d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06

Analysis

max time kernel
4s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
Size 5.4MB
Sample260818-mgsreshm9x
SHA256 d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06
MD5 acaff044266b5e5b2204e70ac22efc0e
SHA1 81f9039cb6d8ec2fd35bccd777320a71739c2de4
SHA512 427ebe3aaaa7d57221c2ce2adf20f9e7ccdbbeaa5ef7f96356a7a7539909772aa8cb8e53ee4d7cb5dccada74072b64f81b0a66ef9ae468e8eb5a16ec56d22302
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6up:AsTICteErownP0oTcMsABqljki
TLSH
T171463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3264
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9132
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8580
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7275
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3539
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6708
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7196
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5136
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4614
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9542
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2427
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3811
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7421
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3760
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6pwvii.exe	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6pwvii.exe	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe

Loads dropped DLL 11 IoCs

pid	Process
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\jfh2wvhq\\jur4g7kc.exe"	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
97	ifconfig.me
299	ifconfig.me
300	ifconfig.me
689	ifconfig.me
2305	ifconfig.me
379	ifconfig.me
783	ifconfig.me
888	ifconfig.me
1538	ifconfig.me
157	ifconfig.me
232	ifconfig.me
328	ifconfig.me
1518	ifconfig.me
2182	ifconfig.me
32	ifconfig.me
94	ifconfig.me
108	ifconfig.me
274	ifconfig.me
349	ifconfig.me
798	ifconfig.me
936	ifconfig.me
949	ifconfig.me
449	ifconfig.me
809	ifconfig.me
1153	ifconfig.me
1280	ifconfig.me
1866	ifconfig.me
19	ifconfig.me
730	ifconfig.me
2027	ifconfig.me
229	ifconfig.me
442	ifconfig.me
1307	ifconfig.me
1443	ifconfig.me
2170	ifconfig.me
2200	ifconfig.me
68	ifconfig.me
237	ifconfig.me
467	ifconfig.me
547	ifconfig.me
1033	ifconfig.me
1158	ifconfig.me
1640	ifconfig.me
1697	ifconfig.me
84	ifconfig.me
187	ifconfig.me
1029	ifconfig.me
1328	ifconfig.me
1414	ifconfig.me
1481	ifconfig.me
1740	ifconfig.me
1864	ifconfig.me
165	ifconfig.me
371	ifconfig.me
421	ifconfig.me
497	ifconfig.me
559	ifconfig.me
903	ifconfig.me
945	ifconfig.me
200	ifconfig.me
255	ifconfig.me
311	ifconfig.me
581	ifconfig.me
1872	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4328	cmd.exe
6568	cmd.exe
8648	cmd.exe
1996	cmd.exe
3552	cmd.exe
2524	cmd.exe
5428	cmd.exe
6448	cmd.exe
7340	cmd.exe
6080	cmd.exe
5208	cmd.exe
5620	cmd.exe
1788	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5248	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6000	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4400	4432	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	89
PID 4400 wrote to memory of 5208	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	90
PID 5208 wrote to memory of 2732	5208	cmd.exe	92
PID 4400 wrote to memory of 6000	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	93
PID 4400 wrote to memory of 2452	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	136
PID 4400 wrote to memory of 4692	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	95
PID 6000 wrote to memory of 1664	6000	msedge.exe	96
PID 4400 wrote to memory of 1396	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	97
PID 4400 wrote to memory of 4616	4400	d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe	171
PID 6000 wrote to memory of 5248	6000	msedge.exe	100
PID 6000 wrote to memory of 5996	6000	msedge.exe	101
PID 6000 wrote to memory of 5996	6000	msedge.exe	101
PID 6000 wrote to memory of 5996	6000	msedge.exe	101
PID 6000 wrote to memory of 1496	6000	msedge.exe	103
PID 6000 wrote to memory of 1496	6000	msedge.exe	103
PID 6000 wrote to memory of 768	6000	msedge.exe	104
PID 6000 wrote to memory of 768	6000	msedge.exe	104
PID 6000 wrote to memory of 768	6000	msedge.exe	104
PID 6000 wrote to memory of 2172	6000	msedge.exe	105
PID 6000 wrote to memory of 2172	6000	msedge.exe	105
PID 6000 wrote to memory of 2172	6000	msedge.exe	105
PID 6000 wrote to memory of 1892	6000	msedge.exe	106
PID 6000 wrote to memory of 4820	6000	msedge.exe	107
PID 6000 wrote to memory of 3340	6000	msedge.exe	108
PID 6000 wrote to memory of 4820	6000	msedge.exe	107
PID 6000 wrote to memory of 4820	6000	msedge.exe	107
PID 6000 wrote to memory of 1892	6000	msedge.exe	106
PID 6000 wrote to memory of 1892	6000	msedge.exe	106
PID 6000 wrote to memory of 3340	6000	msedge.exe	108
PID 6000 wrote to memory of 3340	6000	msedge.exe	108
PID 6000 wrote to memory of 4516	6000	msedge.exe	109
PID 6000 wrote to memory of 4516	6000	msedge.exe	109
PID 6000 wrote to memory of 4516	6000	msedge.exe	109
PID 6000 wrote to memory of 2812	6000	msedge.exe	110
PID 6000 wrote to memory of 2812	6000	msedge.exe	110
PID 6000 wrote to memory of 2812	6000	msedge.exe	110
PID 6000 wrote to memory of 4624	6000	msedge.exe	111
PID 6000 wrote to memory of 4624	6000	msedge.exe	111
PID 6000 wrote to memory of 4624	6000	msedge.exe	111

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2732	attrib.exe
684	attrib.exe
4700	attrib.exe
5964	attrib.exe
6624	attrib.exe
7420	attrib.exe
8736	attrib.exe
5388	attrib.exe
4308	attrib.exe
4192	attrib.exe
2164	attrib.exe
5772	attrib.exe
8480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
"C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
  "C:\Users\Admin\AppData\Local\Temp\d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe"
      4⤵
      Views/modifies file attributes
      PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x334,0x7ffc5f98c188,0x7ffc5f98c194,0x7ffc5f98c1a0
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2010694981272530316,13856184243695527627,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
      4⤵
      System Time Discovery
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,4213384912112527229,1718863523619000854,262144 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,15988396853800479708,1191056846654749793,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,11217744069069943657,5347679062194594494,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,16210291062558141398,16580227914338948670,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,10352243502088683516,70113953530420268,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,15642080672356223709,5762006956703387545,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4480,i,6074285247462553537,1491626268748517582,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4724,i,8853637323338558558,13588183950749979359,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4908,i,13833822482138769845,1033597195738829349,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5092,i,5790318995844456439,708590058030483609,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,5682380010024338260,5369127753129288525,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6140,i,10904528675144811327,1079465050491959158,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8446087776593172717,16907573984864675646,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8446087776593172717,16907573984864675646,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,9060300544395998522,4707761458178255958,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:14
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,15997947180607904526,9141424425003559306,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:14
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6396,i,5420650411593857223,13889983137312803283,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6092,i,6777293685569231974,8493673236599321670,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:1
      4⤵
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6076,i,719487165861245253,11986797863932692746,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:1
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6808,i,4937026585177466221,13152298019731031504,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3580,i,18212618757956527744,8853038027188942414,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6288,i,10616500292884089303,11099359656333869060,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7112,i,1219277903104019927,5830900335215086237,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7052,i,4250105881281460868,2457285005213182047,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7084,i,6333245886909934965,5339737885608518653,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7160,i,366573578550404857,15615080696398847269,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:1
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7592,i,7242491695097275130,18191664536969154988,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7288,i,5439846837747569455,17673909183984716105,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:1
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7540,i,17807210743347617130,6476150933446660517,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:1
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7280,i,8026250233288880227,16576790268005550708,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7704,i,12116927845519897910,5912719913354004102,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7516,i,13319423763827640259,9201325790989901901,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:1
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7588,i,17623654381678164519,17469050925110188585,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7652,i,15589367292489726981,4335205324677367965,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6928,i,15046686556005837800,9552909546839058962,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7124,i,1878114676832164342,17371700719228363759,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,10852285925447779861,18296301442566206744,524288 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8860 /prefetch:14
      4⤵
      PID:6192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7004,i,1390084415246040996,712669977811749179,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7036,i,2675981373261299076,2321299745369575943,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7312,i,15725866850728406587,16057586562343613656,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7484,i,2579116853923423948,14882128091056557301,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7284,i,7738168411439678421,4960680413255580312,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7772,i,14055839808534333745,1806328268802016022,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7676,i,1521903891260148095,17034559314913740011,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7752,i,5921348552273110776,17739236311637616388,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:1
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7816,i,14880560366512845507,17086875024788814420,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:1
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7968,i,3187855273034258096,12729809051967811669,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7976,i,678737899065728071,8616748604632916667,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7984,i,11857394200735938085,7116583012730195117,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8004,i,17284111172019385083,5677318129467859895,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8024,i,11528729268705860266,17323341044372136482,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8052,i,10889609649372200449,16858221845941500127,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7940,i,16142413854904601722,10362857726525236454,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4604,i,11089507151874108069,9989612020144997493,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7948,i,1067356845946975088,7144315418965560277,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7964,i,17415980397942622342,17893968936619296641,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8144,i,2718575065282270117,11431302202023361751,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4860,i,9773161330253285866,16955007717981961022,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9892 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8284,i,16776452899558486015,13385863748813171802,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10016 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8264,i,10277287855484234210,12648630813517453363,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9992 /prefetch:1
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8048,i,7206791733067492419,1523837975582831644,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8316,i,4293207140992980209,3202266133314206478,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10144 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8180,i,8684704386102055715,10358642925418556683,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:1
      4⤵
      PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5788,i,6809171336296121739,17132294423052666611,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10148 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8432,i,16590859150165894172,7940415526535857701,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4828,i,2711222030739016220,6850386301892224039,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:6660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8228,i,15018780702061892592,15038900508566119284,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8364,i,16126209782767380402,11005351269835806661,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8140,i,6245120529359855070,7604748818022282368,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
      4⤵
      PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8212,i,13492229920717028990,4708148292846571403,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8928,i,6771063469372698324,9843725527069174264,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8384,i,17720827205952779062,11513321432168557637,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8452,i,9001783194132102978,50192350577493196,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:1
      4⤵
      PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=4536,i,17233021825665251131,12181638690322646627,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=10196 /prefetch:1
      4⤵
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9540,i,17138948677936862173,4416305448591678149,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13544 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9604,i,13499829387555204960,15317120205055190524,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13552 /prefetch:1
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9576,i,16614770454524582506,3209382170358071035,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13596 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9644,i,7384661571059634409,12281313126302922317,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13648 /prefetch:1
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9684,i,15734887046454628965,13138571291384084574,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13600 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9668,i,17630037057273863417,11625144070281741923,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13576 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9692,i,16157453491925821138,8590206148700971947,2097152 --field-trial-handle=2360,i,8138490419583459845,12424583753149526742,262144 --variations-seed-version --mojo-platform-channel-handle=13620 /prefetch:1
      4⤵
      PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5780

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe
1⤵
PID:1332
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe
  2⤵
  PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5620
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe"
      4⤵
      Views/modifies file attributes
      PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3056

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe
1⤵
PID:5648
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymyfqyyy\f5pz0m5j.exe
  2⤵
  PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1996
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe"
      4⤵
      Views/modifies file attributes
      PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe
1⤵
PID:5664
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0g6eki8\b4jeu9i5.exe
  2⤵
  PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3552
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe"
      4⤵
      Views/modifies file attributes
      PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3720

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe
1⤵
PID:5864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sochxjnk\1utei29n.exe
  2⤵
  PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe"
      4⤵
      Views/modifies file attributes
      PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe
1⤵
PID:2060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7denhxyk\96z6pm1d.exe
  2⤵
  PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1788
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe"
      4⤵
      Views/modifies file attributes
      PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe
1⤵
PID:4548
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bj1taqaz\nbbk4eyp.exe
  2⤵
  PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe"
      4⤵
      Views/modifies file attributes
      PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe
1⤵
PID:5352
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a3xvl7v5\mhyi2mlp.exe
  2⤵
  PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe"
      4⤵
      Views/modifies file attributes
      PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6388

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe
1⤵
PID:6324
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\om1lqnab\c5g2xicq.exe
  2⤵
  PID:6492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6568
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe"
      4⤵
      Views/modifies file attributes
      PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6964

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe
1⤵
PID:6952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cjdm6z5\vz3mm05a.exe
  2⤵
  PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe"
      4⤵
      Views/modifies file attributes
      PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6904

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe
1⤵
PID:7108
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\78qrrl1n\137jk0n0.exe
  2⤵
  PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe"
      4⤵
      Views/modifies file attributes
      PID:7420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8460

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe
1⤵
PID:8512
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hebv8tdw\cg9xgkca.exe
  2⤵
  PID:8588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe"
      4⤵
      Views/modifies file attributes
      PID:8736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9104

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe
1⤵
PID:8204
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yk3guum9\tnj577xk.exe
  2⤵
  PID:8316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe"
      4⤵
      Views/modifies file attributes
      PID:8480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8572

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe
1⤵
PID:6852
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqw91ypp\uai1oxtf.exe
  2⤵
  PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 280KB
SHA256 6f43813e456cee0352ff7e2cb15363f556ea45442f2e3842d503a1d7044fffb1
MD5 9643f17174411b88db3f1f7234f6869c
SHA1 9c3ec7c498bea59b73112fa5e08fd41b413df6cb
SHA512 1cecc3cf210ff96bfc1389b8c934e09b000c57e2cc0a4c12d8610097ef944d2fec5816531a3c84721d23a6f7486aacf1763a2789f8b2ff4b50b87f3b8021d224
SSDEEP 6144:fPg/0+vqaW3pGpYBF2dbRfFILA3CUAz0o49d01bjlgJHcsrlBlNNd:f8h2BF2dbRfFI0rgUqbAHcsjZd
TLSH
T1EF54237AEA6A4141D470F8DCBABF029151AE65DC68B62D0DF5EED332F7318114ACB4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 205KB
SHA256 4c9a35988e43dd60f97a1db4f53cdadb82d0e9cde6ace47d3405e08624ee25fd
MD5 2c1226671f50a340a9c83ee44893951c
SHA1 28dc13bcc938e729a47d56b98a0a761e4225df99
SHA512 ebd496cb0c20b9c61cbe2e4e6efdbbbbaef0abd44068c1a1215744b62c2ef98323afe0a152902daa11f6c4f13ec31bbe12e1ce6314f778f7b07d7beaccbae16e
SSDEEP 6144:Rj8NBNT44hUIsB977SKEGF6wrhUfIkEjnv4tx34btH:RANB544bM1eKrVmfI1nm4h
TLSH
T1FB2422554F62D80B81EE30C968283D5D60A982FBBE023A19E8CF7C4BDD3856F7545EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c05f304f527be10d5cb70d6f747385a569cd9995517f9df8be8c3a192f217350
MD5 54c2220568e9b4e4c489e304684b9e6f
SHA1 258cf87fc067a7acd330d942d1289d4d2231d075
SHA512 c166449538fc69d12bc496a06af79319c0a77c7864b21234a5dfa4203a3e0a384ec5d8a5b36daa21e2b506ecc9c71b2c9e01af80dbd9ec10100c63bf42c58bff
SSDEEP 192:sxRwR/CQ/fTspg+HFSaIzoA8pM6OFnHg6+WNsuSg9bSRfYBEs1Z6FG8IgVxJ:sxRwkQ/fTsa+lSaR8d5cgsRfW6XB
TLSH
T1F442B81AA928AD3B4CDBE219FA15BB53D3F95072A1D01E48F7FC8A1C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fe15838b7e5fc6c28d16c81cc600073a21db7a8b141a9c16c50578d7b9cd3ce2
MD5 fea0639ba4169628d76ebde9aac57032
SHA1 5abe8cdf8b8fcece38e8c01484cfd0e251f2f4bc
SHA512 68b351de9876504ff77934cac8e1db3cd4a7090bdb67103f135dc3a2365947680726983d72b06fcf67ed1bddf6d807c0b532fd1a03cd53054c4905422fa2f8d8
SSDEEP 192:sxRPR/CQ/fTsNgJHFSaHzoA8pMSTSFnHg6+WNsuSglKSH9qSMJrSW/YBEnZI6FGO:sxRPkQ/fTs+JlSauEd5cgxHxMAW/U6XL
TLSH
T1EA52D96BA9286D774CDBE319FA15BB13D3F95062A0D01E44FBFC8A1C00E66DD610784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 612418fcfc3f64668a32f812fecf0ea2cb573b8aa41b17eaeed7554596309c8a
MD5 43f4cf4fdc1b2c1a2a6e265e14a052a5
SHA1 567eadd2765287d482dafdb5e4c4c4b1d3be6d54
SHA512 1149664ecae68fa935913c41e5a3beb520c6deddfb7ea9a61d00e17cc9be2ead4b77aba1e229068f4340744be205913ece4d2430f7ab9f347cae8f82e7a9bcd7
SSDEEP 192:sxRPR/CQ/fTsNgJHFSaczoA8pM+TSFnHg6+WNsuSglKSH9qSMJrSW/YBEnZI6FGO:sxRPkQ/fTs+JlSaNEd5cgxHxMAW/U6XL
TLSH
T15952D96BA9286D7B4CDBE319FA15BB13D3F95062A1D01E44FBFC8A1C00E66DD610784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e48b8759e9b182373711af74289f1f4e28e13c46c5fdcd2f62ce196854f03510
MD5 7d12434a8131eb7ac64aec1af3b7df60
SHA1 f90d524876f95fc1f0afa1bacfa9b2077c99cbab
SHA512 8fe87296b5433bb018dee6a4946d5f317c0d4d9235c3834f1a7c3743b2ec00e4124c5b0117a9f089232b7dc7be83a72b51da4edf14506bc5e669787010f404c0
SSDEEP 384:sxRPkQ/fTs++lSaHLXd5cgxHsROW/x6Xp:sTkQ/f/+nzd5Kx65
TLSH
T1F852C92AA938AD3B4CDBE319FA15BB13D3F95062A1D01E48F7FC8A1C04E66DD611744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dc73d8506852923f08b7aa804ccbb08bae637f43464f3d3dd7b3a45ca8249c68
MD5 97f2d1c609927c5280bace1212ac0122
SHA1 00430620dc07c3d6639025b6c67c20de6f696256
SHA512 270fa58b529e268282001d2bb6afd9220040be1067b8d3cf877efbbc0182360bbce959c4b188eab1e366d3b3cbc39269de78422ee919e3a5d0157e1113d943ce
SSDEEP 768:Fb1pVD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OV/J8IQroSRQ:Fb1pV1E7otWgikfq4u1jaUyI7l
TLSH
T1BEC2DA3B640CCA7F4F804ADDE8197E9B6DA802CB96D8CD8447FA951C02C6BFE91154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aacb155e7c3926ad835814b534ab07711ac3e92a5567cf473e45b154ad106ae3
MD5 0bdf17146bcbd21c8520df82ecc202e5
SHA1 253faad4f11fe657054128f2dcacaa9850f9a42d
SHA512 92c6ef9604b3fb8923b5c5b45ee6e5320568f19724f8f5b6bb8d412508c2ea820e3e1d12418ccbcd417fc6f096a838bf35f946a2a5aa521bc6bc04f15eddbdc7
SSDEEP 96:KRU1gkeCGEWCPvgsEK4hgklQUuSW0Wyf/gc0K4xgW0cUUfO0pHzc5t7xxNWlqggl:CU1gkeCG7CPYs4hgklQUuSWLyfocIxg7
TLSH
T1D7913811743643843C7EAA0C91B99C1F92C2B4A2341DA5EB7B7601664F6AF439DFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c4974223a59dc1814a18208d7ba809783677dfda5373806e4266cc9460a63c3d
MD5 c010bca1081153e13fe9947cb5ff5a4b
SHA1 b912eaeab672da5880d2ac1224d2b5081b73ad53
SHA512 af85a279744a3ea41802cca0918cc7ecff3b68b86dc6c4de869703c99657ce97171a208081ffe196524d92ed58d655021d6dd1af39ac692fc63880f9abc878e4
SSDEEP 768:9rv+4UNbdC3qGOBqobGHmpZu4aWADIidy8LqWeVH1S1C:9bsbw3rmpZzaNsuVLNEH1d
TLSH
T1A903BF3AE899CA779CF79284B1873607BEF8916386890BD098DD1B4F41DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 edd30f0770a428bfdfce5913c00de11f0ac4cf376dca4b1dca2339dc2e255210
MD5 245decd2a7c2d09f5a1c097a8dfd5497
SHA1 d37e30241b266b0637696218f13fc41706079ec3
SHA512 191da1538db8eee0202404c8f183e9931ee7ecad5b1c5779a5be14e088120280fcc29cfc42134834bb68898972c9df2fdbe32d2f45c58e7dea7ebbc0d45f0382
SSDEEP 768:QU3eyhBqobGH2tZu4aWADIidy8LuWe4aBuX:QU3i2tZzaNsuVLddaBW
TLSH
T179F2AF7AAC529D7788BAA284B1473606EFF491A3C9DD4AD5D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a7567b232e98a5f08a9770bc34f22e47af04206a6230842aa3d5d605fe248068
MD5 6d5772f1248f8fce3bf8faa435a0b27c
SHA1 594a3bf07d99976cee9480cdff18d54185c47c20
SHA512 86333c03bf59782cecc073076040925d91d9f1916447943b8d249fe4443fc430c9cdab9c1bd5c1eeb45f69707d4ef9e45954ada24dd430088859e393476e8d42
SSDEEP 768:QU3egpBqobGH2tZu4aWADIidy8LuWe4aBuX:QU3Q2tZzaNsuVLddaBW
TLSH
T14CF2AF7AAC529E7788BAA284B1473706EFF491A3C9DD4AD5D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 020aafbcdf75f9d3eb13e7bf428cc2210cff15f838ed4410f63b02afcd0117f1
MD5 de9fc1947c06e3cd338f0fb08342f8d3
SHA1 1b614588a5f9c887fc686b3858cf5dd5b0e99938
SHA512 344b5b6a7feadae15c70e750ac28a0ba190e5b644992ca341d383ab4e013defebee6cc376b8acae18a0696c8ea23057932c626efde857b33e5f7cc769c7d787e
SSDEEP 768:yrv+4UNbdC3tF9BqobGHWtZu4aWADIidy8LbWeVH1S1C:ybsbw3UWtZzaNsuVLyEH1d
TLSH
T11803CF3AA869CE7358FB6284F0877607BEF8616389890AD4D8DC0B8F01874ED131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b00664b2ee7414978ba0bbaaad185804fc08ef50a832c66f39610992ed4840e7
MD5 8e95dbb7c93c87a365578ead29a1f3c3
SHA1 830b124a42a5fb9f472acc6deb16ef32b52b7f44
SHA512 5135b9d6750c9acc46f6517cbe8e9bec05c47dbe3167289e1eafe4e61bb8b59163bd28bf3a46df6dfe8b774be1d125736ad46e85b07c3bf8ac3cacbf657232e2
SSDEEP 768:Xrv+4UNbdS3B73BqobGHMtZu4aWADIidy8LuWQ:XbsbM30MtZzaNsuVLdQ
TLSH
T1E203AE39E859DE7398BBA284F1873647BFF851A389C90A94D8DD1B4E00874AD231BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0e10ae09f6d4730133049771c980392665aaef7354713750a738667060dc43ec
MD5 3b82a92175b923abc5d6665348036472
SHA1 2735b5b2a785c0e2575e7a15e1dcf2cf23b0d5b2
SHA512 e6ec6ecf63203cfc9432f2deae04e4a96640f5a2d07da49f4fdf5842630b34f4a6ee3b435e8b6f778289e53519b37500e0d05ad47f6b88a33ec9607fa6d171a0
SSDEEP 768:Zrv+4UNbdS3BqfBqobGHXtZu4aWADIidy8LuWQ:ZbsbM3ZXtZzaNsuVLdQ
TLSH
T16603AE39E8599E7398BBA280F1873647BFF451A388C90A94D8DC0B4E00874AD231BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 66b3c4c5c92ab13af3df9759f3353005bb61258530c3d1fea7b5d80eaabffb31
MD5 13c74351c7398a7d79a40bc58824b12e
SHA1 0eb8abcf254c09613b044b23c424de0d1a3caf5a
SHA512 0dff5834a361939bbec88cd587301c2bca13e38e295cb989a659d6cdbca82192269185939a00f4f3ce95ae89a2a3b888a7d57b345c6779621a24a7f026710f6c
SSDEEP 768:P83hOxBqobGH2tZu4aWADIidy8LuWe4aBuX:P83X2tZzaNsuVLddaBW
TLSH
T1B3F2AF79AC529D7788BAA284B1473706EFF491A3C9DD4AD5D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 416a2dbf9e5f42bdfe774ce045fa66ee8a3cae334be64ded5f955bbb627c3834
MD5 b0d351bd1ed64263c6ca050cce9b0eb7
SHA1 effb20aed85cf3c48e98956c828a293d42e07b48
SHA512 d98b05b3e55a5caaf73326ce8c45f0938cd61b3ef947f726698c0666dadf917d1ee72a6e71da144929042ba853453ea1534d595ca34a01341f29b00790efdc41
SSDEEP 768:P43hRvBqobGH2tZu4aWADIidy8LuWe4aBuX:P4322tZzaNsuVLddaBW
TLSH
T149F2BF79AC529E7788BAA284B1473706EFF891A3C9DD4AD5D9EC870F00831AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 f85e0dbd73cbeb9428be093cf3e24254adbfb20875150a2d645a27dd60bd4ede
MD5 c52651cea18b91de7430f034cbe32eff
SHA1 d9f70ea9f24d241553bd54b78666c2a316ad3139
SHA512 3bfef8d9ab3fd6bf1c1d2fdb74395f51ca6441f1db2d702d2bb7dc5c68910d69921bcfd735cac55198be56805d0ad6db209584ab085d30d098a5cb4d5486b007
SSDEEP 768:P/3hXrBqobGH2tZu4aWADIidy8LuWe4aBuX:P/3g2tZzaNsuVLddaBW
TLSH
T1E8F2BF79AC529D7788BAA284B1473706EFF891A3C9DD4AD4D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 34d22ecaa7bc4b368452bcba69d2509c6c9d0eb38687c13b88a3a0013a922910
MD5 214e86f46a53ca4960e861c551d28a64
SHA1 dc3a06cb56b512de36578ff763732e20a2077552
SHA512 99758c83bcc59aeef68e7f14db5067617cd8cfaf55e90e9d5d04e52d7f07e532d108befb42d9f00e83ae52817272c3684d7fe5b1249d9f883a8084bbd69eb51c
SSDEEP 768:PJ3hIpBqobGH2tZu4aWADIidy8LuWe4aBuX:PJ3V2tZzaNsuVLddaBW
TLSH
T1A1F2AF79AC529E7788BAA284B1473706EFF891A3C9DD4AD5D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 0679f2f62a1d19e203f72c72dbed901ede9c4c613b1f0866b2136613ea16a9c6
MD5 e77895dc937434ae65cbd6f512d434b4
SHA1 925984b3b529442e4dab6eece42bbefb16f89175
SHA512 2ed5b5e268c1a59668241bf773042ffa5778c43a9021394393535693c39439cf3090ead7657b6bb76cd31b8b74fcf53bc21e27de61b3238f3a84fd655aef9ce8
SSDEEP 768:PU3hJrBqobGH2tZu4aWADIidy8LuWe4aBuX:PU3K2tZzaNsuVLddaBW
TLSH
T104F2BF7AAC529E7788BAA284B1473706EFF491A3C9DD0AD5D9EC870F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 52b189d15a203a9b457bb941d8cc3964dcfd87048b8a3299cdcbda87d7e0076d
MD5 c81666f238c593eea9b1834b8a7ee1a9
SHA1 6a2639ba70097f1d19038340a2c320755c546978
SHA512 a1f2e287538f7859f4c6cfe4f9cea3a69f0b57e5729e99bc1218403fcc7b3de8539d7c03cae9521a74ffde5ba304fe070908382dcf31eea17bd0af385e4c6988
SSDEEP 768:PP3haJBqobGH9tZu4aWADIidy8LuWe4aBuX:PP3r9tZzaNsuVLddaBW
TLSH
T1F0F2BF79AC529E7788BAA284B1473706EFF891A3C9DD0AD5D9EC870F00831AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bc61c608acd171ee8f3ce39663fc0292bce9daa62cfe8d8451823af5de559923
MD5 eacdeb6bf9abcc15a18e492bb3ddb3f8
SHA1 dfdb03bf21f88bc231176384b63c57b46957fb23
SHA512 88d1d16ac44ad24215a26197500713a3e4ede389dbc6f93d8fd7adc3ae23239d4aa6888d89b8e25bdca8a157f81505f46c4d9d1dd289572894b3636a7503500d
SSDEEP 768:Q53eEzBqobGH2tZu4aWADIidy8LuWe4aBuX:Q5322tZzaNsuVLddaBW
TLSH
T1BAF2AF7AAC529E7788BAA284B1473606EFF491A3C9DD0AD5D9EC970F00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 81315d193f37f99c6cca40af92e311a5903d468b867b27688e96a9fb4e1914a4
MD5 d352b3f3271539e71eefe8d9e0fae92a
SHA1 a57308b9d5c6dc16d5f6625c0ef275390ede7de2
SHA512 d0f2d9521133bfa0bab29ea400826980e2f67c94b4119a579b4d15d8e1c4e0c6064545a6c868b813dc892e60df0217ce9f04e6d00305242230bc0847eca9083f
SSDEEP 768:yrv+4UNbdC3+gPBqobGHWtZu4aWADIidy8LuWeVH1S1l:ybsbw3OWtZzaNsuVLdEH1e
TLSH
T16803CF39A869DE7358FBA284F1873647BEF8516389890AD4D8DD0B4F01874ED131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d71e7f5-f714-455e-8106-093dbc18ddf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d71e7f5-f714-455e-8106-093dbc18ddf7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jur4g7kc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfh2wvhq\jur4g7kc.exe
Size 5.4MB
SHA256 d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06
MD5 acaff044266b5e5b2204e70ac22efc0e
SHA1 81f9039cb6d8ec2fd35bccd777320a71739c2de4
SHA512 427ebe3aaaa7d57221c2ce2adf20f9e7ccdbbeaa5ef7f96356a7a7539909772aa8cb8e53ee4d7cb5dccada74072b64f81b0a66ef9ae468e8eb5a16ec56d22302
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6up:AsTICteErownP0oTcMsABqljki
TLSH
T171463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads