87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed

Analysis

max time kernel
4s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
Size 5.4MB
Sample260818-e51g6sfd28
SHA256 87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed
MD5 47f1a4b3322e9508281f5fed03977c14
SHA1 307e58e51e3d3d00a95da2a3ff8bc44dae618ba2
SHA512 66410b852b691ccc93bf9111ae168ab33859197c6f505cfb1284319991f9dfbbbde005871906357cb28124a475425a8317829088fe42793a8ac532ebc3db36d9
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMn:9XhICteErownP0oTcMsABqlDQk2
TLSH
T1DC463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chg6h2.exe	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chg6h2.exe	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe

Loads dropped DLL 11 IoCs

pid	Process
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\qiyou3rf\\wb68w2r4.exe"	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
568	ifconfig.me
788	ifconfig.me
882	ifconfig.me
2561	ifconfig.me
1308	ifconfig.me
1934	ifconfig.me
207	ifconfig.me
590	ifconfig.me
1907	ifconfig.me
1966	ifconfig.me
3011	ifconfig.me
1100	ifconfig.me
2157	ifconfig.me
2813	ifconfig.me
2900	ifconfig.me
426	ifconfig.me
176	ifconfig.me
2159	ifconfig.me
2697	ifconfig.me
130	ifconfig.me
626	ifconfig.me
2847	ifconfig.me
278	ifconfig.me
546	ifconfig.me
556	ifconfig.me
1355	ifconfig.me
2114	ifconfig.me
3140	ifconfig.me
286	ifconfig.me
982	ifconfig.me
1987	ifconfig.me
2411	ifconfig.me
372	ifconfig.me
2031	ifconfig.me
2517	ifconfig.me
93	ifconfig.me
264	ifconfig.me
1302	ifconfig.me
3171	ifconfig.me
115	ifconfig.me
468	ifconfig.me
1130	ifconfig.me
1900	ifconfig.me
2393	ifconfig.me
186	ifconfig.me
1387	ifconfig.me
1513	ifconfig.me
1548	ifconfig.me
534	ifconfig.me
586	ifconfig.me
174	ifconfig.me
226	ifconfig.me
460	ifconfig.me
941	ifconfig.me
2540	ifconfig.me
113	ifconfig.me
864	ifconfig.me
1099	ifconfig.me
2054	ifconfig.me
212	ifconfig.me
1688	ifconfig.me
1699	ifconfig.me
2392	ifconfig.me
322	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3424	cmd.exe
1620	cmd.exe
6676	cmd.exe
6904	cmd.exe
248	cmd.exe
6960	cmd.exe
9888	cmd.exe
10276	cmd.exe
1764	cmd.exe
1068	cmd.exe
6232	cmd.exe
6672	cmd.exe
7592	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3880	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3296	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 2456	5688	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe	89
PID 2456 wrote to memory of 3424	2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe	90
PID 3424 wrote to memory of 1984	3424	cmd.exe	92
PID 2456 wrote to memory of 3296	2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe	94
PID 3296 wrote to memory of 5720	3296	msedge.exe	95
PID 2456 wrote to memory of 4552	2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe	96
PID 2456 wrote to memory of 5952	2456	87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe	97
PID 3296 wrote to memory of 2580	3296	msedge.exe	98
PID 3296 wrote to memory of 3880	3296	msedge.exe	99
PID 3296 wrote to memory of 2580	3296	msedge.exe	98
PID 3296 wrote to memory of 2580	3296	msedge.exe	98
PID 3296 wrote to memory of 5104	3296	msedge.exe	100
PID 3296 wrote to memory of 5104	3296	msedge.exe	100
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 4764	3296	msedge.exe	102
PID 3296 wrote to memory of 5372	3296	msedge.exe	103
PID 3296 wrote to memory of 5372	3296	msedge.exe	103
PID 3296 wrote to memory of 5372	3296	msedge.exe	103
PID 3296 wrote to memory of 1300	3296	msedge.exe	104
PID 3296 wrote to memory of 548	3296	msedge.exe	105
PID 3296 wrote to memory of 1300	3296	msedge.exe	104
PID 3296 wrote to memory of 1300	3296	msedge.exe	104
PID 3296 wrote to memory of 6128	3296	msedge.exe	257
PID 3296 wrote to memory of 548	3296	msedge.exe	105
PID 3296 wrote to memory of 548	3296	msedge.exe	105
PID 3296 wrote to memory of 6128	3296	msedge.exe	257
PID 3296 wrote to memory of 6128	3296	msedge.exe	257
PID 3296 wrote to memory of 572	3296	msedge.exe	107
PID 3296 wrote to memory of 572	3296	msedge.exe	107
PID 3296 wrote to memory of 572	3296	msedge.exe	107

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7648	attrib.exe
10728	attrib.exe
1984	attrib.exe
6744	attrib.exe
6300	attrib.exe
6960	attrib.exe
10008	attrib.exe
1948	attrib.exe
3016	attrib.exe
5480	attrib.exe
4984	attrib.exe
7156	attrib.exe
7060	attrib.exe

C:\Users\Admin\AppData\Local\Temp\87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
"C:\Users\Admin\AppData\Local\Temp\87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Temp\87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe
  "C:\Users\Admin\AppData\Local\Temp\87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe"
      4⤵
      Views/modifies file attributes
      PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fff4b9cc188,0x7fff4b9cc194,0x7fff4b9cc1a0
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,5045426672904325619,18409546612530163672,262144 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,7485331358961104440,3961415450324091464,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
      4⤵
      System Time Discovery
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,10809843780365556740,6680572909294362262,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,1018307534605016675,359769187356190297,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,4534931094787819030,14957910947791013738,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,5601965014309705768,11496920200020158936,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,3075936848067109599,15092569819461266633,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4372,i,511116783071110429,8120809515273003935,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4824,i,5580874233192059956,3622938141918902251,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3856,i,262459747517210054,7015951977450784958,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5704,i,11139077842067834453,5318080700151283428,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9551876840462906353,9287432538402489084,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6084,i,10499961415326557981,11858614294039555627,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6248,i,8410367989073810576,4790902125788958533,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6448,i,8080594466260899498,3905531883539530781,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5343654450699430501,2130069234104612236,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,7685084091418412451,10693148481516357749,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,11916446361363210813,12714207389344065622,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,11916446361363210813,12714207389344065622,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5732,i,13754517384425412336,9340142672135651160,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6516,i,8039806343466967333,6992677095228346525,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7556,i,17506856925433232255,3287492049503308932,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7832,i,12427007880690892439,143649186872423514,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7880,i,14672763547285855709,13836101413937736911,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5928,i,8596015836939587184,17561981379525763615,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7828,i,18042629376496326707,18057700827276728293,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7864,i,18206811196966628277,8398852654464844955,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7976,i,17887720361689535160,2286845766610886850,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8252,i,16148308171547835484,1486443926807665564,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8068,i,7629582937532174497,6946454343050639661,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8020,i,607687569594155506,8291476764059089495,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7916,i,826230237748611583,7806486982658665152,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7920,i,6928510380740689525,12796141017761560598,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7904,i,12949277495608869129,4180421827807907866,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8340,i,15858214514592584439,6747475190748856790,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8552,i,7641833073685656640,13995839381454162555,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5544,i,6970305089730817642,9342186169709534919,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8492,i,9596828517244782854,13098768141738462414,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8420,i,4505989394847100424,2572527923729504441,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:1
      4⤵
      PID:6540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4932,i,15229512526614906342,14045076989911217214,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:1
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8096,i,16309680507995087969,15971425310305176998,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8476,i,3345229968207546148,15973931288452852152,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:1
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8528,i,18175902060234822711,18121659001236979467,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8024,i,5698044000764154128,6346185067198130824,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8396,i,597066083762322676,277696165591526793,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4920,i,12924953402503824405,8301753422455498993,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,3894858559933108829,12094670687280940118,524288 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:14
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5644,i,17852805807192475897,9803201364647557926,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8576,i,3788594852901081683,10846781041174392725,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8484,i,15137669893994227373,5642727058287407803,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:1
      4⤵
      PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8612,i,13478438579642042131,11249802684997585712,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9260 /prefetch:1
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8260,i,8299890608421083976,17428660740902713139,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:1
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8168,i,2993145248898236066,4310274295095226924,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=3944,i,13908673507400902891,10914306162653183569,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:1
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=3876,i,2288356749693119012,17934338088175604042,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8132,i,14540596571980283897,9594416959534015811,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:1
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=4964,i,18332240504020067353,4927117177983117689,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8208,i,15361658915053100269,3980402326361287518,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=4328,i,14482933788165903086,10412817875170275555,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:7864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8124,i,13382933813971900830,2920490800527497806,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9044,i,16049188782148855765,14094508324285480352,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8904,i,16313334457302807413,15504284091831986575,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
      4⤵
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8840,i,16669291895953184120,1577275470161671764,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
      4⤵
      PID:7896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9988,i,17474632749082040232,7668520384525578352,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14116 /prefetch:1
      4⤵
      PID:7916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10004,i,1315186839369557139,15660864510387976270,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14124 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10072,i,2037054152350980185,1194958470430690131,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14136 /prefetch:1
      4⤵
      PID:7964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10292,i,6100989376480941011,12432923920372117201,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14168 /prefetch:1
      4⤵
      PID:7956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=10100,i,13592076248241935270,10804969348514956265,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14148 /prefetch:1
      4⤵
      PID:7932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=10008,i,17303760163620688072,31183787465754272,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14120 /prefetch:1
      4⤵
      PID:7924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10144,i,14875842899582834826,8060565441261147891,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=13752 /prefetch:1
      4⤵
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10368,i,8704703793956624717,16206609861075416833,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14340 /prefetch:1
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10252,i,3188727536423862346,1997614697501118195,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14436 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10112,i,454039003498023967,15160586083489606002,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14432 /prefetch:1
      4⤵
      PID:8020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10216,i,17588993433205486515,531397433333954881,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14348 /prefetch:1
      4⤵
      PID:7988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10308,i,1823991156696592168,18008247497458976009,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=13840 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10496,i,5448406308685507874,13394421067957190768,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14568 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10424,i,644747003127312473,12363234259423003589,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14544 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10160,i,3517127196465375547,8447127975300606502,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14312 /prefetch:1
      4⤵
      PID:7996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10348,i,1029865359078674448,2071225881935728980,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14384 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10396,i,12578492602228280192,11021309569878156709,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14488 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10420,i,2783421550465669270,7246808944614381717,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14540 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10224,i,1054993859893356566,10006789497026633426,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14324 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10440,i,11311299263258166599,18383895193308113021,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14556 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10520,i,16037152010658802465,6110622988128442443,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14588 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10628,i,6499510180777041662,12201587462346917132,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14668 /prefetch:1
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10532,i,4768436617781170002,5876476284464022144,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14608 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10696,i,14452349343756645707,15603336054373463543,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14708 /prefetch:1
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10620,i,11959025425618095234,11252337082038604296,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14628 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10660,i,5915629170466871642,3095308915312242229,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14688 /prefetch:1
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10712,i,10886133539376376762,6479051443073739062,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14728 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10752,i,17002161615858852460,5944057731513774709,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10644,i,2413045270605588045,5808045161387602579,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14648 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10820,i,12016496441027017945,3146905501275949326,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14816 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=14372,i,10236635380517856024,957352977363217517,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=15636 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=5924,i,13848716734477189122,16936147005834670486,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14812 /prefetch:1
      4⤵
      PID:8140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=5980,i,1540870562041990926,15241247538712367781,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14768 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10780,i,13472931538282769760,17038666545369920106,2097152 --field-trial-handle=2304,i,5137316244985292402,13277413640162137354,262144 --variations-seed-version --mojo-platform-channel-handle=14316 /prefetch:1
      4⤵
      PID:8188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2624

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe
1⤵
PID:5284
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe
  2⤵
  PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1620
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe"
      4⤵
      Views/modifies file attributes
      PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5960

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe
1⤵
PID:2624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4bs0b9y8\92sl0stn.exe
  2⤵
  PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe"
      4⤵
      Views/modifies file attributes
      PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3528

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe
1⤵
PID:5396
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5mgh2n2p\34rr5soc.exe
  2⤵
  PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe"
      4⤵
      Views/modifies file attributes
      PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6156

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe
1⤵
PID:6212
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h2fz7sh4\133gfceu.exe
  2⤵
  PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe"
      4⤵
      Views/modifies file attributes
      PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7060

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe
1⤵
PID:7140
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfouau24\0t2icmcd.exe
  2⤵
  PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe"
      4⤵
      Views/modifies file attributes
      PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe
1⤵
PID:6688
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\42n6zths\68f835u7.exe
  2⤵
  PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6904
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe"
      4⤵
      Views/modifies file attributes
      PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe
1⤵
PID:7032
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oix73x6u\wxow4ha8.exe
  2⤵
  PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:248
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe"
      4⤵
      Views/modifies file attributes
      PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6728

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe
1⤵
PID:4588
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hfdulznp\79b6r7sj.exe
  2⤵
  PID:6776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6672
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe"
      4⤵
      Views/modifies file attributes
      PID:7156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3268

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe
1⤵
PID:6728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\suzufung\3sw5vu4a.exe
  2⤵
  PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe"
      4⤵
      Views/modifies file attributes
      PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7316

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe
1⤵
PID:7484
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ugz3p0mx\nww9viaq.exe
  2⤵
  PID:7556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7592
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe"
      4⤵
      Views/modifies file attributes
      PID:7648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9524

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe
1⤵
PID:9640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n32yfucj\xn9zjuvy.exe
  2⤵
  PID:9736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9888
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe"
      4⤵
      Views/modifies file attributes
      PID:10008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9004

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe
1⤵
PID:9396
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6p9hkmb\0ma0mlks.exe
  2⤵
  PID:9688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o73pagvl\vl5hsa0x.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o73pagvl\vl5hsa0x.exe"
      4⤵
      Views/modifies file attributes
      PID:10728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

5a06bdd3-bc9f-4bae-b033-59e4505cc573.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a06bdd3-bc9f-4bae-b033-59e4505cc573.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 43KB
SHA256 23527dd91c3842a9922b483c5d8c066e81ef9daddebf843beeb9060eef46b206
MD5 9919aa488e5957c9a473565c4de111ed
SHA1 8c72a709adf61bb299edd9fb5176e99fe032d079
SHA512 f5d48682bfc604e8e8742864c0890b0f6d277a495e69cb64a915fd1525461fca2e20fa350a7a80cfbaea134c9292010120d401a06a3ced96564dfd3aea5ad736
SSDEEP 768:Lhy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30//oLDWb2KnBrM5:LhyqeUG44t6gecNW+o30/Ea2
TLSH
T1E713F297A7114E2B3F3DA3CD581DE045AE48BAD0EA014CC18E7D69DAF1F60D3C54956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a826e9b8329401841b165abba0191e7f366164e91e2c1ccdb8131a1c64969bb1
MD5 cd727d735f57f6e8bf6ad93f91d80dbb
SHA1 8fea2e8ca79058c42c19d7e105ba120700b29d9c
SHA512 9540f39b29dcba21b19159233b0312d347a420dec4cce684708bc00064bdb6df8d4cd2451095ec61382b7b0e4f28f1a7f0b45b842b0be6dabfe3696b0e06f1f0
SSDEEP 192:sxRTRVCF/fLsKR6XDde5lSWzoD8pKvHLRFZHg6+WNsYP92tfYBUnWuOoGTIgVgfJ:sxRTuF/fLsM6Xc5lNUT5TGfk3q
TLSH
T1FF42E816A9289D3B4CCBE359FA55BF53D2F95032A5D01E48EBFC8A1C04E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 18ed204138bc005fc43f2b9531d6f562ce04b1f076ed4d5c87f8393e183f9752
MD5 a73e626ef64e6c18a24fffa3ef38dde8
SHA1 64a2ef968aa332f2ddcb621ece53c7feaf59c893
SHA512 5762a43bc212df8c2ab4fd4ac61c6cfdeceff37a143bd670d27077beb39ff0d9787785585586f277d6c9cbc2bfa011ce6ed812ef471dd0cd300e2c1201161947
SSDEEP 192:sxRkRVCF/fLssRMXDde5lSCzoD8pK5+kVRFZHg6+WNsWnDDgdZ2J1q/YBUzCuOoP:sxRkuF/fLsGMXc5lJST51IW6/U3s
TLSH
T1B952F816A9389D7B4CDBE259FA55BB63D2F55032A5D01E44BBFC8A1C00E6BDD2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d0b61f3b456088d6a81e7bb3699b17792c3e5e27f452899dd3396733c909d16
MD5 0ca80ae037be8239a5ed6da3b08621b0
SHA1 8f5021e76ed96b829e4510acd217026c493b67f2
SHA512 3bed307cce90ba41924f7a41288a9d65af2be5cab4b7d6f13d650ddbda138d60e2e85a7198ccfa16a0226670a8d37a89ad3da53d40a4dbc1b1b5a483ed593117
SSDEEP 192:sxRkRVCF/fLssR6XDde5lSMzoD8pKU3LRFZHg6+WNsYPlDgd2tn1q/YBUOWuOoGI:sxRkuF/fLsG6Xc5lLtT5T2mo/x3s
TLSH
T15052F806A9289E7B4CDBE759FA55BF63D3F55032A5D01E48BBFC8A1C00E6ADD2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cab9fb7477dee2878b4ca2da644bef8e1e02e980cdf80d8ec01bc46aace07f86
MD5 a82e0fc8ccb9d207db7a67982a655076
SHA1 f0a81895fbc9e3e30348eabe352aff42eae6a60b
SHA512 8a4f52cbd68ba014c2f19f1a1d45fd475b69852dd701bcf715f7454794939489fb598beb001475d377995965313de49ed117b8b16ddeda99ee00a31675e466ad
SSDEEP 768:jC+vwN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTQqcProZm:jC+vw7E7JQWgQ+f4+u1jaUVccY
TLSH
T1F6C2EA7B640CCB7F4F800ADDED197E9B6DA802CB5698CD9047FE941C02C6BEE92154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cbcd25b22bafe36ed9e349deed3b5439d33e85b5dd8b0437561ad7b90ca56490
MD5 77faf904045bb273c09f50a6ceacd7cb
SHA1 b6dfd3fde5264c4cb558c78c150d708fe90d0fb0
SHA512 49d6bfba05504dfb233fc779950723c44ef65b4b934715bda202a3a5f289064e90c1945c6ba9989dc429bcd5dbcd148ce0ca4f9bc3e1da8282effac4c4203b19
SSDEEP 768:Irv+4UNbdD3cc4Np8+p3bd66j+4BRv86aLIiL2bwCl1:Ibsbp38L8+p3Z6n4yh0ww
TLSH
T13203CF73F9A899739CE6C644B24676433FF851A396C10EC4D8DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 11209ace8a95703bf3616c066f0a110e5b1794e28e025c82975b7ca67c3f730e
MD5 b3bb09e4049bae8bf8d010e6afe0e591
SHA1 d1c651dc63b79ee296b7d8dba163884ee3c18a4d
SHA512 c66aa3b73b79ce195b56cad99870615024f0554282850a90b6ca88a39958a489514806683e909c2103dd96104c5f80c262ba6bbbcfaf477f1665174413a06108
SSDEEP 768:v3Izhx34T/JJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3Ij34Trf8+p3Z6n4ywxm6Vh
TLSH
T14DF2AF71F8A59E739CE5D744B2573383BFF4116398C01E94D9D9AB0E108719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 58a0f1220bcc54c67b5b4e7a9b251e51f97438331565befac5f1e3c5ee97fb6b
MD5 3e70867aaba95cba1349c7f8e4b2298f
SHA1 5a2ad903c4bf86852ab1f99b108bca2d7fc939f8
SHA512 3a8d1e9b829fca6e1849388c0d21d232823c26100d79d40ccb957ebfa7b4fb767b3bed34c1cff57bc98d06530440012f31a78abf067e0b152ade8fac9cd41aad
SSDEEP 768:Qrv+4UNbdD3iZJnNp8+p3bd66j+4BRv86aLIWK2bwClW:Qbsbp38L8+p3Z6n4yw0wT
TLSH
T1CB03BF72F468ED739CFAC644B24677837FB811A399C10EC4E9D96B4E005A19E270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a64f42ab52dd60170f5cbd8e55a6056b255dc0919b061718e85e58b38a1142f8
MD5 f0be8c2d9b1bf69bbfa78df2c756b868
SHA1 fdf4bc8c8f71ba61d8fa4a5ca9236e836f10d9e5
SHA512 0d5d9b56366dbc736b1f58fe96077d115487c484cf1e38c5ddf6a6895725cae23479897786ccefbcda465862904bfea8b1eff111f1615c7adc9b89a9261184be
SSDEEP 768:J3Izhu3TTUzJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:J3I03TTMf8+p3Z6n4ywxm6Vh
TLSH
T1DFF2AFB1F8A59E739CE6D744B2563783BFF4116398C01E94DDD9AB0E108719E2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fae6427333d41f603cddc3961249101336dab8cda9010632713cc6e6ca39eb39
MD5 903a1b6f826602e88cc27b27e9c50a33
SHA1 76341442805c75a16b875a287b9310e3586b7af5
SHA512 ad2e977d33bef8887eafbdd453da89d8fac7cbc1a2a0553337589febbb7c9e6d988794bf8e7915f0b31fa39d7273cb2f99c784648c6c0516d963c059031d6c61
SSDEEP 768:irv+4UNbdT3FToRJnzp8+p3bd66j+4BRv86aLIWKqr:ibsbd3FTSF8+p3Z6n4ywqr
TLSH
T13103AF71F8A9ED339CF6D744B18677837FB821A398C00E94E9D96B4E114619E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ca0c77f2248f32303057e6461975cf94d1970df5039973ee4f8289a9d5f019af
MD5 426a59ade35bbe46f584055dd9511c87
SHA1 a17c69e51ad4044d65be86db086c3a92d279d535
SHA512 63f3737d2ea8c49e2f7d35f44800cdb659a3e8608c646f77dcf1cb25c58d43f53ee467ebeef2acd7c7e4e848170311c5ca41421f862120344d391b5f6a9857f4
SSDEEP 768:mrv+4UNbdg34TuTJnzp8+p3bd66j+4BRv86aLIWKqy:mbsba34TWF8+p3Z6n4ywqy
TLSH
T1C503BF72F8A9ED339CF6D744B18677837FB420A398C00E94E9D96B5E114719E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f9c0a20dedc76811da211b4cd793eb30f03eb440365653c9e1a6135070b2db29
MD5 d331b0a899b78b3fb1e27b7f3f9d22dc
SHA1 abcf67a7a8f8a4828c6da70f301a9d457ecf2e29
SHA512 c7a568c035564b14ff20f7f9591344e1aa100ec66fe9344a1e4705d7bd9641e9df9ad7a150bdb46ac31abe3911f71e0b46421e498b4c2287622d410f29465678
SSDEEP 768:v3Izhg34Tq1Jnrp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3I234TkN8+p3Z6n4ywxm6Vh
TLSH
T18DF2BFB1F8A59E739CE6D744B2577383BFF4116398C01E94D9D9AB0E108719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0fe8e473fd5515ec48803e2ce59c17edf3888b0e48bd8b798672810b577a59e3
MD5 05405f56fbc7782a7f679928627c1ef3
SHA1 34d7cd9d3cc15ca2767e258aa48445939a0160c6
SHA512 afc58e5eeab1c00f0b419ded7e5357adcc483f54034b1bd2374303f02a38ff07ef1fa236af3cd442008dd466feb176220a5eb1aadb56f32914a12d2e6839af22
SSDEEP 768:v3Izh834TFXJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3Ie34Tvf8+p3Z6n4ywxm6Vh
TLSH
T103F2BFB1F8A59E739CE6D744B2563383BFF4116398C01E98D9D9AB0E108719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cb5e1f082078de4058992c7f2a7ddb1438484b7d056821bc036342f24abdea83
MD5 5775f88125f582fa5bca99ed8cdbcc5d
SHA1 1191b73e3dbffc3ccb56bde94d995875ccb9a784
SHA512 0f122f3c128868b042a30b332519912fb93920a3c16cbaa1cce0a684a6fecd3d5b4606b5b859eaf537da038fd77b8238bc39816cca9ab13010647164214afcf5
SSDEEP 768:v3IzhN34Ty/Jnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3ID34T+f8+p3Z6n4ywxm6Vh
TLSH
T113F2BFB1F8A59E739CE6D744B2573383BFF4116398C01E98D9D9AB0E118719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a0f76df8c7cbfaee35a10f606bc93780853bc0a34716c856d617c5b255b30e93
MD5 c5517706cf05fc12432e89c3c12563e3
SHA1 ad5686b41b2abf8e98e08e3144b7ab2205163fe7
SHA512 5733b738b60b64abcefe2f9c74734608fa9e1b2649f89e6a43e7efcd67a1d2b155909a6927240649ae826bafb81203712c1f179d4a366c2c17e1ee57854a3ab3
SSDEEP 768:v3Izh+34TBNJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3I034TJf8+p3Z6n4ywxm6Vh
TLSH
T15CF2BFB1F8A59E739CE6D744B2563383BFF4116398C01E98DDD9AB0E108719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3642b7f2ab2ee796af90a1ce02cf39b1281901bdd9c2b33dbbf70687ada4fdc3
MD5 677eb4222c32a383ee6a29a9d8c6ae9b
SHA1 a9df116cd49bda0969533fe31ff4f78feba832a7
SHA512 4aeb28b2d973b650426f0e994a1af1f0c91c3e8d47caa88d8f259c63c213bdb6f6107507f5e2ef010923a663ed51c277cb355ba18137d605d25917574b683aec
SSDEEP 768:v3Izh834TGFJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:v3Iy34Tkf8+p3Z6n4ywxm6Vh
TLSH
T167F2BF71F8A59E739CE5D744B2573383BFF4116398C01E94D9D9AB0E148719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5cc75c6e6f8cfbed68f9da993832bb497b660bc576d918642b1f579ad450f022
MD5 4518bba7f986dedec7587ab880b87b5f
SHA1 1e4deadb6c7dc4c3dc51583af940975e7d0e9de6
SHA512 1c55d78e86827d2265646c367dec4fc47636c2ed970e3210dc46575bb0bca375c62bd7337b76337cb0d0ac28928ddb6200ff2c6baa5781cefcda5d20d3b8ed55
SSDEEP 768:J3Izh83TTLrJnhp8+p3bd66j+4BRv86aLIWKTX9m6yMh:J3Iy3TTxf8+p3Z6n4ywxm6Vh
TLSH
T132F2AFB1F8A59E739CE6D744B2563383BFF4116398C01E94D9D9AB0E108719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3e2bd582266a5c5da93ce16fac0c6361fa53070c4a93b02304200b4e0e46f9f8
MD5 55f2897ba538fd36217592f4f03f7382
SHA1 aa95db973b4b4218ff68292b7ebc8696a4766472
SHA512 61a1e1532fb083819868a92f476b40269d4107e136e5b01be817a8b0d0a77a386258f5033bbd43d566ef6cd965ffb15e8a5ea1725770425b4776bc3a7525ce0c
SSDEEP 768:Hrv+4UNbdD35zJnNp8+p3bd66j+4BRv86aLITK2bwCl1:Hbsbp3nL8+p3Z6n4yX0ww
TLSH
T14003BF72F498ED739CEAC644B14677837FB821A399C10EC4E9D96B4E005A19E270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 946bab7e1262556bcb993d256f1809931738897de3a99eafc74270a8e0d9af83
MD5 20f7cc8278a541d6c63c4603cf95e9df
SHA1 be971bb9bf8a5b666f742047ac7b56d1b2b6fb68
SHA512 10fd05c8ceb9bf838bd3716c82c0ef39a21fc41a78ef37d21b3bdb27a537877109fd7c14fc70b1db78892197e91a75b7f8abdb5ba1039ba730f4986df017d92e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a1e95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1e95.TMP
Size 392B
SHA256 6cbdaa9c63e18826ed864285817b3a0545882f09bf5b4d3442a1f792414b2710
MD5 cf1f772eae870c20446a1444698abfb0
SHA1 55055670ca4ca87dc689a7f2dc7a5c0ae7dbc572
SHA512 249a7fb234f1be51faf09f67cd1707143b0e4cd21033c7b78dabcf256fc9c5372a52f1c2fdf45403a35bc5cdcb108d546ef523a3d7ae62b8b6f17628a75a2a81
MD5 SHA1 SHA512

Submit Download

620bd96b-eb10-47b6-975f-0bce0aa35960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\620bd96b-eb10-47b6-975f-0bce0aa35960.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56882\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wb68w2r4.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qiyou3rf\wb68w2r4.exe
Size 5.4MB
SHA256 87d9555bd5fb4739563c4808a7ad1291f2e74b939eff3438523fd3caf87320ed
MD5 47f1a4b3322e9508281f5fed03977c14
SHA1 307e58e51e3d3d00a95da2a3ff8bc44dae618ba2
SHA512 66410b852b691ccc93bf9111ae168ab33859197c6f505cfb1284319991f9dfbbbde005871906357cb28124a475425a8317829088fe42793a8ac532ebc3db36d9
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMn:9XhICteErownP0oTcMsABqlDQk2
TLSH
T1DC463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads