472dd6c819d790e2fce9d4a9507c196e5cf33cc03bf69c7f5523d3a14a06d4013134c074895c99653a
SSDEEP 768:23Izh23Idj9DZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23IY3IdNtc44bsNxm6VJ
TLSH
T12CF2BE72F8348DA7ECAA7241B61B3293BEF01227C4D82E98D9DA5F0C094319E175F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e6800bd4f3ee4a060d74748b808b143a8bef9ad87fa0b4c281cdd55902d6dcfa
MD5 bb8d7cc6dae8b75aaa3ebdc110f06631
SHA1 6347f823979bafcd2e1707015110eef3c961022e
SHA512 e65826f14cab940b8bcfa85ca1621a7f29204b4789576d77b7ec6ad71cd6b6c57d741f936d4d9e7265c4a01257809054bf966de33115c770a13fbfa392e20ba9
SSDEEP 768:23Izhm3IdpxDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23I83Idvtc44bsNxm6VJ
TLSH
T168F2BE76F8748DA7ECAA7241B61B3293BEF01227C4D82E98D9DA5F0C094319E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6364d59ec215baa8029171b6e9deb2152bd61c495cbff5950b244f624017b1ae
MD5 0539dcdbcd203a41ca5e69ced5d81851
SHA1 b5df6a4255427be7affe22a2e90a44bb95e1831f
SHA512 f96570b897ba1f6ec100a76df50d0692be9b380df5028f52401db16c248eec9eb185e6e4ffc05ef8d64d281469a216fed87a3afb609e39bcfa4262aaff5cd5a7
SSDEEP 768:23Izh83Id8fDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23IK3IdStc44bsNxm6VJ
TLSH
T1D0F2BE76F8348DA7ECAA7241B61B3293BEF01227C4D82E98D9DA5F0C094319E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6d6ef44a38ed3c2af1158a2a20ea30fc9d8553335e2fab61c14061e666741ccf
MD5 1815ed0488c51b3aaf1241a40b90ea79
SHA1 25946aca536a4d81cc34833809f2e52e741fc256
SHA512 bc5b0fc8849330f45d0eb1f7c55c17f698be37941144bdea1ddf0357b8b28955c2da3073f567d4bb0e935ad206e7788939f3d1a61972afe043dcb93b9f294d6a
SSDEEP 768:23IzhC3Idw3DZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23IY3Iditc44bsNxm6VJ
TLSH
T10EF2BE71F8749DA7ECAA7241B61B3293BEF0122784D82E98D9DA5F0C094329E175F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4218a89b243161cc2e638240c1f885fe07f7c12a40bd66f92e47e60f50049fe0
MD5 ff3fed3921d9ec46fa6dba12cf254630
SHA1 fb5e5777ebe6ec21fe4d254e15b893c2e158a460
SHA512 ae14d9ec90f6aca30747fda57263df2da2072c686e281c03e7c2119d5ba7e548dd3758672d6c3821c6f79bbeabd6e8e114cc94ee4ab94adccfecbb4f07d40687
SSDEEP 768:23Izhx3IdEFDZIO0Z/6Nzc4ReyIsP1TX9m6yMHp:23IX3IdMtc44bsNxm6VJ
TLSH
T10AF2BE72F8348DA7ECAA7241B61B3293BEF0122784D82E98D9DA5F0C094319E175F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f47e6ff04b50539668590cec8252eaedf76108123a4bca02cf3e8f7e69dd0da3
MD5 aca563d9d81eb924c35996d81876ba49
SHA1 fa1ee540ead80a5f4441208236105deb73e49b76
SHA512 7cec2d91244dd7190b8e7fe17aa60374e6e77a31fb47aed2d37b1b751e8b465dfc40f3ea0c43d7a0f2a3dff2c54736d762b9f59b58d14209ee3a126363b7007e
SSDEEP 768:lrv+4UNbds3gBDZIO0Z/hNzc4ReyIsP1eVH1S5s:lbsbS3ntc44bsNEH1b
TLSH
T1FA03BE32E838DD33ACEAA785B14B76937EF8512785840E94C9D95F0C4A071DE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d8ce3ad8db7cf37ddf5dcad8d9ac03ace354da2ddfe17f553c13cdae5e74eddd
MD5 7b35d84daf22fa4cf04dfa62d6e6d8d2
SHA1 673ef31afaf89c0e164c459d35fac69c621a7a1e
SHA512 aac6960f731a01aaf79d3af3d40d021f4bccf409b24bf67add25e86b7a70c2f4c3bb6f50616577fc5e949c679c1db7914b3e6ec820dfd4af98737b8b91a424e7
TLSH
T143E00117974040DED038223040832B3127A7D13456A212869E2102683C14700AF20DD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 56bdc54ceafaf19b7588afc1c5444e7c4e6ed7d7516d6fbff850b3bc423ddedf
MD5 2810bb5a416ccf04c6c943d22f72592d
SHA1 7054bc2acce4ea7d51e07044afb81f20b8ef2307
SHA512 0a89ac4b862122a4e403c0bd5b1a908a79b2677c7d49bdc1a7675243b18ee03f8ddf40b71665a82ae85273a9c423b3dd2d46faf9707f3b41d6f8610ed3356e89
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59d893.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59d893.TMP
Size 392B
SHA256 a9da28cd89736829c0628723316eceef3f0c6cd3f876d618fd269a823e9533e3
MD5 f2661a3e04b3b467d54f4d4a997dceb3
SHA1 6e865552cdbf3bc7c70118880d419bfe4e7cf054
SHA512 419e9ab3b7b66b3d038b76d7ec22216e4808856e71c782c99817980f21d4e297777d41c09b942ab194b583a9d40ba9c34259519742a715e732185b69aee75bd7
MD5 SHA1 SHA512

Submit Download

e20679f8-2f47-460c-a620-0359f1327a70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e20679f8-2f47-460c-a620-0359f1327a70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26962\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drlkijkd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wjj49lx\drlkijkd.exe
Size 5.4MB
SHA256 370ea478bb43f8c0edd0100a0db1234d605797196ff3bba8329f0f1290d313c3
MD5 71bba235980e730352e0d9b9b3059e3c
SHA1 087b22336d832432ca8c83c5ca1e21ee7750be71
SHA512 47f005e91c1f888aa92c1e96a55c4ebb4f8681261c3f4aa03c998a47b316f3b52afce257d9f02634b98895e9dfbb522d897490e3f6a0ab06c56d0444a9349123
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMTH:9XhICteErownP0oTcMsABqlDQk4
TLSH
T13C463308B3A80DE1FAB3D13981665221D573B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads