800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45

Analysis

max time kernel
5s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
Size 5.4MB
Sample260818-sdtgfacq5v
SHA256 800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45
MD5 82fc0353c96e92e365feb73677672ea0
SHA1 0dbaa722e8a4dcb8aac114c6213754f721640fc6
SHA512 0aba4d9f154ef5e3774093af3c18040ed99cdcb091744335379b2056b3c86f3c8cfff8fcb6197ea12df28b23949adc5b7e22ff6d92e293d45a9d7e69fd7d5061
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRQ:OrICteErownP0oTcMsABqlaOz6
TLSH
T1D3463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lf6lfz.exe	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lf6lfz.exe	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe

Executes dropped EXE 2 IoCs

pid	Process
1284	gwfi9x09.exe
1264	gwfi9x09.exe

Loads dropped DLL 23 IoCs

pid	Process
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe
1264	gwfi9x09.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\nuk9a6s8\\gwfi9x09.exe"	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
742	ifconfig.me
1318	ifconfig.me
74	ifconfig.me
380	ifconfig.me
407	ifconfig.me
581	ifconfig.me
895	ifconfig.me
947	ifconfig.me
67	ifconfig.me
263	ifconfig.me
736	ifconfig.me
789	ifconfig.me
865	ifconfig.me
131	ifconfig.me
144	ifconfig.me
242	ifconfig.me
630	ifconfig.me
634	ifconfig.me
671	ifconfig.me
693	ifconfig.me
1029	ifconfig.me
121	ifconfig.me
183	ifconfig.me
691	ifconfig.me
774	ifconfig.me
261	ifconfig.me
331	ifconfig.me
755	ifconfig.me
828	ifconfig.me
1199	ifconfig.me
387	ifconfig.me
982	ifconfig.me
165	ifconfig.me
367	ifconfig.me
932	ifconfig.me
85	ifconfig.me
87	ifconfig.me
315	ifconfig.me
424	ifconfig.me
540	ifconfig.me
857	ifconfig.me
1021	ifconfig.me
105	ifconfig.me
293	ifconfig.me
484	ifconfig.me
547	ifconfig.me
1053	ifconfig.me
111	ifconfig.me
258	ifconfig.me
411	ifconfig.me
605	ifconfig.me
810	ifconfig.me
101	ifconfig.me
231	ifconfig.me
284	ifconfig.me
370	ifconfig.me
421	ifconfig.me
493	ifconfig.me
499	ifconfig.me
1	ifconfig.me
262	ifconfig.me
644	ifconfig.me
645	ifconfig.me
676	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6452	cmd.exe
6768	cmd.exe
6756	cmd.exe
6164	cmd.exe
4956	cmd.exe
1256	cmd.exe
5684	cmd.exe
4184	cmd.exe
460	cmd.exe
8124	cmd.exe
7832	cmd.exe
7820	cmd.exe
6212	cmd.exe
7340	cmd.exe
1216	cmd.exe
7472	cmd.exe
6960	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3720	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3112	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 4144	5608	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	89
PID 4144 wrote to memory of 1256	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	90
PID 1256 wrote to memory of 5296	1256	cmd.exe	92
PID 4144 wrote to memory of 2748	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	93
PID 4144 wrote to memory of 3112	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	94
PID 3112 wrote to memory of 5852	3112	msedge.exe	95
PID 4144 wrote to memory of 4880	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	96
PID 4144 wrote to memory of 2984	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	98
PID 4144 wrote to memory of 4784	4144	800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe	99
PID 3112 wrote to memory of 3720	3112	msedge.exe	100
PID 3112 wrote to memory of 5280	3112	msedge.exe	101
PID 3112 wrote to memory of 5280	3112	msedge.exe	101
PID 3112 wrote to memory of 5280	3112	msedge.exe	101
PID 3112 wrote to memory of 5736	3112	msedge.exe	102
PID 3112 wrote to memory of 5736	3112	msedge.exe	102
PID 3112 wrote to memory of 3180	3112	msedge.exe	104
PID 3112 wrote to memory of 3180	3112	msedge.exe	104
PID 3112 wrote to memory of 3180	3112	msedge.exe	104
PID 3112 wrote to memory of 5840	3112	msedge.exe	105
PID 3112 wrote to memory of 5840	3112	msedge.exe	105
PID 3112 wrote to memory of 5840	3112	msedge.exe	105
PID 3112 wrote to memory of 4848	3112	msedge.exe	106
PID 3112 wrote to memory of 5528	3112	msedge.exe	107
PID 3112 wrote to memory of 3228	3112	msedge.exe	108
PID 3112 wrote to memory of 1152	3112	msedge.exe	110
PID 3112 wrote to memory of 1052	3112	msedge.exe	109
PID 3112 wrote to memory of 4848	3112	msedge.exe	106
PID 3112 wrote to memory of 4848	3112	msedge.exe	106
PID 3112 wrote to memory of 5528	3112	msedge.exe	107
PID 3112 wrote to memory of 5528	3112	msedge.exe	107
PID 3112 wrote to memory of 3228	3112	msedge.exe	108
PID 3112 wrote to memory of 3228	3112	msedge.exe	108
PID 3112 wrote to memory of 1152	3112	msedge.exe	110
PID 3112 wrote to memory of 1152	3112	msedge.exe	110
PID 3112 wrote to memory of 1052	3112	msedge.exe	109
PID 3112 wrote to memory of 1052	3112	msedge.exe	109
PID 3112 wrote to memory of 2988	3112	msedge.exe	111
PID 3112 wrote to memory of 2988	3112	msedge.exe	111
PID 3112 wrote to memory of 2988	3112	msedge.exe	111
PID 1284 wrote to memory of 1264	1284	gwfi9x09.exe	113
PID 3112 wrote to memory of 3800	3112	msedge.exe	114
PID 3112 wrote to memory of 3800	3112	msedge.exe	114
PID 3112 wrote to memory of 3800	3112	msedge.exe	114
PID 1264 wrote to memory of 5684	1264	gwfi9x09.exe	115

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6848	attrib.exe
2900	attrib.exe
7392	attrib.exe
5816	attrib.exe
6540	attrib.exe
6360	attrib.exe
4584	attrib.exe
5084	attrib.exe
8188	attrib.exe
1952	attrib.exe
7820	attrib.exe
7552	attrib.exe
3196	attrib.exe
6788	attrib.exe
5084	attrib.exe
7552	attrib.exe
5296	attrib.exe

C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
"C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe
  "C:\Users\Admin\AppData\Local\Temp\800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe"
      4⤵
      Views/modifies file attributes
      PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffd0858c188,0x7ffd0858c194,0x7ffd0858c1a0
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,5548222041644049665,6822294061730113948,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,4895639753692705309,10336687015108016049,262144 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,15530929298485817219,15002217914865074990,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,6712706827239427502,12948328412245077106,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,16374878912246938383,15915143237580079915,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,13048627996256334184,10297339584196184769,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,10471135389048472019,18280969237753060551,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4464,i,453362803367974454,12064945600032858467,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4388,i,16682176919437256046,1971057006963972403,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4592,i,11708566239618155261,7764852326974078504,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4696,i,13058071827028696066,4650849327210932260,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5692,i,4480228678814806647,12760196183814098752,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4372,i,12391897863432363005,1172463119699074655,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6316,i,11085784469530799126,7127767423693729572,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4368,i,13933369680028152506,7975122493370386008,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6664,i,1460555413086138659,655717794182316294,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,10113229803849846656,14790328015402665082,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,1730037721485773209,2935739497018785450,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7268,i,10152867066869880895,8005024968020941444,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7264,i,16422556994311500015,17006400632888469499,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7640,i,16657722053232243520,16907820494697059584,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7800,i,3677506633795343196,17956821585608079204,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7952,i,4780520128582374316,18286093683041162024,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8664,i,16683766316866067040,2824159028647917238,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:14
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8664,i,16683766316866067040,2824159028647917238,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:14
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8596,i,13289241842427853497,7345308497831040389,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:12
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8772,i,3997087874557445918,14515866184716703486,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8844,i,13762396983966872875,12887173519483711299,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8848,i,13709144612141264963,15241356558222234157,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:1
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8872,i,1845356623535937466,14929193603399813154,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8868,i,18390001031452688834,11824731731670091494,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8908,i,14353435167064172145,773733994971811498,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9052,i,16272691463144956420,11434251676098075072,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9228,i,6596743955982529808,14452644324217337457,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9224,i,3935213082678411508,5165540273950391379,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9232,i,11119956564378084827,2338033669595904767,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9296,i,929530117905251633,7167115178178953405,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9340,i,13978063903981092704,7885981629582840119,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=9936 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9384,i,548061248570494896,9393525828453255293,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9368,i,491041193206091020,2762208867856621013,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10072 /prefetch:1
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9632,i,1887817667346767901,968473184183169957,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9680,i,8632408851617133429,17074865466332014503,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10144 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8332,i,9481984691717518663,8454872797629668783,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9096,i,1808663843386435166,1954263466859386581,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8416,i,15650428161639205889,15361993595974919777,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7648,i,15240458171117711587,13751472070512672752,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10348 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9732,i,15642429483649482331,15594066629369110073,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:1
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9720,i,2036032899126689637,3761006038906330763,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10292 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8268,i,9796804207821812201,5718945284696488492,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10352 /prefetch:1
      4⤵
      PID:7236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8216,i,9866209726799714917,16753791381521099507,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:1
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7768,i,14384575253393210634,7234815065292802896,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:1
      4⤵
      PID:7252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8360,i,11864866140466226092,7713302124908954218,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10332 /prefetch:1
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9760,i,16463952746387799622,978428589685192114,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8368,i,11309902367327765824,15033491748524091936,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:1
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4304,i,14180745584781885689,1777159833175140834,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8272,i,10628235803360597058,7182906082733140974,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      PID:7900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4652,i,16694459709338031848,9236687740909364402,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:7908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5392,i,5924276014054739841,13183062517571203121,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:7916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5432,i,5210996684405420218,2076950010189232942,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:7924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6756,i,5435256310795012431,7834165881244834757,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:7932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5448,i,13339068982202210118,13882490449953260765,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:1
      4⤵
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9824,i,486889210891271293,11310192490427746804,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10960 /prefetch:1
      4⤵
      PID:7948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=6696,i,13922228572834011860,1040868900845471857,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11000 /prefetch:1
      4⤵
      PID:7956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6732,i,1009060567678571675,7039436648331282506,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=10980 /prefetch:1
      4⤵
      PID:7964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=5556,i,875875324359963786,6892973056464727327,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:1
      4⤵
      PID:7972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=6700,i,13874372996186607259,4503247784143459781,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11072 /prefetch:1
      4⤵
      PID:7980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5492,i,9041244116521676234,10859407584109818479,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11092 /prefetch:1
      4⤵
      PID:7988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=6684,i,3774125835541971989,13474809887226526521,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11080 /prefetch:1
      4⤵
      PID:7996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9808,i,1421737672199295614,749967750331392521,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11124 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9816,i,9273615976501424402,9484806754340179559,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11104 /prefetch:1
      4⤵
      PID:8012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4064,i,15786707597482691096,17553731004771256699,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11164 /prefetch:1
      4⤵
      PID:8020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=3768,i,9801631960929029799,2765947353067471525,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11144 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4060,i,2931589196770955904,12533325190279533111,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11184 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=4640,i,1442752953585914469,17933975876316343085,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11292 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4020,i,13380453793408858612,4932425880829621673,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4208,i,10473935648297505129,9179982197630447689,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:7660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8104,i,5817303950880286846,10919401836915191135,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12268 /prefetch:1
      4⤵
      PID:7076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=6104,i,9197449430769864481,18146361749078636979,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12316 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=6132,i,2423355037520291054,17418166841874080522,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12336 /prefetch:1
      4⤵
      PID:8148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6676,i,5149521493563633045,2389029090704517498,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12280 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4480,i,14126743131049732190,15559193808002366019,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9208,i,1488598821162992737,12923193217788758180,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12284 /prefetch:1
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8112,i,6281827797120755838,15950721854960019969,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=12296 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10756,i,7838770429548798894,18252532917669207636,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=14832 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10780,i,12015259263280296100,4834840428293836092,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=14828 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10760,i,16611002333339347030,4714458344743570611,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=15068 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10828,i,14868792621833350181,8673666503702775949,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=15072 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10860,i,3227463321645536090,6326076298191410506,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=15088 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10892,i,16782675251986818297,9177821517286082264,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=15220 /prefetch:1
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10880,i,12082140055660533900,16467526403367026520,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=15100 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11624,i,5553335900220785030,5847702969250694353,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17212 /prefetch:14
      4⤵
      PID:7452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,7140296275308890667,1708808875367828580,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17236 /prefetch:14
      4⤵
      PID:8196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,8400567895739412496,17703802812613870062,524288 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17292 /prefetch:14
      4⤵
      PID:8204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10872,i,14686868479528800785,4251864209071094849,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17072 /prefetch:1
      4⤵
      PID:8212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11592,i,9018361529429691573,16033231013582509003,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=16984 /prefetch:1
      4⤵
      PID:8220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=11604,i,12348982012047760480,15040177948234239544,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=16904 /prefetch:1
      4⤵
      PID:8228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11660,i,15807925274324533257,7736096513460600675,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17092 /prefetch:1
      4⤵
      PID:8236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11640,i,14651010010227452425,11937723166329576076,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17104 /prefetch:1
      4⤵
      PID:8244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11680,i,17074572200007251700,15023367947181607521,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17204 /prefetch:1
      4⤵
      PID:8252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=1260,i,240827068870067122,13190969264132120653,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17208 /prefetch:1
      4⤵
      PID:8260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11696,i,4527191797306728315,946738113553163770,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17460 /prefetch:1
      4⤵
      PID:8268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11692,i,11916723159376808316,2221339051651541864,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17508 /prefetch:1
      4⤵
      PID:8276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11744,i,17831850086103549584,845469513125550780,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17464 /prefetch:1
      4⤵
      PID:8284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11772,i,1701786504502445260,9393681078404257751,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17468 /prefetch:1
      4⤵
      PID:8292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11808,i,5960803867525905172,1955825778445594439,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17500 /prefetch:1
      4⤵
      PID:8300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11832,i,3898910920900159954,1544490222057402789,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17532 /prefetch:1
      4⤵
      PID:8308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11880,i,18192462250046961985,15705210240153785529,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17520 /prefetch:1
      4⤵
      PID:8316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11936,i,17045708081948823291,15296582854015431881,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17804 /prefetch:1
      4⤵
      PID:8332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=4836,i,6118359285400110298,15697880552121629310,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17820 /prefetch:1
      4⤵
      PID:8340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=4792,i,13837480487629018974,16668290697283739705,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17832 /prefetch:1
      4⤵
      PID:8348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11956,i,17085327434735398586,16825887452173969402,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17808 /prefetch:1
      4⤵
      PID:8356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=4832,i,12108022688820282677,7863273165620822470,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17852 /prefetch:1
      4⤵
      PID:8364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=6496,i,3643796458011322024,15170226380179407596,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17936 /prefetch:1
      4⤵
      PID:8372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=4492,i,3665752829320397887,185137835803704658,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17800 /prefetch:1
      4⤵
      PID:8324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=3028,i,16620236977193979395,9986573755140584266,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17948 /prefetch:1
      4⤵
      PID:8380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=12020,i,3754641300810967648,14581865547344369492,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17872 /prefetch:1
      4⤵
      PID:8388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=12040,i,2295675721265335233,5817968856938192595,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17932 /prefetch:1
      4⤵
      PID:8396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=12124,i,4257273161284679474,10057463921610828725,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18168 /prefetch:1
      4⤵
      PID:8460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=12188,i,6058024291170970418,11828143106020689217,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18220 /prefetch:1
      4⤵
      PID:8484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=12108,i,15481324980482811,4648638706387881382,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18148 /prefetch:1
      4⤵
      PID:8412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=1496,i,10282114007581950768,10652793555368890455,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17952 /prefetch:1
      4⤵
      PID:8404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=11884,i,5414181423891313105,52577590793370657,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=17956 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=12036,i,12523688513720726785,9776427485035330534,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18076 /prefetch:1
      4⤵
      PID:8428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=12052,i,6955810132589315920,11629423720653750209,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18060 /prefetch:1
      4⤵
      PID:8436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=12116,i,1635158227325462675,5776014683019535604,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18136 /prefetch:1
      4⤵
      PID:8444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=12072,i,4518909907409787752,16459830424125569695,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18040 /prefetch:1
      4⤵
      PID:8452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=12236,i,4272491649364199737,4455929339112335494,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18200 /prefetch:1
      4⤵
      PID:8476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=12136,i,13865825156706231987,10167554016913984809,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18140 /prefetch:1
      4⤵
      PID:8468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=12224,i,14653500115861844855,7161536841816675331,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18180 /prefetch:1
      4⤵
      PID:8492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=13144,i,15617573979942764286,3194260663329199106,2097152 --field-trial-handle=2192,i,14567934153698986242,2133949649633430503,262144 --variations-seed-version --mojo-platform-channel-handle=18872 /prefetch:1
      4⤵
      PID:8500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe"
      4⤵
      Views/modifies file attributes
      PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3552

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe
1⤵
PID:4240
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6cvwcc0\gws3d6wk.exe
  2⤵
  PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6452
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe"
      4⤵
      Views/modifies file attributes
      PID:6540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe
1⤵
PID:7068
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qmgfv6s7\2msbg6p5.exe
  2⤵
  PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe"
      4⤵
      Views/modifies file attributes
      PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe
1⤵
PID:6272
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5xn5yl\6qbpotgh.exe
  2⤵
  PID:6472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6768
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe"
      4⤵
      Views/modifies file attributes
      PID:6788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6380

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe
1⤵
PID:6536
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\80e81r60\ydbiq4t6.exe
  2⤵
  PID:6772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6756
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe"
      4⤵
      Views/modifies file attributes
      PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5084

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe
1⤵
PID:7060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvr6e6ow\wcw1el6e.exe
  2⤵
  PID:6952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe"
      4⤵
      Views/modifies file attributes
      PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7136

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe
1⤵
PID:4736
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wvweqyrr\brob4uqp.exe
  2⤵
  PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4184
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe"
      4⤵
      Views/modifies file attributes
      PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6936

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe
1⤵
PID:6864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zggg2hl5\ksfxjgsj.exe
  2⤵
  PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:460
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe"
      4⤵
      Views/modifies file attributes
      PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2900

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe
1⤵
PID:1552
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9y0mxhh6\t86kucl8.exe
  2⤵
  PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe"
      4⤵
      Views/modifies file attributes
      PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe
1⤵
PID:2560
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qz86ptbg\w7eowhd8.exe
  2⤵
  PID:7296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe"
      4⤵
      Views/modifies file attributes
      PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7724

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe
1⤵
PID:7780
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71uexq1v\bwuvblhy.exe
  2⤵
  PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe"
      4⤵
      Views/modifies file attributes
      PID:8188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7660

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe
1⤵
PID:7700
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\axrob70t\xj794vrr.exe
  2⤵
  PID:7676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7832
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe"
      4⤵
      Views/modifies file attributes
      PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe
1⤵
PID:7688
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\apm766on\qq5qsu9f.exe
  2⤵
  PID:7836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1216
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe"
      4⤵
      Views/modifies file attributes
      PID:7820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3972

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe
1⤵
PID:708
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iow9d7ix\558n2v3c.exe
  2⤵
  PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe"
      4⤵
      Views/modifies file attributes
      PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6124

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe
1⤵
PID:4972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n1xvasqq\rlkzracb.exe
  2⤵
  PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe"
      4⤵
      Views/modifies file attributes
      PID:7552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1952

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe
1⤵
PID:7016
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2n1ztxzz\3trkeovw.exe
  2⤵
  PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44y9u855\ehtj64vt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4956
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44y9u855\ehtj64vt.exe"
      4⤵
      Views/modifies file attributes
      PID:7552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 280KB
SHA256 fd5cd5d4564e179dfd88ffdc8f19a512715083250b9bd17ab65b12084dc8e82d
MD5 57c82fea5be2d986d05eb929d141b333
SHA1 815f64c06bc2f39f97d7e3695ec728dfd42336dd
SHA512 48e1d367dec8fa72b2bfe0eb316ce65d614282540c0899f32e7ea394de4bf427d6a70b53129491a14a0546e5024f56264c619658433612d8393fc21ab50c27b2
SSDEEP 6144:zPg/0+vqaW3pGpYBF2dbRfFILA3CkKqcUTCxdGwoDaeB01HY78:z8h2BF2dbRfFI0bhTUADDN+14o
TLSH
T11254233EA4E9E2406498A5C867AE4F8550FF4601DF5F7B0DF6BA8051F3228D143A5EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 205KB
SHA256 cd57284edeb7b3bac83dea9ebaef9289d0422d3c7009eed8cedd5e1dcabe57f8
MD5 a7fa95fe9e9c41d2328d5d820e5c127b
SHA1 eb288f07b2761be375e6ebba266480a983a36609
SHA512 c51aa85f2cf17bb0c1fb31ab10aac2300b2a04daca03a791a8c91341716cf6be5eeb00bf948fb6f858171e8451b7f09b63852a77af33da70029640e1c50d8ad4
SSDEEP 6144:ij8NBNT44hUIsB977SKEGF6wrhUfIkEjYADcq:iANB544bM1eKrVmfI1HH
TLSH
T1B12423240D61BA0B92F834C41D286C992C9AD1FA79453F15F48EAD1AED2C3BF76C1ED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 43KB
SHA256 0b14ab9d0e4863752717c058f8c982eb4d624d5e39216664f57d4aab98526dd0
MD5 a24f60462094703b479746602f6ac25c
SHA1 952042cf719953b7ccfb796cf11cf5034d9171fd
SHA512 625030ff305be05987ab67afd6a9c7802c122fc7e8c374acad8ce247ab3ceebb852a4644372429c702cdd59714879f12f57ab06ffdec30024713e50549589a75
SSDEEP 768:6hy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30/3M4ITeCbFhd+:6hyqeUG44t6gecNW+o30/Lqeb
TLSH
T1D5130222F3204A2B382226EC580CD1851E0EFFD0E5562CD1C7A96C9EF5954F34AEB4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 67KB
SHA256 a457ee61b768bcf163dbe76c288b34757348482b36a3947945a3a328b2a7d04b
MD5 12348749e2880973531f8a372b6b11ef
SHA1 e45ad76d630df1f310993c20a05e6583940c14e1
SHA512 8924988ea11ce84822f6b838527095ecac8ddaee0a8a8b9843e2e6239a53275da2a814a5dd92ff40f6b1d525b3ca5a0e9b53ab5d09308ad3cac0d19de2493481
SSDEEP 1536:4tDggvovvcfrJxb1MO6xgRpcd8R3FjlsuR+vb7gP4u8f9/hB8HI1:Agcovvc9MZgXjKC+j7gP4795+s
TLSH
T11A6302BC9BCECE5530ACCAAD543D594ACE96EB710A0ED183DE2D468CF147670A37148D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 158KB
SHA256 b352e4f1729802ca1abf2b130e9c421c54f3fd39ba280fffbab247c121db901a
MD5 048b9248b1bf0ca9a0c218029544f853
SHA1 087681340f9d3ffdd4995324ab231a60523bc33f
SHA512 25cef35daa97236d9075380e53c2c18f33a53892dfef764cb42647472f70217c9d6d21c08c5de036893581f010efcfc0c8d3a68701ace587e4ff2d7004d55763
SSDEEP 3072:s4SzrleBAAmXxojKh2cauRn37QZg9YMXQnha4A3FcBX1gRO1kwsATq24p4t3I:s1zrwcxM6HN37Ug92l6qq21bur6I
TLSH
T1E4F312F30DBE983BA5F968674239E8DD235F94F52EF254A0DB4A0E8184C831C45B95E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ddd737253ffa6a8bf7b3613d26b11b40106fb6cea888a3e173bb34a8c5cafc36
MD5 cbca3a2bac9400fd6319d8bd60299e44
SHA1 f1d02cc8da191e282ccf9a2cc9f0fd521e323674
SHA512 f9731de52daaa69932f83cf146a0c1a6d9c85c1f750865e1cff706aa686ccea114a6ffdf69793900b39c12bd69e88cd97c138c3a695217083b61c6bc0c01c772
SSDEEP 192:sxRGReCZ/fvsX/bkzoA8pMY5oF5Hg6+WNs289SgZYB+7lq2us/GSIgVmJ:sxRGHZ/fvsXjFKT5ibZvD0
TLSH
T1BF42DA166938993B5CDBE31DFA15BF67E3F9502291D41E98ABFC8A1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 98622d76d73337c7b049265d39a76b01ccb5b488e43db534e6fbbfcf7f30f5b6
MD5 dce8f4fd99d205c698284b9448323b1b
SHA1 b6f92f98d0683b4ce680c75dcc69c450328729c5
SHA512 603dbb71cd1c9773c0d72ec89277d4f7fb2daa9fafe40da57aba5adb87a592710f94684c8f075ebeb780693f9f28d39453dfa4cd35047e5dc8d2806a138f4606
SSDEEP 192:sxRlReCZ/fvsWA/2kzoA8pMR5oF5Hg6+WNsiyF+ndSgZYB+7tDr26s/GSIgDxzJ:sxRlHZ/fvsWA+FpT5E27Z9UD3
TLSH
T15352DA166938993B5CDBE319FA15BF57E3F9502291D41E98AFFC8A2C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b621eb113f2261c7330998676079346f652b0d5bb99e8fd4f848500f3532c32e
MD5 6c2d4750bb61875c95c80bb0c9246190
SHA1 03f38a359bac4be6c077e74380d16e54c26cc2c7
SHA512 4c3375c7dc1ccf7e556de880c56dd15bddbb8421ff9f2d046de004c18d62954e1b8cd8b0001ba8c3ee38ed376cb56cfc61b4276367d120cbe42b62379475c47c
SSDEEP 192:sxRlReCZ/fvsW7/YkzoA8pMx35oF5Hg6+WNsiydSgZYB+7Sq2us/GSIgDTqJ:sxRlHZ/fvsW7gFSuT5E7ZKDe
TLSH
T1C842D9166938993B5CCBE31DFA15BF57E3F9502291D41E98ABFC8A2C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 245dba288b9eef4c9553925dc05193f4ccfb6039ce20e51623c963e3bbf138f6
MD5 4d64b58f430961cf1822b54ed5ff5877
SHA1 70aec9ac489c1787c9155c901d424b7d7722361b
SHA512 ae9ed25e3ece456af10ef306274a96b18d1bfa2c56f89a03e170b90f67305ac3052f872b8e17e42cc4d569ca01553416139b0f1837bc6037d922e66629011427
SSDEEP 768:ky2SgS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVASV4XroP+o:ky2SgqE7evWgd5f/bu1jaBU4EGo
TLSH
T197C2CA7B640CCB7F4F804ADDA8197F9A6DA802CB96D8CD8047FE951C03C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fb8f6450da8be404c6398049b53cedaefedd1e2249f09b816bf54b3f58199e54
MD5 0cca5c36610d4f9bf6d046ccae1fcb37
SHA1 fecdbccef90461d20d9b4ea37540c3f49da55a2a
SHA512 900e3154832234fb5979adba80db624fa9df2a008fda6527288681b62d56b7e7ab7ed6943cb254aaab9daa046270c25aa0aa3e3c58a49d1d7a294867c36a9980
SSDEEP 768:/rv+4UNbdq36IqiLjAAam6aQMGdjWca4GhfB8PeU/:/bsbc3dKmaME6p0H
TLSH
T170F2AE31A86C9573DDB7AA99F21B6787BFF021A385D40E84C9D95B0D439708E2307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d6c724c882ea5519faea8e138ac8df61f668bccf07ee771cb0aa09c6bb94d973
MD5 f6908411883e18cad836e3e46616d81d
SHA1 c73a0b9e67c07d9625ecc252f55982c0bc355213
SHA512 0e83237934f037720e10c087fa3f6e7058b096d2ffea7726064715b11bff8b5770a2b5f792733c6e495ed2acbfe26bdac4c6dbaa2f692a28122ba4470550b6cd
SSDEEP 768:JD36jmnXtqiLRLdiAam6aQMGdjWca4Ghf9M4t:JD3znJMmaME6pMU
TLSH
T1CFE28E305C68DD739CEBA255F72A3687BEF0517388D84E84D9E96B1E029318E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 28bc16b7eeffb35d4ccde4feae527fd8d822a2dcce867c7077e678d5e1a86c99
MD5 4b3e13f80bb9284d2fee336bcc8f0ef9
SHA1 5e889f571d38b05664f64aa1f492fc16f1da8a5a
SHA512 f36e00b4530d8dd5bb1ef4e01163b864c2b0a92e5aab471290647fea5c6ef18637e71da5ab35dd8d9fb0e88a477878fe8ccff567ad687d4b2a8965a49fdec09e
SSDEEP 768:JZ36jm3Q3qiLRLdiAam6aQMGdjWca4Ghf9M4t:JZ3z3WMmaME6pMU
TLSH
T127E29F305C68DD739CEBA255F72A3687BEF0517388D84E84D9E96B1E029318E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 144649061a643f704da8b8db5cece45d77eb93015618d0f313629e6b0af0373d
MD5 9ef37b984938237b3e24be1aaf58c2a0
SHA1 13145b1bb026d15333999de6c7028ac993d8feb7
SHA512 64bb021a15ac3af2f6cf7fa5e937a96d5a31feabaeb537916606c91653ca9405020dafa728d985135d86c4f6142ed22f61d8cbd526e9d787b810e1acbcf9b4e9
SSDEEP 768:9Q3rjmauXqiLRLdiAam6aQMGdjWca4Ghf9M4t:9Q3macMmaME6pMU
TLSH
T118E29E705C68DD339CEBA255F72A3687BEF0517388D84E84D9E96B1E029318E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e869b3c07ad0f522eb83ebba19f9db8a8b7d5868a5a85eaabc3fc50026c9b074
MD5 9b32b9a17880a1e5bc19af37952d8563
SHA1 101dd897dd84b10ea4440d212c79d6f36d271716
SHA512 74daea3a25f29bb2521b692d428fff914904614c526c392052eb46205c540356750b5ab93379672474bf9a54846aaa05a16f8aa94d615d74d07721854f77a795
SSDEEP 768:9K3rjmHl5qiLRLdiAam6aQMGdjWca4Ghf9M4t:9K3mHPMmaME6pMU
TLSH
T15FE29E305C68DD739CEBA255F72A3687BEF0517388D84E84D9E96B1E029314E2707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3f2bab3d0f8ba1a5d35f061e32d51bf2bffa7b9bdb5b83d79ce045f6ee029e6d
MD5 cc1ece77d0ba28afa8e9e26a41940eb5
SHA1 177c69ca462d412be7f1f6b2503c589cd2eef757
SHA512 cc17d531e4db218bd9f73edcbd27ce8ee99af8771ed3819a62503837dbb423649f176a05345e9d8d16b70895941eae3f7687c8ad9b4b9ae2c6ef0fdac40935db
SSDEEP 768:9w3rjmmJlqiLRLdiAam6aQMGdjWca4Ghf9M4t:9w3mmPMmaME6pMU
TLSH
T12CE29E305C68DD339CEBA255F72A3687BEF0517388D84E84D9E96B1E029318E2707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 c3fd39e79c57d490c57945e5ce715800801b5e624d5662efaa761d768c5575d7
MD5 b6cc76b04650dbb61cf9ba15d588cfb8
SHA1 1b402d650fff60d69ba2a138c3bd11d937892c93
SHA512 69b9d5075acc12a542f76a699dc70a7c0388d55f6b8fdc86efcbb9612903a3209824caf4376ecc81719deb25b4357a440a0dabb80ea6d33d657d91da95fc068d
SSDEEP 768:9Y3rjmAr63qiLRLdiAam6aQMGdjWca4Ghf9M4t:9Y3mAr4MmaME6pMU
TLSH
T143E29E305C68DD739CEBA255F72A3687BEF0517388D84E84D9E96B1E029314E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 87cd48926c52f829831dd7f9c3de39c2a8c0320aa8797edc81ca2060840281f3
MD5 cdaca18980eaa5d3df306abc3fe0cb72
SHA1 42c09af40b72a7217e6f4a94c07142592f2f06ee
SHA512 42661215ab6ef16994fe937f30fa4d54f86203768315e9694a93979660c56e328df0de7e82d4403df5f56fa924372e18d05daea88389706a33e3818211531415
SSDEEP 768:9D3rjmjgTqiLRLdiAam6aQMGdjWca4Ghf9M4t:9D3mjSMmaME6pMU
TLSH
T1F3E29E305C68DD339CEBA255F72A3687BEF0517388D84E84D9E96B1E029318E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 857ae024280beba0920807ba689b0a82864abc7417b0569a1b4d33c5f762ad5a
MD5 610ef2ce26fa5cc58397deb679962daf
SHA1 a337abb81036fe844706c50ece74659b5b8082f3
SHA512 e6835e12ad993f9c807a48d6d3bf25c77606ebd94ed3b79c6741b82ff731ba377db9e7ba6268cb831eaa75d60799fb0c1bebb03772c93c1bae3bc66bd1bc335f
SSDEEP 768:3rv+4UNbd238jmhXtqiLRLdmAam6aQMGdjWca4Ghf9MPxUQ:3bsbw3BhJomaME6pMx
TLSH
T1A6F2AF31A86CD9739CB7A255F35B7687BEB011B388C80E94D9D96B0D029718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 afa0ce199b88fcf254eaeeea28f87bc600f1fcae2cb2ea48621700aaa581a996
MD5 9325ca15991332fbdcd608d26b08fc63
SHA1 79fafb01aab16a8e5d80517ebb970a24b6cda75d
SHA512 7d67ef61908cb143f3f991a0ba00678b2cfda407f9c5b3afcd5940b04d9e26bf92bfd29ea028dfdb574df11043b304a2fcdf82dadacc0edb8ea2dd84427baa6c
SSDEEP 768:Grv+4UNbdq3AA/qiLRLd0Aam6aQMGdjWca4GhfwMPeU/:Gbsbc3AGWmaME6p3H
TLSH
T1D1F2AF31A86CD9339CB76695F21B7687BEF021B388C40E94D9D96B0D429718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c170f775ca0100b100be2f0325cd77bd72739c4f979baa90526386e407ae2af7
MD5 e3101981e33d444624376f1de82a49a7
SHA1 6ebe34745a1593cc1442d1921b6bf02e1a6ca4d4
SHA512 10b350b125257f609df10a34256ceff3128a0b6b02fa79c35420d03c94850e5e397ea7fa8a66260cf6f7cb05e726f93526837c0f32f06d088f0d965c2ffcabbc
SSDEEP 768:Prv+4UNbdq3o/xqiLRLd0Aam6aQMGdjWca4Ghf9MPeUQ:Pbsbc3o1WmaME6pM4
TLSH
T143F2A031A86CD9339CB7A695F21B7687BEB011B388C40E94D9D95B0D429708E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 3KB
SHA256 8b7af597460b31c5eee5d6e119dd3d7f05360b2baa0e56265b1a08b4d7e39df4
MD5 35f89662ce48b00a59a856def9b9e931
SHA1 0a78057d68161abeb9b914e021ad299fc79c6beb
SHA512 d779a339d0aaa171f6f1774a0d4c16d599ca3155885525a666280b272dfc85d83099d4cc7ccd457046dcf648cc2605bfd7c0c705489916111cf777ed80359dfe
TLSH
T1A8515CE371D53E3E599E7AB10C0E4DE20D488420B09EE04AFD4127EE03766A7189C994
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI56082\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwfi9x09.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nuk9a6s8\gwfi9x09.exe
Size 5.4MB
SHA256 800ec8f8d3c34929f36cbddabe7fb14ce7ab970b0932e697ddd4430c5a25dc45
MD5 82fc0353c96e92e365feb73677672ea0
SHA1 0dbaa722e8a4dcb8aac114c6213754f721640fc6
SHA512 0aba4d9f154ef5e3774093af3c18040ed99cdcb091744335379b2056b3c86f3c8cfff8fcb6197ea12df28b23949adc5b7e22ff6d92e293d45a9d7e69fd7d5061
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRQ:OrICteErownP0oTcMsABqlaOz6
TLSH
T1D3463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads