ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56

Analysis

max time kernel
4s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
Size 5.4MB
Sample260818-nl78ca1flf
SHA256 ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56
MD5 f73948b22999898cbff6ec102d30cf1b
SHA1 37e9c48eb14cb43bb18d68f8f90e1d5beb32eadd
SHA512 abac96cd34f3c3faff996c5ea0b35b484fee70940d82086715c8dadfb780653faba7b4d35f6372d4e0e46106747d1f1f161a56f5b88da92bd663481e9d8fe0c4
SSDEEP 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61FQ:Tt7ICteErownP0oTcMsABqloOc1S
TLSH
T1D8463308B3A80CE1FAB3E13985561621D973B42547B0D1CF43AC9A662F677E0AF3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g8o9sq.exe	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g8o9sq.exe	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe

Loads dropped DLL 11 IoCs

pid	Process
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\yo3swbqz\\zxt0ffmq.exe"	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
645	ifconfig.me
653	ifconfig.me
793	ifconfig.me
1716	ifconfig.me
1	ifconfig.me
473	ifconfig.me
1100	ifconfig.me
161	ifconfig.me
188	ifconfig.me
240	ifconfig.me
349	ifconfig.me
413	ifconfig.me
430	ifconfig.me
1188	ifconfig.me
296	ifconfig.me
351	ifconfig.me
159	ifconfig.me
352	ifconfig.me
402	ifconfig.me
961	ifconfig.me
997	ifconfig.me
487	ifconfig.me
677	ifconfig.me
704	ifconfig.me
808	ifconfig.me
859	ifconfig.me
1095	ifconfig.me
186	ifconfig.me
60	ifconfig.me
428	ifconfig.me
577	ifconfig.me
1423	ifconfig.me
350	ifconfig.me
570	ifconfig.me
1025	ifconfig.me
1219	ifconfig.me
1710	ifconfig.me
764	ifconfig.me
42	ifconfig.me
292	ifconfig.me
380	ifconfig.me
414	ifconfig.me
1156	ifconfig.me
80	ifconfig.me
1260	ifconfig.me
210	ifconfig.me
679	ifconfig.me
965	ifconfig.me
1426	ifconfig.me
1508	ifconfig.me
740	ifconfig.me
302	ifconfig.me
348	ifconfig.me
489	ifconfig.me
822	ifconfig.me
1440	ifconfig.me
1549	ifconfig.me
184	ifconfig.me
162	ifconfig.me
222	ifconfig.me
562	ifconfig.me
1270	ifconfig.me
1587	ifconfig.me
86	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7140	cmd.exe
7164	cmd.exe
936	cmd.exe
764	cmd.exe
4920	cmd.exe
6336	cmd.exe
7116	cmd.exe
6580	cmd.exe
4140	cmd.exe
4276	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	msedge.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 3380	5672	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe	89
PID 3380 wrote to memory of 936	3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe	90
PID 936 wrote to memory of 5080	936	cmd.exe	123
PID 3380 wrote to memory of 2996	3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe	93
PID 2996 wrote to memory of 4220	2996	msedge.exe	95
PID 3380 wrote to memory of 5732	3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe	96
PID 3380 wrote to memory of 3464	3380	ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe	97
PID 2996 wrote to memory of 1552	2996	msedge.exe	98
PID 2996 wrote to memory of 3196	2996	msedge.exe	99
PID 2996 wrote to memory of 3196	2996	msedge.exe	99
PID 2996 wrote to memory of 4196	2996	msedge.exe	100
PID 2996 wrote to memory of 3196	2996	msedge.exe	99
PID 2996 wrote to memory of 4196	2996	msedge.exe	100

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5080	attrib.exe
5196	attrib.exe
2564	attrib.exe
6404	attrib.exe
4516	attrib.exe
4340	attrib.exe
6264	attrib.exe
952	attrib.exe
3916	attrib.exe
4512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
"C:\Users\Admin\AppData\Local\Temp\ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe
  "C:\Users\Admin\AppData\Local\Temp\ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe"
      4⤵
      Views/modifies file attributes
      PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffe8b91c188,0x7ffe8b91c194,0x7ffe8b91c1a0
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15372180737976789596,15257766129343577650,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      System Time Discovery
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,420821599693571646,6409624190373544772,262144 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,2536394072628330321,10706481122336518806,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9227531646519993599,12142478410807320409,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,3604555747471891847,3778770740990349983,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,4055672932416843929,16557219049282730655,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4404,i,13345257136713696310,8939151184677495280,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14219892718742004226,4114348545228396214,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4632,i,6789111230186793965,9092873222469594353,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4000,i,4835163183997168609,6798312766888347766,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5800,i,14443525877321619326,13850607054395071693,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,8380906455255459081,2198587935153099992,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6084,i,5535769468799616927,588766243072415309,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6304,i,13642124031490070787,12108065263045769739,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,18230169218937033398,10433596641560228644,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7394658267466922464,7594720407379910250,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6068,i,18147587868521138685,1025072630365453871,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6052,i,12322200394569793150,3279822928792798834,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17694563117209243496,5099147135696331021,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3840,i,18320470933792136231,5882856151865928613,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7296,i,15250799928580111186,2727157437807889951,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7564,i,15061013611344020990,16489161419460305791,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6788,i,9078642932287401387,11496744261201999932,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17694563117209243496,5099147135696331021,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7760,i,2627889596670338280,8157736918990458727,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,15450057853615946024,12222625412071779388,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:12
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7336,i,14734536575301541705,9148870350497222196,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4764,i,4491000550960301161,10300203749531721343,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9116 /prefetch:1
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4776,i,17444516406402496409,13654813594951959972,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9112 /prefetch:1
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4756,i,15267316995756694953,13657053598267514590,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:1
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5772,i,17190558699225746634,9273515937932635820,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8328,i,7099877460158840801,12171330299574489150,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4024,i,215608033085752618,403552147645817696,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4520,i,1706821983401294455,12620167156217979650,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:1
      4⤵
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4464,i,3191682549672739595,208133822585590540,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4940,i,7509387861428665115,11363425501902066635,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
      4⤵
      PID:6904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8400,i,3965690417185631800,10221805287534683811,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:1
      4⤵
      PID:6948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8448,i,7876030467374700717,2870705435258790274,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9296 /prefetch:1
      4⤵
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4952,i,6199894471337935479,4803390093444432917,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8480,i,17548508371314710734,10601348085351276636,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5652,i,10927414613760774641,16152514914949629814,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7228,i,5398029652688646297,2377730268924421220,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8524,i,17113497628135494619,4444024090175168923,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:1
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5132,i,1625519222163676963,17066090094756590056,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8536,i,10010558890465436960,8313595023622111712,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:1
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8596,i,842058462036020740,9873792844860850354,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8580,i,13522223631514694458,216540181263361459,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10036 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8848,i,17943980760615927365,4298689762964976178,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8572,i,909692223550174214,7253963365967492965,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10056 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8952,i,11201445217244864784,5495126653846953429,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8988,i,5638831409199622148,11112061337586357440,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9056,i,12053815219538432605,10754847558073140303,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10164 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9000,i,13806930701270095364,542276973350577505,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9008,i,8611646679244998162,15103543006316665408,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7188,i,14456176971226387130,15206655918022918466,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11604 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9464,i,5313880464718051643,8020705149059501735,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11240 /prefetch:1
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7180,i,6388340383409377776,5903091862354370326,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8388,i,7205816598536618384,7210740374535869139,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11680 /prefetch:1
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8364,i,4765289479008290161,2494663810819862378,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8368,i,3171258455314006250,4061901461160121753,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11628 /prefetch:1
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8904,i,9294662245168976033,7790998175814814939,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11668 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8020,i,3252124763692849459,18161282142420731753,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11732 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=4744,i,13594374904272109025,4477164026420769159,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11744 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=4948,i,11889625808385365536,15168151533206828499,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11752 /prefetch:1
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8212,i,10366320641708465330,3986741428578138750,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11724 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=4488,i,13736066416462486553,2846698614672693946,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11784 /prefetch:1
      4⤵
      PID:7080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9700,i,5041430440593587907,5748389873847769406,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11672 /prefetch:1
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9756,i,5634670692894961012,10330645057350674448,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11804 /prefetch:1
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9804,i,12677537965260963354,11315423459430036503,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11864 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=4828,i,4257182724595654103,11551872958460224625,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11824 /prefetch:1
      4⤵
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9884,i,12094100087744873539,1094531777590137448,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11944 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9860,i,10602148630547130657,6817695597839843684,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11904 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8216,i,1752000390865938535,4240082328532157386,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11884 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9776,i,5245918449675512328,7611391230953559230,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11844 /prefetch:1
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9952,i,15408150394980430189,697651883629630525,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11964 /prefetch:1
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4772,i,6056166384995860520,15615111102750782778,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=11924 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15700,i,9471108975557921133,18141910853024181436,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16028 /prefetch:14
      4⤵
      PID:7676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9428,i,2012707554663686702,14632572901715974507,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16040 /prefetch:14
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16032,i,18107236286554408411,1937334067786099007,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16084 /prefetch:14
      4⤵
      PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=3000,i,16728023061040687280,2833105839303942638,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:1
      4⤵
      PID:8528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8492,i,14739493993136165453,17712316059839555599,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
      4⤵
      PID:8928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=16252,i,6157844433034311608,10671397208957440011,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16220 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=16300,i,9941260044504172444,185394543208735554,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16188 /prefetch:1
      4⤵
      PID:8552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=16232,i,10932564310152966204,1134922071590459555,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16212 /prefetch:1
      4⤵
      PID:8136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16636,i,3043558785076634078,9625009919190552181,524288 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16640 /prefetch:14
      4⤵
      PID:9112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=16612,i,10556994600649583473,2663665308658455956,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
      4⤵
      PID:7312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=16912,i,3809546037374252469,15638734850995215361,2097152 --field-trial-handle=2396,i,4995842845750302435,7324178778880986867,262144 --variations-seed-version --mojo-platform-channel-handle=16880 /prefetch:1
      4⤵
      PID:8848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1200

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe
1⤵
PID:4972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe
  2⤵
  PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe"
      4⤵
      Views/modifies file attributes
      PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:912

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe
1⤵
PID:1584
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t0qotgoi\ntfs4ob8.exe
  2⤵
  PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe"
      4⤵
      Views/modifies file attributes
      PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:912

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe
1⤵
PID:4640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0tgxzyb\911yxya2.exe
  2⤵
  PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4920
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe"
      4⤵
      Views/modifies file attributes
      PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe
1⤵
PID:2616
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\marin5ey\h4ajqi0z.exe
  2⤵
  PID:912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe"
      4⤵
      Views/modifies file attributes
      PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6160

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe
1⤵
PID:4684
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0eeg3x8c\bzmopcir.exe
  2⤵
  PID:6184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6336
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe"
      4⤵
      Views/modifies file attributes
      PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6756

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe
1⤵
PID:6972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lharitaa\9nr9kkfx.exe
  2⤵
  PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe"
      4⤵
      Views/modifies file attributes
      PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6616

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe
1⤵
PID:6728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z59s6uor\ljwfp31i.exe
  2⤵
  PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7116
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe"
      4⤵
      Views/modifies file attributes
      PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6580

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe
1⤵
PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1tco3usq\swojlc1m.exe
  2⤵
  PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe"
      4⤵
      Views/modifies file attributes
      PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5324

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe
1⤵
PID:6364
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fy2drc5t\lkzidlrb.exe
  2⤵
  PID:6536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1rti9kmb\00y8ai7a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1rti9kmb\00y8ai7a.exe"
      4⤵
      Views/modifies file attributes
      PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 43KB
SHA256 0b14ab9d0e4863752717c058f8c982eb4d624d5e39216664f57d4aab98526dd0
MD5 a24f60462094703b479746602f6ac25c
SHA1 952042cf719953b7ccfb796cf11cf5034d9171fd
SHA512 625030ff305be05987ab67afd6a9c7802c122fc7e8c374acad8ce247ab3ceebb852a4644372429c702cdd59714879f12f57ab06ffdec30024713e50549589a75
SSDEEP 768:6hy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30/3M4ITeCbFhd+:6hyqeUG44t6gecNW+o30/Lqeb
TLSH
T1D5130222F3204A2B382226EC580CD1851E0EFFD0E5562CD1C7A96C9EF5954F34AEB4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 27KB
SHA256 df56b93b77dc0e54faa099e90d52c1e4c3c18b004e96940a49d745769c0ac01b
MD5 1b23c2d7bb7e6f3f33aa479741ce7a75
SHA1 3dabcaa2839206bf56eab6107842da86da9290a7
SHA512 4dd879bc3639f69330598b592ad1eee3e0e33f4671537a63b5ad32fada2a49e68c6bb1b314650f3fc7e20116453716e7fbc064bae6a380f2963e1aff497da5e1
SSDEEP 768:OGZLO9c+c8qycUC/B+y85QB1a+BM1GhtpF643/nKh3ujsu:OYL5+S3NdWQB1zu1GhpPKhSsu
TLSH
T178C2E1EC4C9749086588CC32A5DC9B0FCA7C6C680123BD8199C893FDEC9614EAB2F1F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 45KB
SHA256 6d860073098c5e958c2ed5fbbe589d8800a344d8bf65313d7bfc18985d44dea4
MD5 2bff6bcda000dfd231be5a30758ed476
SHA1 0525910f72c2005dc608e64882a53b8317a7a898
SHA512 f6722934b6efd902f5b21bd5fa4af53ff004b04b6e93f3f3c05ef28a2b2c22a9d75f3bf2806e12f3ff31d229c929b63778c307249fdb99f3f94b6c6bfdea7949
SSDEEP 768:qjrQy7wAvxl3mMV/CdNRe8r+7WK4Vw5uu0VzbV7HVP1IVmcMdHcCkHEPrjZ15ei:qjsmwAvxl3mMUdNk8IWKYl/f1P1Ioco5
TLSH
T15A23F111108A29961E61E781B34BFAE47DE182EB0B1F7DB55C8E8F546608B27B0D1D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 50KB
SHA256 671289f35e3da79d75370b98688f9b349ffdc57fad498666e79cde82db4d04c2
MD5 70648f676a3fad1489802f562133040f
SHA1 352e0b66e7cb9b45dfbe69ad9bb4186019298aea
SHA512 14c59fc1c4ab42414fa1b45de641b34ae4cd8607f46b63dcf9df6d987a143c4b23d1e9a87181910e1e9ddce7199a76503463d7dfecfe8fab61668b8b5de9080c
SSDEEP 768:loj22LY07FeVM+kPcjZG4iVDHNL9D3LwO6ra4FpL+MX172iPs6A974Oxvu:7OT70VLEcjkHxJY2OpLfBJPPANxu
TLSH
T18D3302523B690309AACD295BF42C26F04AFF0714DCF892B1D8957D719DEFB5C19D2902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 77KB
SHA256 499235a4444b177b5b4ebf3ea5c252730838e295dd0993ea628a1bdae60ee507
MD5 7e7fbe396873ab4b3bfcc5519edaae9f
SHA1 39c87814f0f8120ec97699fb4f19ee532d499c10
SHA512 40eda6756822467265e440c0f377008c9bc7247089324d09c0ef1bf4c6d745c6ccca1bc235f9d6e9b4866cbad31bee11b1d96918dc2609d62a6f79798a10195e
SSDEEP 1536:UkcTd81ovZpzBjp1gnd4eqFBYhoG3gDBcpQralpDShOBB6au5NOrL2ALCjb:Dc581Cztp10tiCpoalpDShMY1OrLQ3
TLSH
T16E7312062F9CA5495CBCEFE922437CDEA80EC6D207E677AC711B504A74E172285E8E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 130KB
SHA256 e3b84f5041518aa488b573defa45bf3a10166729cf6b7897374f66104a2fbee7
MD5 7c261e4619eed505cfe82e58be8a1efc
SHA1 ecb3f4c67704135eeb1b749618eda595af621b24
SHA512 499d4857b7cdf646843b54f8a2818922356aebd8e54a4229dac4a0c1faf45f9f0bb7b67e794872bf9d2834469882462a922745bd3fb93c1a09522165c98794f0
SSDEEP 3072:P+01X3UOgyCOvjDEVVT4aPXsa0aGPBMN4D0DA7zenRBAmOGQvDhJMsPTxaY:PP1XEOBUTFPcjVp/D7g0CQbFNt
TLSH
T170D31267AB47E9CDF74FE168669051B6BAC2ED2302C41A1E5315F3C35812BE38791D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 279KB
SHA256 ac7ae1b092c38e8f9d4fbf72993c908acd1700dd4f91a6143459e5a901fa910e
MD5 e722a8c9e1bd114233dae61e7a605876
SHA1 50fc9004cd705fac0ca0814843d55cd5952a8db8
SHA512 e96cab9e5aea4f69d3b24f6fe754955190f95d383486ea5b5480415dfc7fde2b40738399d25ada4ea3a340c2613dec199874db77d37194a33c0db3ab66f65900
SSDEEP 6144:1Pg/0+vqaW3pGpYBF2dbRfFILA3CkKqcUTCxdGwoDaeB01H5K2u:18h2BF2dbRfFI0bhTUADDN+1M2u
TLSH
T14E54233E74F9A14078D4B08825BB4F8541FF8A419A6F7709F6B68142F3629D243F9DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 621KB
SHA256 1cc0b6b5ad9f026ef1115befe607a31eaa3370f0f23aa315ea6095c3394e7549
MD5 b0eefe7077b968ccec8a7243d9a96e41
SHA1 fd89e47c7e85bb265ab06ba9f8e29e7dd9ca4712
SHA512 45b25756e39bea647df11919cbdb8ff57c3e82f57da04b2984af35fccf7591a328a98e1932f72b219cec035eb779239573636cb6a26b6aa95d3a25cda5b3654b
SSDEEP 12288:mJ7Hw6okekrZr692gCNXWcbRRpNW4in0dX9f+dYwWnvrmBC028D6m:mJ7lKcgCNGc3pyn6Xh+KrnDmx6m
TLSH
T1F8D423CE6384A7C2F9B9083C3D4D9B3E814F6651B964828F85A12B47644DB7CDC2A47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 40KB
SHA256 0cfd1d5a04f47bde4a5d5b62336f978ad09dee1364758dab049f8bbfa22a4026
MD5 edcf8120e2ec8f36c4f5e478ae794373
SHA1 bbed206cddc2c1a023a3e991c6bc1d18cb86ae02
SHA512 26343602d751cb4e5e062b8eeca21c5ffe60d2317c6aeb1cc3963ab167242deae80a7e07a369f31c08a70b4d92d9d009922a8888dcb03b53678fb054edac96da
SSDEEP 768:gRIy8vbbJu0AAiXzowgGyljlexPPAy5QFmhYXTYRTg3LwPcfi39oESHMVg:glUJ1G2xljWPVQFAOTag3LwoHrsVg
TLSH
T13E03F10A638B4B8BF504D4F1B8CB6B85F424A4A064B0EF63B67B0326387FC96C45547E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 60KB
SHA256 fc96f8c0407755f59a423a5c0f6638799c35a3767c3814f857456bc3639b0d16
MD5 5821e374bcb2e7ede2a30ea8992cb8e9
SHA1 33bc7e9f1c0273262d9e7126e2c04376c4ca6031
SHA512 5f95d57f182edcb8d1fdb559b5930d5a93a556fba4f898a8a49aaaac5ae045d1d4ed29ad399f362f04c126de6865cf1590a40114cd43d04a9ff194dc92ba462b
SSDEEP 1536:2KnORwX75/+x1GhvurZW5fGjCTdpKcWw8wNuMkQp63JLSTL:2AdXW1evurZo1rB8w5kS63ZKL
TLSH
T1ED5301CCEEB6D68BE935D888DF4D6AEBE964009543680F1C2C8BF5C8761F8F1D800592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 75KB
SHA256 ef14e5cf01df77b5e5086bbd17f4e78567a2dc607b0dc0111e80e4034ed780cd
MD5 d5bd42668c14fdd25513714d2fd916fa
SHA1 562190c0222f0998497c0abf292ea49d25bb8d8a
SHA512 3d6623395460012e9ba399c2a3ae0c97bbb07a4a7f87d4ccfe7ed08dc2560bf709294d729b5e862a8a24d3f5f5020a65aa01c604104fdff08037dbbd034f104f
SSDEEP 1536:GSRrHkf9BFfVtfeHZP8+Fn5lRxzs2YtOWcl26DUyz24S+:GNf9/VtfqP5R5lRxzMOWclvQb4S+
TLSH
T1707302F81AA57FC2BA2D70685ECC06A0F20807506DF922CFC9D99778D0EB9971064F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 21KB
SHA256 a3d8bdb8d4e94c935586972bc44ca6de73f85b2b8b1774bac16d4b337bdcddd0
MD5 634193278226985204833cd63e5b991b
SHA1 86f97c9b8493e5075edd34a9491d25cbb28343dc
SHA512 e4ae39e4f74d4634625129d3d0734fddd75fe289310825c604aeba0699f0e62852a039b323fa905d0ae36fe1faee948615c7c1735e50d776f78255ce3d29cd98
SSDEEP 384:eiRzNh7h1JYfi5X9rfUORMBw7nGx0kNW51bq6hMU0b+ZdYqdQf6ubXw7ngZ:eSH7hYC18ORti3Y5F6ydYFff74nW
TLSH
T1A1A2D0A6D81D4DCA83DBDB1C30D397B9CB712A0E9C41AD7C98CBC74564C561D2A1870D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 35KB
SHA256 3f1b272ca9118e7f279af022a33a8228153c339d30a0d1a9dd2e44edb852dc9b
MD5 2d341d3bbfd1dda2ef36f9033173449d
SHA1 af109a665a35f5ac95e057085d434460d0d95913
SHA512 17642d6f0509df90dfbd378e2bd53bd5147d7eb93e99aa5ab31b9f8804145f913f0aea187993d39269f5d20f0ac2bc087cc3501c3a1d5df962cf93ba6f5bf82b
SSDEEP 768:J+EJR+YRREIXQgpxrsLwX/njTprl5EYnHEG8QSwvmsJGX0SbZEP6mUXltB:JxR+EdXrpJsLwvnp8YnHDjSwv5JM3SWV
TLSH
T178F2F1E71CC2038C6275743EE790070CE4A03FBB6AE4DCCD9A487766B4B275A8585D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 17KB
SHA256 41d5e9a00c94e34764dbf0bc12b2e874e537cb093ae45fd03cebc9e94afbba10
MD5 36242823c69e78c4627dc5a0d0269d80
SHA1 b0c7e2fbd372118e62843114c9c02eb4eeebcbd6
SHA512 15105caedbe138b9ba8f35e36a253b3d37d5f35337a8865d489d6c9f1b3d54e4ddbfd00b293d086d666499a1c54e6d611088dc019ecda7e38f23483ab72f38b0
SSDEEP 384:QYT51uiRX86wtBI1dtzsUNIlx5waJpo4onn4aAcHug:/lsPtBI1dFITCaHo+af
TLSH
T1B482D18E71F6DAD0DF522D05BDAA74542333BE9B431E1A236065529DEFC37B81891C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 21KB
SHA256 0533e5998d075b2eca0f15a9faf5eb74301e813857a681732038fd2d40fcce9e
MD5 1a9cc46f01850e69e979e75c5cd51277
SHA1 a33d13298c3f24b50ead41be87220c12309ff075
SHA512 c51880ebd11e3bbda7ecf7533a0855977ec43522675fe7d83ad1caab97594385ee569e43d823f8545f83b6010898fbc30aa2dbec6025b7b0f1441f41c2cad772
SSDEEP 384:LnQ3kS4E0Fr7T1uv5GSv7SYKrEBb8JuRYEdeJLsABumGrMrevqxWqcFPljwQhNY7:rQ3kPr6v54YKYBbFHd/ABJGZijc9lMQY
TLSH
T1FAA2E17E05FCEF18E144427B7775C2EA300BA839EBE8A8700AC7674049B87EA8D45CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 86KB
SHA256 4ff2e2081ca67bd8294f77bdf630190586fa66e312edcfaae2b2c4dc6655f2ea
MD5 c8684fbdb68abac8f413030a223806af
SHA1 14f1576b0ce97ea3930d680f6242fc9230814439
SHA512 bd6c0f0ea1a6fe211c6355041e2228aacb45e35ff96bbceab203c1ccce7804ea2de5d9f93b3f10ba7741f187cb1da660942fc1468fe55f9e2f194d5cfbcbc86f
SSDEEP 1536:4SeL85Nh0fPwme+bCPCMOkksykEF30U9MhfhkfFDKDIGG5jkTW6:4S/Phm2JPCMOpsyDkU9Mof+dojt6
TLSH
T15D93023255D72CDCB4A4E6F790C789E969AB46B79A844397150FB2C9C83D8FB3022334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 202KB
SHA256 2337c70619c6d489f438047b4aaf3613eccdc8a016ac0bb980a7527d2be86ac6
MD5 e8166dcb6e22f28b1e2df0a5a5e983a0
SHA1 1d654fcb581498888cbdbe60f57821725fa826f7
SHA512 49b0722c4e8ac1f83a6c6575f14ee1ef0694d609c5ee8d23a4dd95841061513560cba7da6d8178e90785d4027032035432c51d8872dc4b85455499b5289e167b
SSDEEP 3072:ZD3npuw2sUMvfRwj3U2qzsHC6iuf8ueUjOckOWofwBqk3KVnwTdXBimwOgdJK8Fh:55Gk2fHC6iuf1eUTLIskaedXnwOqJK8D
TLSH
T1C614227216F689FC51703D9A4132D16720CED05200BDC7AEB4A3E694FEE4A98EEF5325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 49KB
SHA256 385a630eb4e43af1ceff5c3f15aa9a25a8bd07976988069417cc6ca2f2162ad4
MD5 aad1d8a9630b9ee81ee3f8208020049a
SHA1 0cfba71b6fd8fa2008380cf5e143799467fefd90
SHA512 3ee243a7b903c46fd46af4d003a87bd9da9cddc9ea2caa931607f81fc2f8d31315676b47252fbc2937c1e50e71c7d9d741f43f4fee330df9cb5a47d455ebdf5e
SSDEEP 768:by2FvAw/HZWdl3H7nw07ptN/5vPU1uyv127njoPYco9ouVPgUjp:7j/H4dK0pz5UtvsLjoPAXBN1
TLSH
T1E1330270BACC1F01EDC146682FD989B9C31E79E18BE63DBE4396390C26507405B7E55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 147KB
SHA256 b3790aaf2c91dc30c90a8e9bc622d7dd480aedbd56550e082f040af9aa10ca62
MD5 4cb08ce34e989e6b7799216a5077c495
SHA1 131453e3a82e4961bf9a5a4a347703dcaf890fc1
SHA512 f6fd757b09a802eb1f790f56d901d4ea3b8c035e22d4922a7135476abd5396271b66e1442ea36bed30cc56e54f9f7100d6ebd9cc6eaa2db8e7983262557020d7
SSDEEP 3072:1FiVxW5Sn9rC88Bp0bZcdctMXQgCe6rzsMVv1:1FAxWGhcwZ0rgje6rzsMP
TLSH
T176E319457640CF8AC38F4B36079FEE9394D6B7298A78D146F992DB8B2390A004E71FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 21KB
SHA256 27fbf1cc76894c289357a1601105392f1dbaafaba15daa258c954487b507718d
MD5 07df54df91480fbfe2906765452c6fbf
SHA1 a52e8a49117192c1ef95bc076dc156b1c64597ef
SHA512 6ac0f00abd894bbc17c8440f1efe6ac67e5167d91412b318013a5898713e2dd1afc9413b2f9e5d93b3a70c61b3febc4f5911c471c3016311363d89f147393f78
SSDEEP 384:U62J824pAKFNW2Vr4/r33n4gU9kFcvyO6iH/ug3sOoWEt4bK8ArCi:N2J8FpAuY2VrGn4gU9kFeyO6iH/XsOoD
TLSH
T113A24D327741DFD2F29E073858A7DE02B6CDF6658666DA2F7147A38F3B841604531B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 42KB
SHA256 27b101995cd472351bca908614bf320fe018cd6fa171a979ce37a810e1732d85
MD5 df416f45fcfee5c0944313b56924e267
SHA1 288ce83ab46ccb429a26f79dad4bba9131023e56
SHA512 8ab2cbd408bdc38767459757b0cf8baafea7977466e3c0bf51987a40a36d5baf76c2d4de79e4a64b0df92e63482a7a031ee314cf70239397cc784e8986a55a87
SSDEEP 768:tQJ8XUYhYxw/U3/9ovTDPdt415COEWq/3eP0jIpQ:6JbA8w0Sv3ny5RFXQ
TLSH
T138134B267641DFA7E2DF4338105FCF63A1E9BB24A978912BF281EB4E27411115A32FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 33KB
SHA256 61b7ec0cd4189f4bd47025c9776bd50871b7e62dc5c9f7bfd96ec34dd9cbc4be
MD5 0adc0d9564d090abe498ae8dc3746e4f
SHA1 3feb317473619f73e41fddf5f2d56767d59cd308
SHA512 ce240344b67388caaa6fc6b774d8adefba324b9c52903ed46ceb38f1e143a9e12ddccf95985e8689558a2e3cb28d934633259353b9e69ef1bd6953cf31a4ea83
SSDEEP 768:J2J8FpAuYBhoLE5P9FAO3N9KQeZKnGEialbUSRfllktGj7KeQbyni:J2J7uYBhoLgP/AgaJ8nMavllQGj73QbD
TLSH
T134F26E327640CFD2E2CE4336409FCE1296E9B721957AD52FB542E78E37961224A31FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 44KB
SHA256 e790f53e529219a3fb8b3579cb5beb36276c2a98c02d612757ccec5917940b79
MD5 e9385dce39c5167754c02ee58cbe9539
SHA1 3cec73883bac7811deaaeaad37fd169a13ea7291
SHA512 8f046bc02c35e87cb79a54265fa7008aef54bc3015438307a70850f00fe49eaceb48cd50ee77af906dba719a201305b6e3e0f215cc3d54d23be457cd9fdba78f
SSDEEP 768:D2J8FpAuYQFcenF9AclzvnxQSAyn8+cQGQMoFLyZi:D2J7uYrenrASzaSA3+cCK4
TLSH
T17F235E217640DFABE39F4734549FCF03A1C9B7908266D02AF101CB9A7791666A233FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 32KB
SHA256 43078647f3bd86002cc2d165f4439181afa7d53c7b271cf5a02071cc25d6909b
MD5 939340c7a209b4ca46615c8200f6610d
SHA1 9dee563165182c679c2eb808966dca25aa09b006
SHA512 743af1c6630eac427508c015b90b86ff3ad2c900df96ee71396955b0fb6473effdc8b9b01da19019bfec8f2c12a2d8b5b33d744099778a089ec0898b44658cfe
SSDEEP 768:As/PNPiPQTHCiSbVESUnSTbgtK2RFozpMDWeFDZeNX7Xi:As/PNPiPraNSvgmIWoely
TLSH
T1C0E2C3227242DF92E2EF5678149FEF0396D9B60586B9C62BF102D38F73901528A35FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 98389a63b260d6ff6435105dfd7848454004c3a3285ff743c1019432b49fee6b
MD5 23b0e8082a23e96d0a574ef29afbad73
SHA1 d7f6486be2726382e025e11bfd6631e4577fa986
SHA512 be55c5d25cf30bc26d44f7e19f7c4130af228b4265ba764f38862f9486f48213c52718cff7daf838861f7b7c6aac9dd93b282f1864adec4ddc35da2d9dbc4af2
TLSH
T11631ADF3C6E85A3D894146F877153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29099E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f0da9cd3efde283cc229a9b09a41d18e144dae59768a513ee23d6cb926352f4
MD5 838041291fd7ff35f044af1c21a95e17
SHA1 40a5d001e8ade9d97f61435ee41b27d9cc3086fa
SHA512 b27b8b92b06beba0286f5ebd7e7b69f17364693af47bdc895ed0ee937994926d4593daba7cdaa873988d0ca9e8105f79e7ad0a5707a62ea53b8904a1691ea712
TLSH
T13A31BEF3C6E85A3D894146F87B153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4ee6cb87115e0cb0ea7db43b7c684956e7c223c0351efd4ecceac2c34721e709
MD5 cb3eefdfb3c891dd0ae6b913da6deb3e
SHA1 1197ab3b5cc9e1111eb47f67a3faebf64944c9e9
SHA512 4901b6f99caaec348a6eab62a1b86f6088be4cdb67f59242feb4c9ee0a117ecedc5e261fb66bf38b93a1926474d8e788440c4c077fba35b6c836f0f98657c238
SSDEEP 192:sxRL7RLCi/fnsBfDde5lS+zoD8pM40F5Hg6+WN2wS9ZYBUk17uOtG4IgVMJ:sxRL70i/fnsBfc5lHsj549ZmvS
TLSH
T11C42B817A938A93B8CC7E319FB15BF53E2F95032A1D11E44ABFC861C14E66DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cdd5e4d1857e3860981f09633cf3834061091ab6ad42c7398125096d792c7e34
MD5 3092bab29f71f6f7f2e7a30d9d32019d
SHA1 3e738852ff1f83450438bbae4a3652080eec4888
SHA512 095d69551f0ca223516cb2f28cbeb72a9addd90f006700ff63bdf2135e18a736a9c15d5e8b10e26e2a6f961d272c3756340cb96e7398f0c1b7a89b1686e32da0
SSDEEP 192:sxRLkRLCi/fnshfDde5lSIzoD8pMS0F5Hg6+WN2wS9ZYBUk17uOtG4IgDrEJ:sxRLk0i/fnshfc5lhij549Zmv4
TLSH
T1EF42A716A938A93B8CC7E319FB55BF53D3F95032A1D11E48ABFC8A1C14E66DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 290f53220d25c2514674eae23fa19d36dda3c522165b7ca150e3e48a82d5a800
MD5 4b5d2ed032e0574c565f1c7c37bb5ad1
SHA1 9855d0de0c3f45beab187caca28f2f6b7e961c8c
SHA512 376f722c5eb774fc80f78dd5ffd64aa6b6f7fe9391231995a7d272ae4eb7eb881b625c0bf2d14aaa7b58d94e872571a536bfeda2a16f5ec8afd3e3f4334854b8
SSDEEP 192:sxRLkRLCi/fnshMxDde5lSlzoD8pMyiF5Hg6+WNm9SH9QSOJYBUk8ZuOtG4IgDrI:sxRLk0i/fnshUc5looj5dHzOJPv4
TLSH
T1EA42A617A938A93B8CD7E219FB15BB53D2F9503291D11E44ABFC8A1C04E66DD621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd3b8728255f87b8c590e1875c41d0ca7f277fcdee6dcf006adf53ef62c34886
MD5 0ec872abe6eab4f1ac65d23c2a8abdea
SHA1 e97e120cad746714849cb085ff5555bf30a90b62
SHA512 7f7217f9aa4aa39f817d6490c90ff19c660b72c271254ef0b5935ba44ac701bf5f14ed8374f83a985468db3ae7f646d2bd177fe8707e2809c76afc6b43b0b796
SSDEEP 192:sxRLKRLCi/fnshMxDde5lSezoD8pM6mSDF5Hg6+WNmNS3dUSGJZS2/YBUk3ZuOt7:sxRLK0i/fnshUc5lXRj5t3vGC2/avoS
TLSH
T1C552B617A938A93B8CD7E319FA55BB53E3F9503291D11E44ABFC8A1C10E66DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 07dbd6da35bb9d713914f43f54a5778689c8ab8904b9c6c4540ba25d10a791ed
MD5 6472a94371d558a609b339adc39c8689
SHA1 72d086bdce54769cc2491bf7d359e25a96aab1ef
SHA512 3319c6b4088bd206065395ecabb3ad0afc4409812ab36a1345f061bd81ce004c5d9d732f4f296388f920899f01547afe457d289f37d4bca1da65c3c3920d0bbe
SSDEEP 384:sxRLC0i/fnshUc5l2NCj5Yki3OKC2/ovGS:s60i/fAUElBj58oOS
TLSH
T19052D757A938AD3B8CDBE319FA15BB13E3F6503291D01E44ABFC8A1C10E66DD6207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dca4f691a486fb633e58715b64b2bad905709f10bc533fd12927c79c7864d8ec
MD5 d626417c613c0b48f9b0a557f6495549
SHA1 36c333d4695074aa278d30f56009ac429387cca4
SHA512 1a0f72252e512ec83b62c0ae3f84c8b8dc6691e0157023c2f67786f722638da3cc3c25e38bf87c39125e757b5d7ba19834d05051d640711d20888a403059c0ca
SSDEEP 768:jC+vtN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJQqcuroZWJ:jC+vt7E7JQWgQ+f4+u1ja6Vclu
TLSH
T1D6C2EA7B640CCB7F4F804ADDEC197E9B6DA802CB5698CD8047FE941C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60ae461477c38d156d9dcc0c94a7552bf9c0bf3be5bfa29d1165563e8f6fc671
MD5 a51c3198c03627fc17e23efc65434083
SHA1 25caa1a0a74d6dca160cc48301337af234f8a337
SHA512 7028e2102800c81e20a5a9c3e313f1bc5ca86929ce28806527935a6a62eb9148bd4b18efc0bb1b8a6b556f0a13720f7c3ae0835956327267be4e3a3825b69255
SSDEEP 768:Irv+4UNbdD38cwNp8+p3bd66j+4BRv86aLIik2bwCl1:Ibsbp3ML8+p3Z6n4y20ww
TLSH
T17503CE73F8A899739CE6C644B2467A437FF851A396C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5069c51517009c841ac242e701c729c6994b92d92171e06354096cb75e51ef26
MD5 9b16a29f47dbcf4307f581165d460692
SHA1 b88918c8816b0f3d59958feae525ffbde14a83ed
SHA512 488f45dd1c2902694555f294ae9ae07ef459f7f43db116e5259f8ed485f7bc4a5d4025f31592a797a9a6753acb879ce130253f2ca388dfb21bfb537b3e6add03
SSDEEP 768:Zrv+4UNbd43RTOr2K9Jp8+p3bd66j+4BRv86aLIWfqn:Zbsbm3RTOz38+p3Z6n4ylqn
TLSH
T15403AF72F869DD739CF6D644B18677837FB810A399C00EE8D9D96B4E014719E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 07daef742851eb316fe65b6cbf21215b6bbd4f646aa2e18a50d310f888983a1d
MD5 112d380fb6fa04560b4c5708e3790f1c
SHA1 1d582d0cde3841a308831dc6a5a82c796a894970
SHA512 de504c849084c9826ea2abbb4a7da2ec8d3d4fd8813951ab4a85968b31819f54605dc3daf2b7cc1ad45951630345b81c6f8f4cc3805573e6fa7c2b756443d6a0
SSDEEP 768:Vrv+4UNbdD32uK9Np8+p3bd66j+4BRv86aLITf2bwClW:Vbsbp3QL8+p3Z6n4y60wT
TLSH
T11B03BE72F468DD739CEAC644B28677837FB811A399C10ED4E8D96B4E015B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0d83caa6c0c85442dd263a02382529e2e012961c13196aab956c1d27c93cfa3d
MD5 dcfc8312f43e39299590375aa932fd4b
SHA1 628ea5153d26124b9b2132a7c9d2cf3772b4a57d
SHA512 4d4b6220e3a554dad9309aa9f22da647b5e47ea67105699f44efa86be25673aba692715ad5e7c56fb140166c72651a41f22dcfcc08efac985bb063bc49473cdd
SSDEEP 768:j83PTOyOK9zp8+p3bd66j+4BRv86aLIWf0uTHVQBuE:j83PTOwF8+p3Z6n4yl0cHVQBt
TLSH
T1A3F2ADB2E8A5DC739CEAD244B29677836FF451B386C44DD8D8DD6B0E014719E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ff21024a814f69bcf1214ae892210d9431d3c9fb2be5d5e0ae733129c13d6dc7
MD5 9dd9deabd7e6af2e469573cf113e44e7
SHA1 bdeed65bebee22613b77bc5fd82558a439c9eb33
SHA512 8ec90a9b657d52b6830240ea2e97f27d4096c617fbfe0f3f5c1324cacb3987b02b6968842ee0a2600229fde7aed7bba6134aa53b3831e1c7fed77c7c819ce28d
SSDEEP 768:jU3PTOd6EK9Gp8+p3bd66j+4BRv86aLIWf0uTHVQBuE:jU3PTOdCw8+p3Z6n4yl0cHVQBt
TLSH
T1CDF2ADB2A8A59C739CEAD244B29677436FF451B386C44DD8D8DD6B0E018719E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ee40a3e29a81cd74a2e4f9ec828322df41929868b63ed7c4e6bfc9d7d3eb4cb4
MD5 bd2c93cd74b6df21d0930b2344a5188d
SHA1 2b576904a090b807dadeed999991bf214dcecee5
SHA512 5b94a53af1e62ceb8d4bc715a9883e5a8ff1f02700407f70803981102d32662142e86a81d4db5eccd7efcf36810e37e9b7a32294dceb2574b0f1e0dc20b7dd22
SSDEEP 768:jE3PTO78oK9Gp8+p3bd66j+4BRv86aLIWf0uTHVQBuE:jE3PTO7cw8+p3Z6n4yl0cHVQBt
TLSH
T157F2ADB2E8A59C739CEAD244B29677836FF451B386C44DD8D8DD6B0E014719E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 56427c64b29fa2e2f4921c3f0f9ee9913cd0039e56ded58dc79ec3c3e7c80e71
MD5 d3b60295f74673b95a1851845e16c9cc
SHA1 bb91fc234bc1d8984c5b73f5e6b4c62078597c78
SHA512 ebcacef25c6594002895313efbd3574f5046c391e325b3cdf8aed55fbb613bcf089631fed45a5ba0d489070f87bf05505f25c1b95d7dd1d2916d4ab570e54d35
SSDEEP 768:PH3sTOa6K9Gp8+p3bd66j+4BRv86aLIWf0uTHVQBuE:PH3sTOQw8+p3Z6n4yl0cHVQBt
TLSH
T199F2AEB2E8A5AC738CEAD244B29677836FF451B386C44DD8D8DD6B0E014719E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6bfd4d08677a1b7b875c2a59d36968669706477ceac45bf48bf23fbc3c3c15fe
MD5 79c48e8d47d6229743e371aebf73e765
SHA1 d31236f1ac89384760480c09235edc7ce43cd295
SHA512 082b1bd9c86c97f02e813bb51aac4b81c4cb74b842fd246c9e4a65908b9d260d52b0d4498f2813d68ec43657dc82922a9370dbf021507448e437766ff4cf986d
SSDEEP 768:Nrv+4UNbdk3PTOLyK9Jp8+p3bd66j+4BRv86aLIWfqS:Nbsbe3PTO/38+p3Z6n4ylqS
TLSH
T17303AF72F8A9DD339CF6D644B18677837FB410A395C00ED8D9D96B5E014B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4420f1dfaecb55b7cd5e4abf20a2f610802479a450fde658130e6b7b4ab77f1a
MD5 e8f61bd38bf6c34926770262fe2a98e4
SHA1 e974e6c40fa0efa9daeeae95670411bfd6df8071
SHA512 805be689dfd93e911a42e068662a37559b8e4b886a4deaea914e5fb0e6b8ae289ff42a36b42f36dcae23eac6dbafb64bdc99108bd5688a695aacff99d5cc8e0e
SSDEEP 768:jh3PTO+6K9zp8+p3bd66j+4BRv86aLIWf0uTHVQBuE:jh3PTOwF8+p3Z6n4yl0cHVQBt
TLSH
T1B9F2ADB2E8A59C738CEAD244B28677836FF451A396C04DD8D8DD6B0E018719E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f188f3fe3d6b581d4e867a9a1332139777d02eaeaeea13d1edc0a78066d48d3d
MD5 d99c386dc0894b0ac7fb48b3e302c5e5
SHA1 66b64470a4c48485939b24a63f6d7dfcb2d1a7ab
SHA512 0f827521069cc1f257822c8a8e6f0db0f3f97384d5bb80701e149d97458a459b8c083f79440ad9a013941755f3e7fdab4fb283a52d4197d9d64d960edeeadaa7
SSDEEP 768:Rrv+4UNbdD3z8K9Np8+p3bd66j+4BRv86aLITf2bwCl1:Rbsbp3JL8+p3Z6n4y60ww
TLSH
T1B103BF72E469DD739CEAC644B28677837FB811A399C10ED4E8D96B4E005A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e385d065277da2d3a8152fa117959d16a10ed813ace4a4322751c2e8c74fce42
MD5 cc9cb8af674904800d609877a1187263
SHA1 49654042ec04680b190672ae958a6165fed3cdb8
SHA512 7c604ae5b7e92ab22e1115966105cd23ac43ce79fa4b8e36a54d118b97d3732111429dd9b5594beb486e2c6947b506519a1acc835965d0c82e127cca7cc13837
TLSH
T1ABE00103DB8010FAC42C07300183122163E3D03406E212479C0401613C036500E70F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 514af8b83acbfcd1edb8e742e5e0d27b46e44c7af8ad59d31e98dfb199e6c0a2
MD5 b8b8a89adbeff80e3ffa57f51f557dd8
SHA1 be5cd7ce2719db0617b88b96af1b08941e0e647c
SHA512 daf3cef7c2e91f870e196bd8a24d0a3f67eaa126cd9ad208d89464680d74fad73924e9f07a224c08a01b567dc2ef944c8db96146452b49eea5f6f0e91978ad33
TLSH
T183E00103DB8005FAE42C17304187132563E3D03407E212479C0401617C037500D72F92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a19c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a19c3.TMP
Size 392B
SHA256 a5ae0ce11c28e392841865486ad4e8d1b48ef7a097172cb53f0dae28e1e4bd3a
MD5 900bd058bb1fd8940d6aefda9b937217
SHA1 9c1fb0c9b8df6cf710adac9b48753063d23ab889
SHA512 f66bc00c3daf4e8bfe5e2c3cdb8b9f6ab923da605d319a633ac0941e9a75bce043fc65a2923228d40f4489dd978aa0af65abaed507a19767bce91fed733e2bdd
MD5 SHA1 SHA512

Submit Download

03633fe9-f186-445d-8a72-c189f754169f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03633fe9-f186-445d-8a72-c189f754169f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\base_library.zip
Size 711KB
SHA256 5bb163499a74294fc14fe93d7b3bd648e3a42b7832a453ffdffcec2a064f5fb9
MD5 e8fc4ab9f7f7f3a4108a70a3a79bc17c
SHA1 1c6299b4a475218650dc455d9f5206111f39b5fb
SHA512 ace80e834bdbbe2fcdbda7d1d09bde2f822e87e2fe23c9dbeaa440b2ccf8f8e808421b1a6f86e64ee223a7573d4fa1cda97c7145f064de32455e28bfde501d03
SSDEEP 12288:MJ2k1mldc2osQNRs54PK4I1g0axefyEpoQDS4V0cOEhH8:o2rldc2osQNRs54PK4I1dsefyEpoQDSB
TLSH
T18BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56722\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2996_1516590977\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxt0ffmq.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yo3swbqz\zxt0ffmq.exe
Size 5.4MB
SHA256 ec365d67eb2a1629324a485557f6123ecae4f0d04d8fb34827c2a377d599ab56
MD5 f73948b22999898cbff6ec102d30cf1b
SHA1 37e9c48eb14cb43bb18d68f8f90e1d5beb32eadd
SHA512 abac96cd34f3c3faff996c5ea0b35b484fee70940d82086715c8dadfb780653faba7b4d35f6372d4e0e46106747d1f1f161a56f5b88da92bd663481e9d8fe0c4
SSDEEP 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61FQ:Tt7ICteErownP0oTcMsABqloOc1S
TLSH
T1D8463308B3A80CE1FAB3E13985561621D973B42547B0D1CF43AC9A662F677E0AF3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4408-460-0x000001CA35070000-0x000001CA353BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads