39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447

Analysis

max time kernel
3s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
Size 5.4MB
Sample260821-h33fjaac39
SHA256 39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447
MD5 e956434b7114a499c2774e0cd2b8b739
SHA1 8e37d5bd84bc7c83a973154bc73601f55b4e7d15
SHA512 a87aba56d25597940cf2f2ba6b165baffd9db6ecdcda9941ca9339161b9d517d70eb983cfa6a0a4337de9e052f89f9b8b028fa945b4472954d6fa342b088c873
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUi:E+ICteErownP0oTcMsABqlUutvx
TLSH
T17E463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hejgsk.exe	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hejgsk.exe	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe

Loads dropped DLL 12 IoCs

pid	Process
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe

Unexpected DNS network traffic destination 34 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\xy23qkyc\\75e27ftj.exe"	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2540	ifconfig.me
2575	ifconfig.me
364	ifconfig.me
239	ifconfig.me
258	ifconfig.me
325	ifconfig.me
1477	ifconfig.me
1592	ifconfig.me
2794	ifconfig.me
2894	ifconfig.me
207	ifconfig.me
109	ifconfig.me
1028	ifconfig.me
1526	ifconfig.me
1759	ifconfig.me
1801	ifconfig.me
1923	ifconfig.me
2473	ifconfig.me
1128	ifconfig.me
1658	ifconfig.me
1805	ifconfig.me
2617	ifconfig.me
2858	ifconfig.me
2963	ifconfig.me
165	ifconfig.me
398	ifconfig.me
3022	ifconfig.me
110	ifconfig.me
151	ifconfig.me
1315	ifconfig.me
1446	ifconfig.me
1511	ifconfig.me
2672	ifconfig.me
2882	ifconfig.me
90	ifconfig.me
468	ifconfig.me
504	ifconfig.me
2177	ifconfig.me
573	ifconfig.me
732	ifconfig.me
943	ifconfig.me
2425	ifconfig.me
403	ifconfig.me
181	ifconfig.me
1	ifconfig.me
2199	ifconfig.me
2634	ifconfig.me
2781	ifconfig.me
187	ifconfig.me
233	ifconfig.me
452	ifconfig.me
453	ifconfig.me
984	ifconfig.me
1026	ifconfig.me
1255	ifconfig.me
3046	ifconfig.me
134	ifconfig.me
1264	ifconfig.me
1740	ifconfig.me
2104	ifconfig.me
485	ifconfig.me
566	ifconfig.me
1338	ifconfig.me
1504	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6532	cmd.exe
6164	cmd.exe
2536	cmd.exe
6692	cmd.exe
7188	cmd.exe
10284	cmd.exe
5356	cmd.exe
3680	cmd.exe
3096	cmd.exe
6452	cmd.exe
6988	cmd.exe
6568	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2648	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3100	msedge.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 3256	6028	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	89
PID 3256 wrote to memory of 2536	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	90
PID 2536 wrote to memory of 720	2536	cmd.exe	92
PID 3256 wrote to memory of 3100	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	93
PID 3256 wrote to memory of 4536	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	94
PID 3100 wrote to memory of 4880	3100	msedge.exe	95
PID 3256 wrote to memory of 2556	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	96
PID 3256 wrote to memory of 3732	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	97
PID 3256 wrote to memory of 1712	3256	39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe	98

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5920	attrib.exe
6512	attrib.exe
6648	attrib.exe
6588	attrib.exe
1644	attrib.exe
7044	attrib.exe
6736	attrib.exe
7248	attrib.exe
720	attrib.exe
3680	attrib.exe
2936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
"C:\Users\Admin\AppData\Local\Temp\39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Users\Admin\AppData\Local\Temp\39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe
  "C:\Users\Admin\AppData\Local\Temp\39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe"
      4⤵
      Views/modifies file attributes
      PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x34c,0x7ffd1d33c188,0x7ffd1d33c194,0x7ffd1d33c1a0
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,8632397096740302132,5208994479012274774,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,16509494741899619046,13059690588744520620,262144 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,14819519530608348199,562326549343372980,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,15958654981605725793,4366704980290843536,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,13475822990914488953,13117808760267112477,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14970030229539256059,6417829626783958442,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,416767017234776118,2119524574573871609,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4404,i,8256281803558605403,18435145336482100942,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4704,i,15969346692787021466,2602826658548769432,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4900,i,4968058854298689626,11178438868166535802,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5024,i,1190721378684072352,8168017748552405830,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,7749731091157947897,11579135335240701096,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6116,i,5170085810355581050,3163759823908068478,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8404726450399425778,15488954372864378138,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,2322443955435114178,7320729047190733815,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6592,i,9338606974983163668,12079121960744204575,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6776,i,9858390582124955198,14594741058476922549,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,9058454733784833265,8611486934362479812,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,4539286570765423148,17713898928684672310,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7520,i,9492528242879023277,12246166692945866187,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,9058454733784833265,8611486934362479812,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7724,i,12005311395984645356,17978637024825826659,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7788,i,7854635568120126936,9849277937537917971,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8100,i,17666640625917946268,8683667035603334977,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8428,i,7099547535308244957,5276685363013726906,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
      4⤵
      PID:7056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8320,i,4714309336619376513,8672522575035584264,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8560,i,7703484030782779924,13627859754691553455,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
      4⤵
      PID:7020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8480,i,6349900927889582549,1901802984220297968,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:1
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8352,i,10361476315144821078,9234186316847441710,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8540,i,15806979063408791636,10173252169598318340,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
      4⤵
      PID:7064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8716,i,220367328815118845,4854922900483399484,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:1
      4⤵
      PID:6996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8484,i,2424550103357280629,6147393342967281479,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:7072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8440,i,5820158536514922653,5665131496438906063,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8696,i,1124468828289792510,7449077354849702863,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8348,i,2526205425439397689,2965031176729328759,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8744,i,6840811791054664672,5928258196356120382,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7376,i,5793396700532568632,8646714767536379152,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
      4⤵
      PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7436,i,8842009920942175018,16934149084718424340,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7460,i,8172547411329830388,16366787124624835939,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9032 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6020,i,2464292937713816112,9856091668813362490,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:1
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7476,i,4656450556627937430,8865899587582022737,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7412,i,4629515468593859124,16955934564291433610,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=8992 /prefetch:1
      4⤵
      PID:7148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8044,i,12015008480485290314,3058319121524050775,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:1
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8732,i,9569798261313119850,16881263569814035083,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8812,i,9479861716200641879,12509745248609264212,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7380,i,441625439884569094,10708598231288097948,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9236 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7404,i,11011270840282067445,5765168106321032497,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8768,i,14490787607011673000,3368373094120462136,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:1
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8820,i,3774772593065494832,13723604272133098256,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9244 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8660,i,7445157527956305109,17089140522096981045,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:1
      4⤵
      PID:8128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8904,i,14896032787336861804,14143973860242926949,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=10888 /prefetch:1
      4⤵
      PID:8112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8932,i,16367056483066074483,11420065579942157665,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=10892 /prefetch:1
      4⤵
      PID:8120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8948,i,9629423419941985867,6162525483552424494,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:1
      4⤵
      PID:8136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8828,i,6985845666646848737,13047503522084554412,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=10920 /prefetch:1
      4⤵
      PID:8144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9656,i,2553359786035417517,4261741700060204011,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13216 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9808,i,18102671766594272029,6037122232818498210,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=12932 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9828,i,3404521652802036327,795114449008577500,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13244 /prefetch:1
      4⤵
      PID:7200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5612,i,9588308447524203957,6583024452573928922,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13204 /prefetch:1
      4⤵
      PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9840,i,11844381581120902954,3738601941568421059,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13352 /prefetch:1
      4⤵
      PID:7264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9748,i,10413597203104955592,4461060950581216061,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=12848 /prefetch:1
      4⤵
      PID:8172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9764,i,4361653743002875656,6724656609765510749,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13220 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9712,i,4883554284043524730,13347227609239329708,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:1
      4⤵
      PID:8188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9844,i,15647481898317859533,2136748156274460919,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13376 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9920,i,12632376294694485762,16037842515049414472,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13412 /prefetch:1
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9992,i,13211403818043998712,6781737359325822371,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13504 /prefetch:1
      4⤵
      PID:7232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10072,i,12848555671909943744,2147261635225010184,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13608 /prefetch:1
      4⤵
      PID:7272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10056,i,357257267054055274,5752177718616003716,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13604 /prefetch:1
      4⤵
      PID:7304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10088,i,10863397379957052650,2466201214634915830,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13612 /prefetch:1
      4⤵
      PID:7308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10128,i,16395402349527621022,67524421274529848,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13624 /prefetch:1
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10160,i,16668585555493327891,3678436680316179242,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13656 /prefetch:1
      4⤵
      PID:7328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4420,i,13205480792965020053,4432024027359390981,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13356 /prefetch:1
      4⤵
      PID:7256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9848,i,3828034718965562834,1992977931520257669,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13436 /prefetch:1
      4⤵
      PID:7248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9924,i,7897926693725951073,13804095138493237343,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13388 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9976,i,11017735736214650246,9027427537035902535,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13468 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10776,i,9729651859196533553,1138204518516826995,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14408 /prefetch:14
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10012,i,3976939477440964701,6892693506802720216,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13508 /prefetch:1
      4⤵
      PID:7284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10144,i,8975451874560050528,5727318147070868976,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13636 /prefetch:1
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10220,i,356341626027076771,16281605060100881038,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13856 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10192,i,9226885602002211279,13322444071001134740,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13848 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10252,i,6262920543515168983,13980278207229358183,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13860 /prefetch:1
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10268,i,2791731715424683877,17196494761342986499,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=13884 /prefetch:1
      4⤵
      PID:7384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10288,i,17370824032142342375,15089836280950298344,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14040 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10464,i,15085377323548147923,15613082326615260816,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14152 /prefetch:1
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10340,i,7605414324109940498,8254197878251729583,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14140 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10524,i,812339951096722092,1089834226722342159,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14160 /prefetch:1
      4⤵
      PID:7488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10488,i,639927262306413661,16116875704281099774,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14180 /prefetch:1
      4⤵
      PID:7436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10620,i,4399895096206983432,5283759784337286067,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14232 /prefetch:1
      4⤵
      PID:7448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10328,i,18437773367988812835,2858239137026537168,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14044 /prefetch:1
      4⤵
      PID:7408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10392,i,5229051159045738558,3502030920579639410,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14060 /prefetch:1
      4⤵
      PID:7368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10344,i,15098937738937454698,6738078460273029543,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14048 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10404,i,13228546090755362447,3897662194944580308,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14072 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10432,i,9864036269088447563,2279608021560204514,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14092 /prefetch:14
      4⤵
      PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10780,i,1351099790804528841,5195062521154280979,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14500 /prefetch:14
      4⤵
      PID:7464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10648,i,4263426510732986690,9370178790478523639,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14252 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=1404,i,12014055913238171176,4682653239584237274,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14280 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10556,i,6983568758032894717,10367791595255523686,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14212 /prefetch:1
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10572,i,904845100402314109,1902044142392053920,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14192 /prefetch:1
      4⤵
      PID:7584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10660,i,15068791850579990245,8549750976539329287,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14024 /prefetch:1
      4⤵
      PID:7628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10724,i,11236150010575360408,17485786919876555692,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14416 /prefetch:1
      4⤵
      PID:7596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10784,i,15828219931862567478,9806030949025980626,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14728 /prefetch:14
      4⤵
      PID:7636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=1420,i,8671223000077031454,7031924668223299676,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14300 /prefetch:1
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10692,i,16229237383898357050,13622524145363104579,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14260 /prefetch:1
      4⤵
      PID:7608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10768,i,10891420861218872231,1291601809252739484,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=14412 /prefetch:1
      4⤵
      PID:7644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10816,i,7016489583799615909,17839392511744451128,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=15008 /prefetch:1
      4⤵
      PID:7560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10836,i,7411523173652457534,8021362409299957422,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=15012 /prefetch:1
      4⤵
      PID:7680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10856,i,15746633977259813637,12878200928743431394,2097152 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=15016 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20640,i,1946521943633600910,4540654348181765924,524288 --field-trial-handle=2292,i,715480937024941029,5832293274359653266,262144 --variations-seed-version --mojo-platform-channel-handle=19016 /prefetch:12
      4⤵
      PID:10312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe
1⤵
PID:1776
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe
  2⤵
  PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5356
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe"
      4⤵
      Views/modifies file attributes
      PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2260

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe
1⤵
PID:2276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ge3ts1k7\mlshnvoj.exe
  2⤵
  PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3680
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe"
      4⤵
      Views/modifies file attributes
      PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1708

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe
1⤵
PID:5080
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7y6znfwm\8vwwimmf.exe
  2⤵
  PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe"
      4⤵
      Views/modifies file attributes
      PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6188

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe
1⤵
PID:6280
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e9xkmw0\dm05yafb.exe
  2⤵
  PID:6424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6452
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe"
      4⤵
      Views/modifies file attributes
      PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6768

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe
1⤵
PID:6884
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3hygh05\2ee9bjce.exe
  2⤵
  PID:6956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6988
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe"
      4⤵
      Views/modifies file attributes
      PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6224

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe
1⤵
PID:6368
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6a4y5zcd\urz2fiwi.exe
  2⤵
  PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6568
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe"
      4⤵
      Views/modifies file attributes
      PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe
1⤵
PID:6324
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6sa0x3z6\az71jcck.exe
  2⤵
  PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6532
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe"
      4⤵
      Views/modifies file attributes
      PID:6588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6444

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe
1⤵
PID:6588
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rgq9pxd5\jjsl7bjx.exe
  2⤵
  PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6692
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe"
      4⤵
      Views/modifies file attributes
      PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1644

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe
1⤵
PID:6676
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2m47ujd\4k48jt21.exe
  2⤵
  PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe"
      4⤵
      Views/modifies file attributes
      PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2836

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe
1⤵
PID:4516
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7aqxax20\y6mnqgwv.exe
  2⤵
  PID:2832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe"
      4⤵
      Views/modifies file attributes
      PID:7248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7664

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe
1⤵
PID:7892
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2ytkn6pq\5nw05b74.exe
  2⤵
  PID:8000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xbz4964s\yqp80wko.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6f6b88adeb8b649d5c5c3c647228701a0c17ff35a6e1d38dcbd33b17f1554f39
MD5 95655411f23c128dd80f4afc0edf837b
SHA1 8406395b3d3bf0c3c45ffa8a3145305d4541e113
SHA512 87a369e8e5ab5698a9e33a7bd97bc001361c74b57c952254db9200a485cc0ed9c85f51cbc24bc531d695209f375f728c7676263855f647bd1713568d877bbe00
TLSH
T182412168877CDFCDDB940AB1BCF1D6843ABE98CD1B47EF80C4D41ABD4A02B9509A1193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d4da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d4da.TMP
Size 2KB
SHA256 ea741e91caf840e65b186874ed6a387b0949187856fdf80211bdb890e74996e1
MD5 34711c232e97389d09644a3173384db2
SHA1 4296da8cf8137f351e7ddaaeee089c8b833a2945
SHA512 831595fd4d533d507810e869cb20a3af858d26ac5b0b868ee69a63e80890148e122a186ef500bfc552b50c676a111753f8062ba516be143c3c6804a77234881e
TLSH
T1B7410D58837CDFCDDBA449B1BCF0C6943ABED8CE0307AE40D4A41ABC4A06B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ba9b61669653818b7c4ef1fd2022f892b082b86c97993d281068aea6b010ecc4
MD5 c56b51957a1ae15cdca9126f1f11c10e
SHA1 f3b4bb14789457ae6c2f9527cd9341b6aea8c323
SHA512 452615237665284ddd52b6b44228a07d9565fcdffad0188940f51387715a80735894094603b614b23e9447c95ce104116f03f4dfa7776fd5dec36a957dfb819a
SSDEEP 192:sxRK/yM/jK1Ml8wCX/f9sLrprQ5nzoA8pKUB/g6+WNsucF6y/YnYUFhbGRIgV+3J:sxRK58X/f9sLrDp/5yR/Bmo0Z
TLSH
T13062D816AA746D778CDBD209FA517B63D6F91473A1905E44AAFCCE0C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0abe15b812b1c3e39b6d0341a537f35290f510a24c2232593bb28e0b8f068f02
MD5 bb8a0b77a9f5192cc262d40343654203
SHA1 ed5483efa7bb32edef5cc5e7af6d1f3029a9ec5c
SHA512 acfc30b745499118d369e6cd69d0100218d0eea00a3c971e44d707376bb641b85657adb322fc6b8456d139b4baed6bf0b08fe5b7d6614d178deeb6e2c5e65b9a
SSDEEP 192:sxRp/yM/jK1Ml8wCX/f9synprQ5SzoA8pKM3rBFqHg6+WNsL3rC3dM8Jh/fYBnMO:sxRp78X/f9synA5k5oIpfftQo0Z
TLSH
T19572E916A5749E778CDBE218FA41BB67D2F51472A1D05E44AAFCCE1C00E7AED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a771b75447ed0039ca296c691bebf4f5da1456cef4450cc08d38c271d6eed75c
MD5 d1b80bf406c521438b1373aeb45a5911
SHA1 69fdb116a44b6d7d190e54ceb6fa50127dd12a5d
SHA512 fb33a03f03966a7e1f965a8ca0d82750483d307f456c97d406176299141adf08adb6a225929355015981e05652fadcf9aedc95ba94b981c914401d2f297b7616
SSDEEP 192:sxRp/yM/jK1Ml8wCX/f9syrprQ5RzoA8pK4B/g6+WNsucFC3fYn0UFhbGRIgDj+Z:sxRp58X/f9syrNJ/5yefdmouZ
TLSH
T1B562D816AA7469778CDBD218FA417B63D6F91472A1D05E44AAFC8E0C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2ebf5da7cef305fcd3d3ecf397f6722e6cafaebfa14c671dea45628f1e77c857
MD5 baee1f3442bb7fd9c1938977e7b01505
SHA1 c6f30d361f22af41ac0482ffeaaf2cec4a051f8d
SHA512 f8e1100d4846465657cd95d86af40a671c4caca40cf224b4ea014ef87b9b55af0ec3b9e89c9618ae1e83881090f7520aef5e1b239189d7859e34f28c246bb1b7
SSDEEP 768:wGedUg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YwroSU815s:wGedUsE7X6WgoufDMu1jatVYbS2
TLSH
T18AE2FB3B680CCB7E4F444EDCE829BE9BADE801CB5AD8CD5447EA840C03C67EB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2ed0baa3943eddc8c8890e2e8467ad6c84012d8e9caa8d74521919d1edd0f3bb
MD5 234a87b93cb525442549ac21afcd751b
SHA1 2df95a67803a4a3024e9fa899b5b2c329a6c2641
SHA512 7aea9e470efc96fb6a6d1d48f106ed4e188ff760a747656db648c1895c566454c672dddfceb0edc57d4fe30aa0d5241aa233470031a82708aa02f07948f2a7b7
SSDEEP 192:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhhY18bjhigtIx50HPoHpm3zBj3CH0j7JKA:4DjmYi
TLSH
T1A0D1E34171BA02403C7E694995E5886AA38174A13468B43F7BED02E64F6BE038FFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4ed42901f7f336b507fb21dd32b3b7a8bb53dac6efcbcb967c9b765fafb6cc15
MD5 467c33b7eba47ecf80b7d7ae77aa7f22
SHA1 d59d83203532ef8e84c2b09b72591d2eff3879fc
SHA512 dcdd41db3925221e810decf0a5d36a375ffcb97301cb1550de7614b6acdccad309cb162fe2ec3ac851aa690a7ec9a927c1c79e944e6094f14635648958637f21
SSDEEP 768:6rv+4UNbds3ZPDZIO0W/Nzc4ReyIsXqeVH1S5D:6bsbS3Rtc44bs6EH1Y
TLSH
T17703BF32E8788977ACE66785B54B76133EF8912782D81B90C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 05db6a6bf5b5b2e2dcd3c8513a467e2f71304379966ee1574d45a4b724ec4fcf
MD5 e67be354be9ffc5613580fb131db4a56
SHA1 51d830ee6225e3daf188ce2c7d7dd8f320f1afbb
SHA512 e35eedad4190c4bb011a12725da124f4013bdbe7aac46511264eba9578baf74dc5982821430e7b3dd29f3f1bf58ac20c18847048ea57e6d68ad9751e55d33a7f
SSDEEP 768:frv+4UNbds3DIDZIO0WhTkNzc4ReyIsPjeVH1S5s:fbsbS3sktc44bs7EH1b
TLSH
T1B803BF32E878DD33ACEA6286B14772537EF8216B81C40E84D9E95F0C4A471DE175F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 48784006845a7e28841b689daabc89412ae3b9baff94492e76ebd8cef635758b
MD5 d6e86a57cdb727c6099570a75382bd29
SHA1 69fbabcbef897c721e23375c4fee0768f69717bf
SHA512 b3cad86aa5fcb40ea6996e5be0eea95741e8db36c6bb3ffae30da4dcd557ef1605750ccb5d483c0997a4a25c0d22a619d715d686b1bbe3e7531b7c137a0e4b3c
SSDEEP 384:nZZcIS38N5j7qpXO/zQLCJDZNfNoXOVSUUWXnFLXoabmETRzcoXfK86sfxEZxxsn:xS3FXPEDZIO0WhT9Nzc4ReyIsPjfUqj
TLSH
T105F2BE71AC75DC63ACE9A385B6067693BEF5507781C8AE80D9DD9F1C08032DE172B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 83d31d25d6310af3c1a38acc7bb35bfb4e0ed35fc89350945bfee5e9fa5bec8d
MD5 9ede79c3aad45c9c02e08a44bc6569b2
SHA1 b4891dbae3a4685680b0e2718706b2bf2a4dc368
SHA512 0809bfb411993b1617d5dffff40e5081c875fb924c0a8061f0656c867eae55c52a2a91e99b50552f780bcd24ac2359da7ccf64cd15e66fda7ff525f9ef5009b1
SSDEEP 384:nZZcIb38N5j7qpXO/+JLCJDZNfNoXOVSUUWXnFLXoabmETRzcoXfK86sfxEZxxsn:xb3FXlEDZIO0WhT9Nzc4ReyIsPjfUqj
TLSH
T1B9F2BF71AC75DC63ACE9A285F6067693BEF5503781C8AE80D9DD9F1C08432DE172B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 80ce259c4aa97a99b5a52e94d83992dbbb5e633dc8f6a55d5b3365efeb1de229
MD5 e125ba14b25c98c054e30d4c08817c37
SHA1 f7bddbf31db22d2bf14d4e355b144523328dc196
SHA512 aaa35a8f501e1367d75a62dcba504d8e7578dd02a66bc86b6bec0ec9d95f32f3aeca71f2636a60a7d193a644c77595fe34d1a833eacad14f1495933a1ae4bb04
SSDEEP 768:nrv+4UNbdF3vXZ0DZIO0WhT8Nzc4ReyIsPjS:nbsbL3vq8tc44bs7S
TLSH
T1A603BE31F868DD23ACFA6285B20B7693BEF4216780C41E94DAE95F4C05472DE172F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e22107073fe11ffd466931d761f6aa3b68878e420c3053584a5a091e7d6f1df4
MD5 043b6536b8531d94f50caea1dc1275e0
SHA1 6db423c7a8a34d9325c7320c24bf170afefb860a
SHA512 d31bf9ba40e576cd08b029eb11ae14363400131d433168bc57147bdfeb6ad0a202b7504c23d2bb753232316e9feedcf22213f27280c9b3e0bded97103d5bca5e
SSDEEP 768:brv+4UNbdF3vXaEDZIO0WhT8Nzc4ReyIsPjS:bbsbL3vB8tc44bs7S
TLSH
T11403BE31F868DD23ACFA6285B10B7693BEF4216780C41E84DAE95B4C09472DE172F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a60cb3fc7bdbbb7cdc21877d7f441459a932135e9bd087708f0ea3c52ce996c7
MD5 85cf5d4b6b36a30d57dccbe020281d01
SHA1 90827845d25622bbe6cef74983a10c5b32067624
SHA512 9a1495323e17add45a40f68287df66b1469b5063d079b1f2368f65b52771fac14f223b86ec72e2f209a616c47cb5b19ff6ef27307a8b3243fc28147d37ef752d
SSDEEP 768:hrv+4UNbds3ryDZIO0WhTkNzc4ReyIs2jeVH1S5D:hbsbS3Wktc44bsUEH1Y
TLSH
T12103CE32E878DD33ACEA6685B14772937EF8216B81C40E80C9E95F0C4A471DE175F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f5dda9b5c4022754ca9bcfcc2318498aac411f4bee085cccffaf353e8b1fc6c8
MD5 e704816a613f8f88048313ffed431a6c
SHA1 92761b1c2b50b5c1b18bf1f78e752bca95a2e9c6
SHA512 6de5045105fbf0310ffd4cd7a9e50507fc9ea1676f63cedfb21be9218b94b3fab597feff710425bdd6d8500a724ffcb3fe6af0a177d7878389132ce61f1882f5
SSDEEP 384:nMZcIb38N5u7qpXO/+eLCJDZNfNoXOVSUUWXnFLXoabmETRzcoXfK86sfxEZxxsn:ab3WXSEDZIO0WhT9Nzc4ReyIsPjfUqj
TLSH
T105F2BF71AC75DC63ACE9A285F6067693BEF5507781C8AE80D9DD9F1C04032DE172B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 528bead038a0186bb61964c1f54ac87a70f5e5a04dcad5cd1f99f0d0defb9619
MD5 6795add1a88d006ae88ce22ab3289020
SHA1 a7ee22e7a3860f72cd48ebab2ce1b33fc28eaec8
SHA512 8a987ab29fe01f7d549694303c705327639cd8533d72ccbf94be315d2e395a964b77930c71068ad56dcc5062e112f8469c23c91f128ed6997d4be5092c8c2fec
TLSH
T1ECE00202A340047AC43C027010821B312761C01506D21347561002641C607401F30C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5999b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5999b6.TMP
Size 392B
SHA256 8ba6800b34b4a1bd68c2b7ae7e3a238aad2bb696241fe9049485f757555d9d12
MD5 3f53952c44bee506de663be382a80f8b
SHA1 17ca51109ef6690ad5cc4dbe037ca2b62e3496f3
SHA512 229fd7ea32f0eb800ac8e6ccbc6d47b8a561bd22365186473e1556afb361940d8a1ccd61253c1ac3a6942edc868a15014e311ce55abdb6aa258f15442e159ce2
MD5 SHA1 SHA512

Submit Download

0c55a552-9a60-44f2-8772-041e169d8f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c55a552-9a60-44f2-8772-041e169d8f0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe597f96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe597f96.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

6dd6288b-0343-4730-a262-128769c8daf2.tmp

Path C:\Users\Admin\AppData\Local\Temp\6dd6288b-0343-4730-a262-128769c8daf2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\base_library.zip
Size 711KB
SHA256 8a83ecc21cee6f9af303b2e03eb3b88cc86663455a6636ab288381ddc8afef2d
MD5 0440f4aa9429ce96e9dfe534a3bd4e2f
SHA1 523c84203b2889008830a00d813c1276cbb5835f
SHA512 f418b2d04b1f0f2b78da1a387ed6dc6bd46a2cff9a38dd27792fa44dbdfb559aa5464f9b41862db2d7d0801528d641c2e7c1961986cd214c5351cff6401e0a23
SSDEEP 12288:tHV0cfk10axJkldphcfyEFPl2osQNRs54PK4I1OoQDSDS:pV0cfjsJkldMfyEL2osQNRs54PK4I1Or
TLSH
T1F8F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60282\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3100_1580571604\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

75e27ftj.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xy23qkyc\75e27ftj.exe
Size 5.4MB
SHA256 39d2aa3d86f60bd5678bea429708f7010644f0b919facf56b1da98c17c8f5447
MD5 e956434b7114a499c2774e0cd2b8b739
SHA1 8e37d5bd84bc7c83a973154bc73601f55b4e7d15
SHA512 a87aba56d25597940cf2f2ba6b165baffd9db6ecdcda9941ca9339161b9d517d70eb983cfa6a0a4337de9e052f89f9b8b028fa945b4472954d6fa342b088c873
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUi:E+ICteErownP0oTcMsABqlUutvx
TLSH
T17E463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads