a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327

Analysis

max time kernel
6s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
Size 5.4MB
Sample260821-pp7xesem31
SHA256 a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327
MD5 92b8ac837f765f592c45352378724328
SHA1 4a9a12acbfbe41d5e70e5fb70d8196be6699b06b
SHA512 c4ec75b0f30c0a8c85c099526e5463529b1d76877ba9a44ffe2a554a7fb0477187751a6ee4af803c173e69a245b21114944c92e9a418349c672f5f185ef5d8d3
SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1b:Hdx2ICteErownP0oTcMsABqlqBnF
TLSH
T11A463308B3E809E1E9B3D13D85665221D573B4254BB0D5CF03AC9B662F777E0AE3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4973
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3657
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1800
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4011
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8157
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3658
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7236
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1883
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9510
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8720
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6071
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8336
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4963
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7102
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5060
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7257
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4211
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6948
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1367
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6256
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6712
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3624
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9100
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7579
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2155
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9877
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9676
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5719
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4478
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7406
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7509
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6665
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7325
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7469
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9067
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6481
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7586
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8488
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3181
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5303
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6806
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6365
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6628
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3933
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6219
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9624
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3453
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5922
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8493
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5508
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1208
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6258
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5150
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6610
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9467
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9336
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8204
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6772
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4530
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1574
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9309
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9195
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3781
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9190
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4124
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5135
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2375
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9438
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8681
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8499
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5436
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8851
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1733
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5393
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5041
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3175
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9359
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3764
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9367
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1102
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2448
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7357
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3773
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4304
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1502
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2910
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3461
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3761
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9712
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2926
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4977
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5960
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2388
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7078
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7801
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6223
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2097
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9863
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7601
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2576
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2668
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2545
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6316
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8734
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9690
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2262
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6277
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7802
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7921
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5432
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4620
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3592
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4182
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2039
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8548
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1898
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3042
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4474
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1861
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7127
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3889
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3245
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4590
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9582
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4915
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7069
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3223
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8234
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9977
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8717
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9542
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9820
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6016
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5545
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6509
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8538
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5760
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8117
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1604
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1716
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3908
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2037
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5795
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5588
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1850
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7498
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8021

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4727

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9718

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kikco7.exe	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kikco7.exe	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fg9zt9.exe	2t2xi3kn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fg9zt9.exe	2t2xi3kn.exe

Executes dropped EXE 2 IoCs

pid	Process
3472	2t2xi3kn.exe
1272	2t2xi3kn.exe

Loads dropped DLL 23 IoCs

pid	Process
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
1272	2t2xi3kn.exe
3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\pcv4psht\\2t2xi3kn.exe"	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\x4p1o1h0\\s908fufn.exe"	2t2xi3kn.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
909	ifconfig.me
1042	ifconfig.me
1397	ifconfig.me
1884	ifconfig.me
2330	ifconfig.me
352	ifconfig.me
146	ifconfig.me
241	ifconfig.me
243	ifconfig.me
750	ifconfig.me
760	ifconfig.me
1539	ifconfig.me
72	ifconfig.me
493	ifconfig.me
516	ifconfig.me
713	ifconfig.me
1693	ifconfig.me
203	ifconfig.me
264	ifconfig.me
993	ifconfig.me
1384	ifconfig.me
1507	ifconfig.me
2467	ifconfig.me
2548	ifconfig.me
915	ifconfig.me
313	ifconfig.me
476	ifconfig.me
538	ifconfig.me
1853	ifconfig.me
2212	ifconfig.me
440	ifconfig.me
429	ifconfig.me
6	ifconfig.me
522	ifconfig.me
542	ifconfig.me
855	ifconfig.me
1028	ifconfig.me
1495	ifconfig.me
107	ifconfig.me
153	ifconfig.me
239	ifconfig.me
925	ifconfig.me
1071	ifconfig.me
1227	ifconfig.me
1294	ifconfig.me
1653	ifconfig.me
1022	ifconfig.me
1594	ifconfig.me
1598	ifconfig.me
1648	ifconfig.me
1749	ifconfig.me
553	ifconfig.me
1856	ifconfig.me
392	ifconfig.me
162	ifconfig.me
222	ifconfig.me
304	ifconfig.me
450	ifconfig.me
543	ifconfig.me
1023	ifconfig.me
1768	ifconfig.me
5	ifconfig.me
117	ifconfig.me
200	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2188	cmd.exe
6332	cmd.exe
10980	cmd.exe
3512	cmd.exe
4176	cmd.exe
5636	cmd.exe
2628	cmd.exe
7024	cmd.exe
4800	cmd.exe
5548	cmd.exe
5780	cmd.exe
6788	cmd.exe
6784	cmd.exe
6340	cmd.exe
9896	cmd.exe
2224	cmd.exe
5968	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3824	2660	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	85
PID 3824 wrote to memory of 3512	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	86
PID 3512 wrote to memory of 2948	3512	cmd.exe	88
PID 3472 wrote to memory of 1272	3472	2t2xi3kn.exe	91
PID 1272 wrote to memory of 4800	1272	2t2xi3kn.exe	92
PID 3824 wrote to memory of 1596	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	94
PID 1596 wrote to memory of 1056	1596	msedge.exe	95
PID 4800 wrote to memory of 3412	4800	cmd.exe	96
PID 3824 wrote to memory of 4232	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	97
PID 3824 wrote to memory of 2224	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	136
PID 3824 wrote to memory of 4356	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	99
PID 3824 wrote to memory of 2108	3824	a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe	100
PID 1596 wrote to memory of 1772	1596	msedge.exe	101
PID 1596 wrote to memory of 2500	1596	msedge.exe	102
PID 1596 wrote to memory of 2912	1596	msedge.exe	103
PID 1596 wrote to memory of 2500	1596	msedge.exe	102
PID 1596 wrote to memory of 2500	1596	msedge.exe	102
PID 1596 wrote to memory of 2912	1596	msedge.exe	103
PID 1596 wrote to memory of 2364	1596	msedge.exe	169
PID 1596 wrote to memory of 2364	1596	msedge.exe	169
PID 1596 wrote to memory of 2364	1596	msedge.exe	169
PID 1596 wrote to memory of 3856	1596	msedge.exe	106
PID 1596 wrote to memory of 3856	1596	msedge.exe	106
PID 1596 wrote to memory of 3856	1596	msedge.exe	106
PID 1596 wrote to memory of 2800	1596	msedge.exe	107
PID 1596 wrote to memory of 2800	1596	msedge.exe	107
PID 1596 wrote to memory of 2800	1596	msedge.exe	107
PID 1596 wrote to memory of 4420	1596	msedge.exe	108
PID 1596 wrote to memory of 4420	1596	msedge.exe	108
PID 1596 wrote to memory of 4420	1596	msedge.exe	108
PID 1596 wrote to memory of 1100	1596	msedge.exe	109
PID 1596 wrote to memory of 1100	1596	msedge.exe	109
PID 1596 wrote to memory of 1100	1596	msedge.exe	109
PID 1596 wrote to memory of 3960	1596	msedge.exe	110
PID 1596 wrote to memory of 3960	1596	msedge.exe	110
PID 1596 wrote to memory of 3960	1596	msedge.exe	110
PID 1596 wrote to memory of 1472	1596	msedge.exe	234
PID 1596 wrote to memory of 1472	1596	msedge.exe	234
PID 1596 wrote to memory of 1472	1596	msedge.exe	234
PID 1596 wrote to memory of 1084	1596	msedge.exe	112
PID 1596 wrote to memory of 1084	1596	msedge.exe	112
PID 1596 wrote to memory of 1084	1596	msedge.exe	112

Views/modifies file attributes 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5352	attrib.exe
2124	attrib.exe
9792	attrib.exe
11632	attrib.exe
3412	attrib.exe
5620	attrib.exe
3440	attrib.exe
5272	attrib.exe
6932	attrib.exe
6796	attrib.exe
2948	attrib.exe
3796	attrib.exe
1048	attrib.exe
6396	attrib.exe
6556	attrib.exe
2004	attrib.exe
5844	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
"C:\Users\Admin\AppData\Local\Temp\a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe
  "C:\Users\Admin\AppData\Local\Temp\a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe"
      4⤵
      Views/modifies file attributes
      PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ffb29b9c188,0x7ffb29b9c194,0x7ffb29b9c1a0
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12278986824568334918,4086344498945484416,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:3
      4⤵
      System Time Discovery
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2627534481764202411,8266445834009987497,262144 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,7529958278049971136,3869824674659531647,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1133496463932225785,16108980087575167847,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8700067518404884903,13137406000048956418,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,17572447832701805936,14988805597269689963,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3135194074537159373,10487902224175811238,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4620,i,12832553429720612826,5406284564221043106,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4876,i,2734633436544918156,10667098549274021426,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4916,i,3491294203067666645,11164058021327363623,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5168,i,8258627644042896978,3231975154826755537,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3504,i,1206931013144624706,3674267362220795246,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15433891342219327029,103384260764248222,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6060,i,809565420004491216,4535554953158653331,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15975588653359579653,14670610361829792101,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6432,i,15380062245963984123,5801305378381618316,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,167703775240806297,17019736873557147286,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:8
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,167703775240806297,17019736873557147286,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:8
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5216,i,18138018777288552475,1511440710649006475,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5716,i,2319034595576176494,8968152687904750844,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6620,i,8321806419929559057,9126530694154636570,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6580,i,12729765548020145444,8260247964896367332,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6644,i,4183203738552482705,5598772423446960808,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6604,i,6448950120058135268,3995432708920844153,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7320,i,6361892815742719792,12561634303082478209,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7356,i,10002871941971701610,1576508004764012134,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7412,i,14666969617051401659,16742689028890037833,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:1
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7376,i,9254573603696603921,15731215531315092963,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,8305272014941196141,2485008787097487667,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:8
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,5816821487839787063,11164345644812186688,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:8
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7308,i,14125359162393761170,15863100337432942133,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6688,i,7130829373008519889,3500698466511339983,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7284,i,10325690824899947394,17790546902459506472,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7144,i,12737128384029667503,226471824825676864,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:1
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3224,i,1225515344851198780,5873630281806531115,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6956,i,10123739574679511230,7195824076900780840,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6976,i,11671372331776435332,7526363646304967267,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7008,i,1534418365549028345,14760750405717799732,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6676,i,4920343098034066892,5680428451230289393,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6868,i,480863633823192014,18010132426695644507,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6784,i,18405295089382257448,5326188049545665080,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:1
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6828,i,8296727181884369859,14076283156366580552,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,10689274760652788314,2898822899200648826,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6888,i,15206631259913031778,15612393418697809025,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7824,i,13370538888654377532,4541166196085762684,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7912,i,4538226956655854610,11565241881374282737,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8016,i,10066549680962217179,14574649916446252321,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8032,i,14422363786960980363,12750912557990649440,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9508 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,16685454322468224146,15829504424412494563,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8076,i,8901107268220146521,17175489334181388851,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8096,i,8536135647289736303,17853193549853003123,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8148,i,10364571577386185492,6229186673675022036,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9596 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8060,i,14129891159750228847,179370968625744470,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8180,i,7922462715471713150,15202305439818191258,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8212,i,10500799321668636705,13685339052817829870,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9764 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8280,i,10465361313215181561,11585418146148919112,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8240,i,7258417471728470756,11238760874919407485,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8312,i,2951803954423049849,1630890303649953237,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8316,i,4131378610682392954,12304532204815984087,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:1
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8372,i,15735475639714068180,3002616188587641723,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8348,i,7098231909276092925,9773014036762867809,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8480,i,16705411994453323352,10392754336456215431,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8408,i,8482054593827218362,17734225658697164606,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9988 /prefetch:1
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=4920,i,13305966842949486512,3631931421061639789,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10220 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8440,i,2216127554590830394,15735346403986989910,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=4272,i,17925700555542076295,13049133514644828138,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:1
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5064,i,6215860744687683018,370503277773295249,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10224 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8592,i,15123508918673354195,18214101559036369668,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10016 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4324,i,4000404515425146020,16018308437882652096,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10216 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8456,i,14320415715238044781,1734614860653637779,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4344,i,3491610788855776061,1541527237434921204,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4280,i,11744816694271214396,14248577148811976727,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:1
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=4288,i,12160838161610119097,14624914101219479294,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=5112,i,5921886421302725697,17064701592558132498,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10236 /prefetch:1
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=4184,i,4359238232983892921,3080826934546998901,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4264,i,4071728227250825310,11776136165464531794,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8620,i,11382709977196731162,4320978519797505593,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8600,i,7102587251083213894,13034257559510467879,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=5340,i,14456188251285024895,15979180174946669503,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8580,i,7776485052596372237,1350161031491661009,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8560,i,16512950817641433776,4323004273589458380,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8404,i,4094934258088892980,17807819625993801372,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8708,i,11661207224288321911,778808881337377115,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=8720,i,15770160483800717708,1433348990914430318,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=11532 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=5008,i,8538655468692883539,7536910750992931387,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10736,i,3720467084540857852,7330303195494860577,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17116 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10756,i,17473036484913547725,2004022095562035211,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17144 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10816,i,286146007541759927,9682380600076362509,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17180 /prefetch:1
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10848,i,14322573302900638551,12020357308009896726,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17216 /prefetch:1
      4⤵
      PID:7492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10860,i,10244327568609454835,3397245566947630443,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17264 /prefetch:1
      4⤵
      PID:7500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10928,i,17618756279003413408,17716307930654784872,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17300 /prefetch:1
      4⤵
      PID:7520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10932,i,12227941951442970911,17334114977354716591,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17292 /prefetch:1
      4⤵
      PID:7528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10948,i,1752134070175494879,12450087045001135344,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17384 /prefetch:1
      4⤵
      PID:7536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=10984,i,8763819820219256917,13569358713637234761,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17172 /prefetch:1
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10956,i,17848218129257750075,12945417168996609158,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17404 /prefetch:1
      4⤵
      PID:7552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=120,i,9149385391881205543,13025303004132753127,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17484 /prefetch:1
      4⤵
      PID:7560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11012,i,17285166896941968580,2989497316460168134,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17508 /prefetch:1
      4⤵
      PID:7568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11064,i,3462351512852722624,10125852760892660918,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17604 /prefetch:1
      4⤵
      PID:7576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11032,i,5987493250738310070,945452551967411226,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17512 /prefetch:1
      4⤵
      PID:7584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11080,i,17590647419409711724,156819319854434052,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17632 /prefetch:1
      4⤵
      PID:7592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11104,i,15809273252690573128,10064008809874826776,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17564 /prefetch:1
      4⤵
      PID:7600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11136,i,4821563062699549709,2416618254044818291,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17536 /prefetch:1
      4⤵
      PID:7608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11160,i,7592941181046536753,9164147781069226413,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17664 /prefetch:1
      4⤵
      PID:7616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=11196,i,18045757808453170873,7967790423093792482,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17624 /prefetch:1
      4⤵
      PID:7624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11156,i,1672376789769686524,7662052063455062836,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17708 /prefetch:1
      4⤵
      PID:7632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11144,i,13297340517480481976,6019346422460969967,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17728 /prefetch:1
      4⤵
      PID:7640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=6272,i,5023188086269684810,14701939713891623027,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17768 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=6396,i,16250018584075163375,5106432776915546902,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17748 /prefetch:1
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=6368,i,2256343827418358761,18243491893836832158,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17788 /prefetch:1
      4⤵
      PID:7664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=6336,i,6606001266318197561,16775489777402569752,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17808 /prefetch:1
      4⤵
      PID:7672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=6352,i,13009664537344257507,2971196763428824603,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17892 /prefetch:1
      4⤵
      PID:7680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11496,i,916602390977607789,7795683253647216273,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18348 /prefetch:8
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11260,i,9235994472992983391,8041018244241817713,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=17884 /prefetch:1
      4⤵
      PID:7696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=11272,i,9581321581716999017,9886266273596906331,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18064 /prefetch:1
      4⤵
      PID:7704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11500,i,11884312229388627694,5378882149264696162,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18440 /prefetch:8
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=5972,i,7145390941241326859,17551060487253686003,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18076 /prefetch:1
      4⤵
      PID:7720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=5980,i,3393911595945524276,9957102720530157533,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18088 /prefetch:1
      4⤵
      PID:7728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=5856,i,9547746372730545506,7757647824598194274,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18108 /prefetch:1
      4⤵
      PID:7736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=5912,i,4900546563603650253,13420597601796024391,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18148 /prefetch:1
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=11320,i,5484941894839782299,1267808727766272350,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18208 /prefetch:1
      4⤵
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=11368,i,17603912285610903620,1948577192197830052,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18228 /prefetch:1
      4⤵
      PID:7760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11504,i,14289942030663434483,3337448756064968547,524288 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18532 /prefetch:8
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=5932,i,15407033083576762077,16452914442453784529,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18128 /prefetch:1
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=5904,i,1234035572695829834,7338791322607905675,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18168 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=11284,i,13584293471679820318,18412578765782381158,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18188 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=11432,i,7968743425502151266,796009139851682742,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18288 /prefetch:1
      4⤵
      PID:7808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=11420,i,9196598338504274474,2779129042193277739,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18268 /prefetch:1
      4⤵
      PID:7752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=11396,i,171470481859113213,1306430667550000261,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18248 /prefetch:1
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=11480,i,6502612591771298603,5427784231145951829,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18328 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=11448,i,16016114945559794847,4193774871073305978,2097152 --field-trial-handle=2248,i,2412936376126497435,15022006780654361139,262144 --variations-seed-version --mojo-platform-channel-handle=18308 /prefetch:1
      4⤵
      PID:7832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe"
      4⤵
      Views/modifies file attributes
      PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe
1⤵
PID:3544
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x4p1o1h0\s908fufn.exe
  2⤵
  PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4176
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe"
      4⤵
      Views/modifies file attributes
      PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2664

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe
1⤵
PID:1420
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25lq6pvx\4mwb6hqa.exe
  2⤵
  PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2224
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe"
      4⤵
      Views/modifies file attributes
      PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1500

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe
1⤵
PID:992
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bwz8y0ht\png8f50t.exe
  2⤵
  PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5548
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe"
      4⤵
      Views/modifies file attributes
      PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6088

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe
1⤵
PID:5756
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmwuvarn\2abfvna9.exe
  2⤵
  PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe"
      4⤵
      Views/modifies file attributes
      PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5644

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe
1⤵
PID:2364
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n0xvuv28\ykh1r4uu.exe
  2⤵
  PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe"
      4⤵
      Views/modifies file attributes
      PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5248

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe
1⤵
PID:6044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27ftd839\hu3g41gt.exe
  2⤵
  PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe"
      4⤵
      Views/modifies file attributes
      PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6088

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe
1⤵
PID:5840
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rih542u1\lyfj1y87.exe
  2⤵
  PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2628
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe"
      4⤵
      Views/modifies file attributes
      PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5920

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe
1⤵
PID:5312
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\utmxloww\7qtvxj04.exe
  2⤵
  PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe"
      4⤵
      Views/modifies file attributes
      PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6168

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe
1⤵
PID:6036
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7lw5i7l4\pt62p95m.exe
  2⤵
  PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6332
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe"
      4⤵
      Views/modifies file attributes
      PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6872

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe
1⤵
PID:6524
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctyooezl\hti4kkqi.exe
  2⤵
  PID:6648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6788
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe"
      4⤵
      Views/modifies file attributes
      PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6316

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe
1⤵
PID:6200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldhvmos8\pkfy5ef6.exe
  2⤵
  PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe"
      4⤵
      Views/modifies file attributes
      PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7144

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe
1⤵
PID:6840
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x5w84sxl\ws4dqujy.exe
  2⤵
  PID:6932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7024
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe"
      4⤵
      Views/modifies file attributes
      PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6724

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe
1⤵
PID:6560
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\omjjkspg\n3r42zhp.exe
  2⤵
  PID:6768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6784
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe"
      4⤵
      Views/modifies file attributes
      PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9260

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe
1⤵
PID:9636
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n5fj0z8l\n8lotef0.exe
  2⤵
  PID:9768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe"
      4⤵
      Views/modifies file attributes
      PID:9792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11560

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe
1⤵
PID:10644
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jmjmbr8r\avw6bmn9.exe
  2⤵
  PID:10832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ds4038ma\1bxw8vzz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ds4038ma\1bxw8vzz.exe"
      4⤵
      Views/modifies file attributes
      PID:11632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 282KB
SHA256 51e850c34c6234bfc2398bb758ea65a0a7436581ec068e7e47ba5e6caa482c95
MD5 f88654445271c1eb4deb64610eeaf703
SHA1 070b6547efae9b83885d01a4189b3915aff96d23
SHA512 977734f52640a632136e66efbdf9e56d9202deebe752b8cc033623f4ca10d21fa8208e3b1d12154e4284ae2881c007a9fed655902df2caedc7de64b74dd68a2b
SSDEEP 6144:uzaJQehk3mfKzVLixCOix18atTGTYen5/o5XlSn1Ew:U3mCpH1BTGzsXlSn1V
TLSH
T1115423149B4D02116BF9C02A2B5A4949DF89648DC0850DF6F8EA3E27DD00BBE0AE75FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 219KB
SHA256 bd194f912c80cb84f75de607989587ecaf5cf3886a2af3556640765150e727be
MD5 8a3e7dfd05c97daeb1c687c6656f5016
SHA1 cbe1d15be57427719f5afe854a0949e959e74cb1
SHA512 630b13a6c868e6769c35d465a7781b58cdc3c3d3a2a3e6a688a197a925b6e6de3ecac39afc9aa47c27192e1c437fe00778eb0d0588ceb85ca2b0e386d1b95227
SSDEEP 3072:3bz9barNmHnBtA4Xb7fgyWuF6GUwX+vwdfsFOGeWesUSKNb+yts0A76Yyw:rzsBk1bgo6GU23u5esPY+d0I
TLSH
T1BD2422D04D270BFF82B6037BCB187D9E7F6F42244A573F249A81D98BD50A30A74921A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 89KB
SHA256 e61213e0c958dca27e7a1ba05433e5f867a181ca723821f359b62e2608aaea29
MD5 206159c33f739cd6f16dbd7bd1d947a4
SHA1 4b5e15a9dc95a849fd9b5832d69e4e440194c1ff
SHA512 d2bc7ceb80bcf3136dec0bc5ba7b2bbec42f06fedfb5fbe5bc6fb830c1701164823d1d4497da700481ca6545bc3cff7b4172dff8a44aab24d4b35e87cea8b93f
SSDEEP 1536:7rBVOBa4OrL9/i159g0O4K6Ko7mvkUfVx6SiJTMGrB87D29bzzP6pbySyd1h+0wh:uA4OrR/iZi9hoqfVxEJIGy/21zzDSaN+
TLSH
T1D39312679803357B2BC0856A24D5CF052CEBB7B6413A13BAE63C85C3B912FD5D61AA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 47KB
SHA256 53977bfb2ac015dea4764d0bc4e9083664e9f24891f9c980999f27c5f3aea8ae
MD5 1d983683a5ade8b330dfc9aca29a9369
SHA1 58f93d18f74734052664fe877382465e944678f0
SHA512 c95130abc0bcb06b8d3651eb7eafb76f0aa56928e6605754e27b3336166b4407877e41c20c3f2f3ba477c5d564fbd0392aa3c67dc953495bbf3eb08e30b5d613
SSDEEP 768:Fr8ZxwH4wUt9nRVyHgTUOjFnLVUNvSt8vPV7G+R8dbpPE69ScGW+Torv2u8:yxy69RVmYlBnqNDvPV7vR8XE69ScGRTH
TLSH
T1582301162C3977A25171BFC5D272024375EC888EB63ADD8F4C61EA442BE8CA361DC735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 67KB
SHA256 aeae0da73139a235146c7e1a5605a969b0bed0743c2c06a272ee818329f48cc6
MD5 1a3e207eb153670f2c2385982d8a51e8
SHA1 d3b43669f9a94159bd9b8bb3a84efb6f6a02443c
SHA512 9cf1048da74f382aa5e40c4ea9cc2e6db854603745820687bde686b8d0e4dff59620a48f4f8d4a7d7dc664b0ab9e35e0691af306f238601ec3220c9ffcbff33b
SSDEEP 1536:yWor/EUuvPCdgVVidBZm9sxZUezwC77Tl:sr/EUuvRoSsx3MC77Tl
TLSH
T1CC6302A501357053D84F5ABECAC71B5E0CCD9975B0A9C6CBA59D29A33C3887874EABC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 105KB
SHA256 7b8d112484417a8d42fdabddf05f0290fccd408ae60ff5dfb31e3f20ff2efa78
MD5 b178e1f5ff1914fe6b4a359250094563
SHA1 7ee2cd48c0ad2bbc95562fcba04fd5bf27b2c8ea
SHA512 9917a66702effcbc7a8ae72cc2c061a4133a3537c8e72f6d672b3853c5089f10b359ce1f81697b2f6166c34bd10f07a284fec4fe47cafd09cc3415d8d4bd9049
SSDEEP 1536:wmZgChsCj7xp1R3qbjLAscyIpgtVfptHcDJXmNBYYDWsSj15d1zKQzkGlj8JJk9K:wmtxb6fwypTtH6OBzS5lDRKWg3
TLSH
T1D4B312FBA50CF7C892D95CCC28BFBF64332EA9294C5381DE59A5807E224E9DD0543963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2cf2918d81a104bab6eec9ae0cbd60b7e4838cd82317890962ad27e66ddec9ac
MD5 1d992121c7f97b06f9e5376867495d34
SHA1 e7bc848d7fd790ff34e61bbf42c110959dc3816f
SHA512 7f3da17875f511538c524a7c65f70695dd0bdd13e299e1d1ec3876996ef60572f7108ad75689941708d3b987cfc2704ca2071f7a94046d8d25fdf8a400a7c0d6
SSDEEP 192:sxZIR1yM/jK1Ml8Mjq/frsaL2IdpLlZ5/gFG/W6+WNiNlrrHderhYBYe3KqtkIgt:sxZIr7q/frsaL3+ubC/wh+iKq
TLSH
T1E862E852A6345AB78CDBE219F551BF57E2F50862D2904E44AEFCCA1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4a8f4cc40c0850e03b0134c06e309db9120922c4f4166ae521ae52328eb4618e
MD5 0970c65def78109ce1e82ff34493c5b6
SHA1 2b4706bf5daf82628d4bbcba4a68241717a21b02
SHA512 63ed1e31a6a5651ecd95d69947c5ee631fe0f8d07fab9f5855d4921c56aae45bfd5c83904de0e42f12438a92020273a5356143b1d1c757e011eb041c93da55c8
SSDEEP 192:sxZdR1yM/jK1Ml8Mjq/frsIyoEdpLEVQgFG/W6+WNisblDJ99KfYBY7aqtkIg4J:sxZdr7q/frsIy/uubFLGf2c
TLSH
T1FC52F952AA346A778CDBD219F951BB53D6F50862D2904E84AEFCC91C04E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4cc132145f64a3d26a687339a87524ebb260d96a0a4a4c4ab599abe34101dfbf
MD5 3cf02477dbeb76fd41793bb3c3f0dd8c
SHA1 ac31c2ef633fcf6d3d816adcda501bcc720a6f60
SHA512 e3b8dd73633f9d386559deb69ee08b6fcf283e5e6944818a9b2122ffd10b1f1fffee49bd30a8578c1e6bf30c1ccc456c6ca2218f266bf560421a20eb67693f53
SSDEEP 768:cu8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyALl6opd7roZkbUnw:cu8iJANWvx76ru1ja1ALocdISUw
TLSH
T1BCE20A3B680CCB7E4F845E9CEC266F966DD801CB5A988D5447FA880C03C76EE51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 13e8a055778644a1062fa0012cb04b67e301058f6a6a384a1a3acf171db814e7
MD5 a4da0f10a20cbca6b4df37f3dbce4a14
SHA1 afcfebb06584e3ad1859cef3a94c13fd532d524f
SHA512 fba54eb5c164aa460450ebd57d95be5a0d7881cb1618d43d0a77ed0f4c63251cbc7d2694fb2bde26774a21939f91dbd115dc8ba5fc61dbb4fea44d4c98e22575
SSDEEP 96:KwfyKoK6gKTiaK4YKRGO32K4wO+NqKOQb:8n/bUlt6
TLSH
T1CED12402B1FB02212C3F391C926586279B417AA3305DE46B7BB804B61E6BE255CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 05c97b31b2bb661b3f837458ecf11d86080e98d44611232163b533cb47aeaf95
MD5 3a3502b2c29255691e7983f731db6f56
SHA1 d9eafbc2370c6fe649540f1fd8373ec3e1673c24
SHA512 f18952a530113ea142b274d29bc415b7fd48c27e78f9c5e9fec6b56e2c60cbb8d6647fb44e6d94fc6e5e67f2f33469d57d7cdd126a11472bc88361e90816249a
SSDEEP 192:uuzm+xasuheOwQxMOhsN0IQHiNKfmYYQmiU1hNUuk03bb9zUNEjgLIOqOlt4/tyA:nwZcI7sN0IdP9RbkqbFUipUivD6ob
TLSH
T189829D702CB8AC7718E7E205F587371BAFB854B79AC89F44D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5153a12db0707b70315783cbbc0de82be1f09cc39f429ad984a009943308063c
MD5 35a8e281128db451e8e11ef89b7eba34
SHA1 5c8b68773ce555bf7646eb80cb91bfa0a19876f5
SHA512 39aef4c6102c35c04618d3a9f47d816534d7a89bc19450a626e79d55844a6974c5130652366f97d445d55eb026bf25e330d8d84c084b7c490f0df3507b8dc5b9
SSDEEP 192:znsN0F/5QHiNKfmYrQmiU1enK1k03bb9zUNEjTcIOqOl9YyXj/Jf:znsN0F/5dP80ikqbFUitU5tf
TLSH
T15242397168B8AC379CE7A605F44777539FB820B78AC56F99E9D84B1C04C739C2B0B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a25a7792e207b33a409b1fe990d876779114b2ee456e56f43b88bc3c26626fda
MD5 68331d209d6e562eb6861850b8c59e54
SHA1 fdb32c04eab0d37c864da527ebe23921a6e089c9
SHA512 4f5f36ee70098d87085c40ba92057263b0174ce0675225a565d91f5beda082029d7f8c708f5feb791696c3de7d34993c8ccc733c67a2c3146515aa66325f1c7c
SSDEEP 192:uuzm+xasuheOwQxMlsN0IQHiNKfmYaQmiU12NThk03bb9zUNEjgLIOqOlt4/tyAX:nwZcISsN0IdP5Y9kqbFUipUivD6ob
TLSH
T14D829D702CB8AC7718E7E205F587361BAFB850B79AC89F45D4D8D72C05C67982B1B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 72acafc50e2066bb8a25a764381a4ba9b8ee12d0ec1ecb4565c0fbe98eaa29af
MD5 a1a2fb8fc2b89cdccb1d1413faaf6006
SHA1 14854ef3fa6f7eacf0799c399bc77311788bb776
SHA512 0dcdbb2de631e90dd8dfd06db998ebf68a695d85c2393c8d85e6d836595037e851357360a649d06194c7867fd067b0462d688aede5b195e043c3daf7b653730e
SSDEEP 192:z6sN0F/5QHiNKfmYlQmiU1sn8rk03bb9zUNEjTcIOqOl9YyXj/Jf:z6sN0F/5dPOOmkqbFUitU5tf
TLSH
T13142397168B8AC379CE7A605F44777539FB820B78AC56F99E9D84B1C00C738C2B0B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f3a1acad95b48f79109692b788259b20da640c55784487cdb8fcb1379cf8387
MD5 9d856502ce809028d96e0aa2e9269d6e
SHA1 91a0c476e0bc0241a88707223e68003d7b7211cd
SHA512 84677edd42a91ef8e25874d9234fad829c361aeb35503c11de0293698cc431b8c35a0d87245dd641f7a81b7f5907687ac0d5e974ad09d910628525b79b306a7b
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5U5D2BhPwivh50xy0SFYK4AxYYCbJ:gONZ6kDfQmiUyGmZ903bb9XQipCCU6
TLSH
T1C902F835A8786CBB8EE3AE49B48777275FA4113BEAD52F84D9E81A1C00D765C1703836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9015a360bcd366f1fa180b7da013b67e359e16b3fa16d79fbb73cdeede9661b
MD5 2b3a70a66b21a01ffe5c921413914bc2
SHA1 f2cd6aaa1d1c1581e53f613ed15319ad8d5a3e87
SHA512 27dda99d95ef1e08a999889a61e4697295db01154d40c1a43c9eae86305685756264fb56285c3af2b8a833124df7f1dfdadb99d33421979c4350b73e1ace21d4
SSDEEP 192:GONd6kVQmiUy5mR903bb9zUNEjwcROqOlU6:GONd6GXR9qbFUi9UU6
TLSH
T18212177164BDAC2B9DD3B505B08733675FA82077DE85AF85E9E44A1C04C768C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0d7989b9e05a0b195e127a526e6dd37a1cdc7e4fde4f2a67e1010d168fa0b6cf
MD5 f70d4b6bfb37635d9e60bdf31583e9ce
SHA1 44e95fb729c4c3ed0078901a699e41fe5c257fdc
SHA512 1ef3e0ae49e8ccf5fa703806ba09189e96d0b9cca62b5163fba7633f21c1e4f0dbbc6cef04cb771f04a374d38399d4f606bd68760dfaa3a5df20cce40f42112c
SSDEEP 192:zpsN0NQHiNKfmYcQmiU1wndgk03bb9zUNEjTcIOqOl9YyXj/JM:zpsN0NdPtCOkqbFUitU5tM
TLSH
T15442297168B8AC378CE7A609F44777579FB820B79AC56F99E9D44B1C00C728C2B0B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a2bd45c4cb7d2695fabc4c8f307c4dbfbd94bda90a7dc1d1f20cb9def045cb0c
MD5 56eb6da61c4b6a56eca507a248abc7c8
SHA1 ec904929a2d7c181640d83d9128b97775344c6fe
SHA512 9bb4dc62b5fd144fe14355aae4f8cafa42f89e1662c8178938c7075223a5398da77fbbfad6a288c07f16b0aea5a00e4533412cfc9b2896dba7b4efb8b64a7275
SSDEEP 192:znsN0F/5QHiNKfmYlQmiU1xn5yk03bb9zUNEjTcIOqOl9YyXj/Jf:znsN0F/5dPOLckqbFUitU5tf
TLSH
T1B142397168B8AC379CE7A605F44777539FB810B78AC56F99E9D84B1C00C738C2B0B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 62dcc0db429447998e37c4ccc27626eb0ab8c394a42732dd76ee6742f58acbf3
MD5 88bc41a2ed3a25608dad6110b7a60881
SHA1 ce2b79f12418a0463006c702586b318d9f09569f
SHA512 6e3be53cb766c1b86dfaa3a66c62ded122b906173b94fdf753219ce7249dd5140f0a04065119f6a314c8a68455905cdf9940646160e0333aa856ee5d0692208c
SSDEEP 192:zzosN0F/5QHiNKfmYPQmiU1UnN2k03bb9zUNEjTcIOqOl9YyXj/Jf:zMsN0F/5dPES0kqbFUitU5tf
TLSH
T14A42397168B8AC379CE7A605F4473753AFB810B78AC56F95E9D84B1C00C729C270B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0079ebff26a4ae919051067e0e5a8580d5fa9564d3b64c6b0f2296b050136e95
MD5 1979d91688e0570c61176be2519b99dc
SHA1 2ec1e17444a887c1e9dfacc1bf192f4ac532cab2
SHA512 54a14447160d8c1fc4b57028dd32f8f4579fc8a51c2239fd9c28a71075127598ded43c920c0d1229d0c099b2af063efa83d42cef1b9c7cd11469364a12a981eb
SSDEEP 192:zzm+xasuheOwQxMBsN0OQHiNKfmYPQmiU1AnB/k03bb9zUNEjOLIOqOlt4/tyA7L:zwZcISsN0OdPEe5kqbFUiXUivD6ob
TLSH
T1D3828D702CB8AC7768E7E205F587371BAF7850B79AC89F45D8D8972C01C76982B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d370daa05ccfae2e06e1ccec10219a4e1b3f8a4b2f0cb4267d6c97dba63401f2
MD5 a8269a751f08093c038bec9d464de088
SHA1 1e3da18996924688be417e0f8cfba6079819b1d0
SHA512 91efc728454014d35507f0b6f38f75b5e1cbceef73a84f2184efe77bce59c7e3ed4990ac8fe79fe626e0851a04e966c65c5493bfeb4b6fb10621e16e1fa75248
SSDEEP 192:uuzm+xasuheOwQxMUsN0IQHiNKfmYPQmiU11ndbk03bb9zUNEjxLIOqOlt4/tyAX:nwZcIvsN0IdPObVkqbFUiyUivD6ob
TLSH
T147828D702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8972C05C77982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 33f963115c69c49d5ef7d1a140de8680abf920e34d1c5ce345d385d6e130e09e
MD5 9d3e2c8651255959802431230a3a8233
SHA1 e52947aa8430bc890ef8438d47ff547a5e09745e
SHA512 f76632af904614f7991adbcaadc31be81d1e88377037627193db47eb576f01770813afbd1ca4ec9f3c4e7b2ef3ec58d58f577a1b7ea3e03e7a6e33f83916e7ef
SSDEEP 192:uuzm+xasuheOwQxMKsN0IQHiNKfmYDQmiU1INakk03bb9zUNEjxLIOqOlt4/tyAX:nwZcIZsN0IdP6e/kqbFUiyUivD6ob
TLSH
T12E829E702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8972C04C67982B1B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee16a0ad92d5200d23c917456ba88d35e2db06964bd8fac5c0d3a0725699a242
MD5 96da04678661a83b83142a8fd5f396dd
SHA1 02bc8ea69b922f29baa16c367e23ac95aa48b45e
SHA512 4ff64765f439f0269b1310dcf3d46dbb5ed46d163693c762f32ae1513c5e9c273434826cc729cee60a6d417a981e1c663a5611cc2371e311a2532bf910c30ed9
SSDEEP 192:uuzm+xasuheOwQxMQsN0IQHiNKfmYHQmiU1rNkstk03bb9zUNEjgLIOqOlt4/tyA:nwZcIfsN0IdPUvkMkqbFUipUivD6ob
TLSH
T1E1829D702CB8AC7758E7E205F587371BAFB850B79AC89F45D4D8972C04C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b2df2e744bb19d1884f42049a1727d9f7e7bad3ae6ad2be42a46a403b61c1def
MD5 0387f724bc3707af868b31141205a509
SHA1 232702d852d8bf6a9ca245e6a4e4dd92e4713c56
SHA512 9070cc114db28f3947797bc8902507f660034069b4ee975c951e229c78083a6868a42c5290ddbe11cd6e0d0aa395d79cbe9c02dacbfcda0587504eff9755bee5
SSDEEP 192:uuzm+xasuheOwQxM3sN0IQHiNKfmYeQmiU1jNmIk03bb9zUNEjgLIOqOlt4/tyAX:nwZcI4sN0IdPNTXkqbFUipUivD6ob
TLSH
T1B9828D702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8833ff905681568aa5adf9d8d4be08c5bccc46376dc0ec2908b0bef913415cf6
MD5 7f9fb15a1ea008a58d0237ed81f3c8dd
SHA1 ffa34d3ea36d3a95655844a37f54bd1ffb16be71
SHA512 08e806079effc8c5b84040672598c64b2271a1dcd349d12a6eba6a3b906b2803fbd8d97e65f66ffd1b37ca2e7c37bc3bcb3b2587a3937b966597aa867ea561ba
SSDEEP 192:uuzm+xasuheOwQxMXsN0IQHiNKfmYyQmiU1/Njdk03bb9zUNEjgLIOqOlt4/tyAX:nwZcIEsN0IdPdDJkqbFUipUivD6ob
TLSH
T152829E702CB8AC7718E7E205F587361BAFB850B79AC89F45D5D8D72C04C67982B1B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 96af6facbf8404279ba339f66d213a4a3c05eddba94611792d463768f11fd7e3
MD5 6d210f8d696427184e3317c89d5074c1
SHA1 257e83a4be6801ee92b56092a6d671e0238d7d68
SHA512 4d58a095880716aa7debbeaea3cd3863c7e6afe268f2650eaf8e459590a68602eb9e4b15b0c031a70109befee62485eae5b39990dcd46ad0863a6b6867b63ed7
SSDEEP 192:uuzm+xasuheOwQxMGsN0IQHiNKfmY7QmiU1UNZ/k03bb9zUNEjgLIOqOlt4/tyAX:nwZcIxsN0IdPC2VkqbFUipUivD6ob
TLSH
T176828D702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fb0059c5e6e6efd3ca20eb3f8df1392552a073ce591236141daf7e84e432221e
MD5 ed017431d5a69dba25c907c123dcacae
SHA1 1a3213a65a6f535c25e0d4c662e1147fa01c4091
SHA512 11bd968c06367b0f345d8cbd1bbaac568fb68d5888904ea387080420e60d4cbb528c98ddde96432937135de89ddf17ab3567c45ca4ea331d95d419e9b7c62d8b
SSDEEP 192:uugf+xasuheOwQxMqsN0YoQHiNKfmYQQmiU1FNwik03bb9zUNEj4LIOqOlt4/tyA:naZcINsN0xdPJdDkqbFUipUivD6ob
TLSH
T120929E702CB8AC7758E7E205F587361BAFB850B79AC89F44D5D8D72C04C67882B1B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4da9462805f8cc891f2ae7f619e77aa6e610b944c67dd28d97cb7537f3ad98e2
MD5 a34d6389fbf732112dbb0f2444fa1809
SHA1 2d2a369d18a58bce623411b8f6f352a39882c49d
SHA512 663683432ef09b7c4502d4f7c500f193b71152566282f0a14569a28740a354d02cc0174be3891863ba4362c9c52e997a9917395e58cb2c2788e3eae5d4e2f3dd
SSDEEP 192:uugf+xasuheOwQxMjsN0YoQHiNKfmYjQmiU1iNP1k03bb9zUNEj4LIOqOlt4/tyA:naZcIEsN0xdPgotkqbFUipUivD6ob
TLSH
T180929E702CB8AC7758E7E205F5873617AFB854B79AC89F44D9D8D72C04C67882B1B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e23c54305822fc325b2505ba1d165d102e84eb4e7ec332745f2338665b87397e
MD5 2675af9e81585bf68f3407c5bbc4414c
SHA1 09260e2fd9c1d89d2daa7fb946f5ea46fde20315
SHA512 46b8698265387d5d76e568ca63e136c8d949483b32feeece9f57adcf81429e309d9db1da1a5ef8b229efe4bfff792e289c9c0c3bf5e519c5e276bfedf4ece5ca
SSDEEP 192:uugf+xasuheOwQxMNsN0YoQHiNKfmY3QmiU1nNbpk03bb9zUNEj4LIOqOlt4/tyA:naZcIqsN0xdP4T9kqbFUipUivD6ob
TLSH
T1CC929E702CB8AC7718E7E205F587361BAFB850B79AC89F45D5D8D72C04C67882B1B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 afcaee81b48f3eaa72c5bd48ca9f75d281b89d55d00911e2016eae512ba029fc
MD5 ea96e5a0cf0c960b04542aa8c35c1843
SHA1 a903ff33965813d49bc75f066c8aae2ee1ef4617
SHA512 ba3b6996420eac489bbf3cd4978c7b63f109a0fbeac530a4e90243c9e37b04a7d79b81e16d310d9965f2e3c71ad4fa9268a52755f984f45d010723b71485c3bc
SSDEEP 192:uugf+xasuheOwQxMysN0YoQHiNKfmYwQmiU16N6Ak03bb9zUNEj4LIOqOlt4/tyA:naZcIdsN0xdPlknkqbFUipUivD6ob
TLSH
T1B2929E702CB8AC7758E7E205F587361BAFB850B79AC89F44D5D8D72C04C67882B1B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4aada09e731f54282c0a202138ff2123cc95c88d771217ae64ddbf8c66a3cce5
MD5 76f93f120c8a4b4a115a78420d0ec299
SHA1 f5b0ec5128cd6e73fdd9483a7f21fe026fa47eb6
SHA512 d4f262a8037b92c1c542b608e468acf663345eecd5e0897ef73ebb854c5637921034eff760f5b5b8f1ece07336e4071b81379693e963f6f547d11122196d7598
SSDEEP 192:zxsN05QHiNKfmYTQmiU1lnQ1k03bb9zUNEjTcIOqOl9YyXj/JM:zxsN05dPkvukqbFUitU5tM
TLSH
T12842297168B8AC379CE7A609F44777579EB820B79AC56F95E9D44B1C04C728C270B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f63b8df5c5ce21628445d6273933f221b546e0e0003a78f661a78d5d2c7980e5
MD5 60c962882602084e4357c51b13999f3f
SHA1 de1388a34297b03f113637289d0fba5fe06bc9da
SHA512 d36f723f2dd8737884f6aa879b1473d5e1106d2a92734ed9324191258706a3429248308bd4e66ac779dc324af6f3292691dd0b1baa60b6b8dc321a0a24cbde1b
SSDEEP 192:zJON06kmYpQmiU15nvyk03bb9zUNEjwcIOqOlU9:zJON06ZIHakqbFUicUU9
TLSH
T17B22087168B8AC379CE3B509B48737539FA81077DE856F85E9D44B1C00C728C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b13aca284aea407e1a866be8c0cddbb5603de7b37c02209a21469e4f37e85de
MD5 150b67c506ca0054e0b8a15f664170cb
SHA1 b8852928b9cc38551e3e3d5153cb71a81f842be3
SHA512 0ed7d5aac83721b312af982fc4b65427d767ccad96eac6ce524567559e0a63acd94e0d132791d7dc50d03eb61f0749547582b46e1e0688fe6dc10013b938bc95
SSDEEP 192:zpsN0NQHiNKfmYrQmiU1vn+rk03bb9zUNEjTcIOqOl9YyXj/JM:zpsN0NdP8VSkqbFUitU5tM
TLSH
T13E42297168B8AC378CE7A609F44777579FB820B79AC46F99E9D44B1C00C728C2B0B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 496cb8f7e90176cf1d95e4f128915903c1f16c7e272a3332339e3d5ba118e311
MD5 0f73ed087847d83964119086ea2f4549
SHA1 5d450b7113a388da608157d52b4f43b1c7e5a372
SHA512 2aa23b30202b85da5e6d48e6111713e19c3fa2bb1c05de102003a6e3b514eab017366a2a359a54cb5fa16640dac258b692ff020752b3ae35df5d08480210d065
SSDEEP 192:z6sN0F/5QHiNKfmYPQmiU1Pnrgk03bb9zUNEjTcIOqOl9YyXj/Jf:z6sN0F/5dPEtkkqbFUitU5tf
TLSH
T1D442297168B8AC379CE7A605F4477753AFB810B79AC56F99E9D84B1C00C728C2B0B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1dbfdb173a0be1122b9a531952fe9d80c1ea4441581155f0a30c6f4be4b1d2af
MD5 688e8b1b3f36539865819df679788a84
SHA1 388382a3dfcfbb76210596e9219de32dd524d524
SHA512 bcb33d28d74c54f00538344f2cce500c0f9b8c9381f5c027036959f5535ad054df1d6ea46c44e0e8c940e13066a495ae648af8de706cffda85b997b3b61ad231
SSDEEP 192:uuzm+xasuheOwQxMlsN0IQHiNKfmYfQmiU1qNHtk03bb9zUNEjgLIOqOlt4/tyAX:nwZcI+sN0IdPSsNkqbFUipUivD6ob
TLSH
T15C829D702CB8AC7718E7E205F587361BAFB850B79AC89F45D4D8D72C04C77982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 eb9119e1666496898bfc02e8992dbc3a04e3ee230dcd40951fc6892caba3fd9c
MD5 52fcb3d4d29fe9d37bdee668ba8336a7
SHA1 c4c6cd50746f6b50e9554c70a2ff6902c19c5fca
SHA512 43e4f9776a1ed6a07f4ed026d568f38736c844e1e11f8a678877ae4dbe9da48564027dea70439141f69e7a8ee1e45218fe365a95008e4f80629fc7c95374cee9
SSDEEP 192:zJON06kmYpQmiU1nnk8Uk03bb9zUNEjwcIOqOlU9:zJON06ZIRkHkqbFUicUU9
TLSH
T1F222F87168B9AC779CE3B509B48737579FA81077DE856F95E9E44B1C00C728C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bac96ec58b80c77230f7bc5f0b7c5b9167c0c7004f0dd7a9276121e70a6c5ac7
MD5 fbbfd654cbb8677331b5c0478a77af24
SHA1 f6cd9878d5ed2fbc19e3017b0764766a5da17867
SHA512 3678c57a7a89477086c03ea292352ba6ac2f199b4edb7ea5cc8ade8b9aef2bf7f3e171d0585d55207621b911533473593d98dbe9005b89392d6b8594dfb1ada7
SSDEEP 192:uuzm+xasuheOwQxMbsN0IQHiNKfmYHQmiU1xNlnk03bb9zUNEjgLIOqOlt4/tyAX:nwZcIMsN0IdPU19kqbFUipUivD6ob
TLSH
T114828D702CB8AC7718E7E205F587361BAFB850B79AC89F45D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 12a090959fcde9657f9c7da8a9652ef762c3fad8b963a6706abcd7f483de1f31
MD5 d35a03562914d6dc0b8a5f2e31fd6a6c
SHA1 f3c91de45c51f0573dfda9bb41706e0259e8a246
SHA512 1c0c59eef59db7c8aa98b4aba4c1bbc4fbdee484d3f226c7c6ed6cf6420330b489c9f14ef2b9567b17a39ab55fef93f046289cf44215946c35173a2ff7b64d19
SSDEEP 192:uuzm+xasuheOwQxM84sN0IQHiNKfmY3QmiU1wNyYk03bb9zUNEjgLIOqOlt4/tyA:nwZcIKsN0IdPoGXkqbFUipUivD6ob
TLSH
T1F3829E702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 edf8af732f317c11c6b529f87a53452e23189a618809c12205035c67168158b9
MD5 c862fd8f5bb32e1770367a6d06dddddb
SHA1 ca466bba01f3150fad09e2d221e64b30ed50801c
SHA512 4bcceec183b9d22914e017df7324874f583b96706fd55f9e7837188d96d9352260142558cae2bc5f6840c08b252204c58a1b26460a1ab9daf8c08dd9e0543714
SSDEEP 192:uuzm+xasuheOwQxM+sN0IQHiNKfmYbQmiU1pN/5k03bb9zUNEjgLIOqOlt4/tyAX:nwZcIpsN0IdP2JBkqbFUipUivD6ob
TLSH
T126828D702CB8AC7718E7E205F587371BAFB850B79AC89F45D4D8D72C05C67982B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 85fd8fdb8fcbb2f083f91ad3ae0cc40de8689fa5683b029c05507ee4c09314bb
MD5 58e8109f0b0f07a306dc83638f14da2e
SHA1 682e79c6fcee16e4f2a72f5e0d0f283c631899f9
SHA512 412cce716d74e659a4845644dfdac05e1958fcb4f80bf56960b60a6181185cc0f24e0a96c7327a0a4ef5db1ae8335ece814957a2cda39b136ff5f9e1b9fc5944
SSDEEP 192:zJON06kmYpQmiU16nMZk03bb9zUNEjwcIOqOlU9:zJON06ZIUukqbFUicUU9
TLSH
T1EE22F87168B9AC779CE3B509B48737539FA81077DE856F95E9D44B1C00C728C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 569def720c59ae27c41c996ec2c07284957b72b8935b8003a60db07efb2d7e30
MD5 358da9008cb49448a2318f47777ea754
SHA1 8771b01e0bed74207e230db9858acdc3a09ea1ac
SHA512 e36d8c5eb82791e7a7b183e64528fab8f74a37d1e426508b1ef2f823e5e7e4259b6c8eec198f31743214b6962839823258eaadb1c93f4660838cd9c31dd11853
SSDEEP 192:zJON06kmYpQmiU10na/k03bb9zUNEjwcIOqOlU9:zJON06ZI6qkqbFUicUU9
TLSH
T10422F87168B9AC779CE3B509B48737579FA81077DE856F95E9D44B1C00C728C2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54beff332c319e93638dbdfb46021d4d522169d7363c8e969116dfc065f5ec75
MD5 ce01a90a05087a0958bbee0245a406da
SHA1 f4b07cbefc405932b8c123dfcd39aeb1422dc464
SHA512 1868e78679934d85fe7ebe171b7e9494b2c47819274fe2ea58b1c324528119e9ba50d8220a409861efbe2c209719f02c219fd2c53d1166e750e91f2a346be68f
TLSH
T135413959B6F91148B3777F179BF2A86E487EB8372E06905E10020E4F0632A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\base_library.zip
Size 711KB
SHA256 87aa00aeadee10f0930e97db484c087641a7963a7073beb4bfba68bc839f9878
MD5 aaf9a6bcb2d4335999f67fdd3be9577d
SHA1 16a1b22c15f785785bfeb1d94d3378856d8722f2
SHA512 569990f03e8731524c8d53aee7c21be070216bf59661fd76b31bfdbe7a7f3b5c31dd1f69f19677751071506504afb6cab88001c9f711003d3144039a5c04a741
SSDEEP 12288:xk1wjfyEDoQDSpLyax+Q2osQNRs54PK4I1AV0c4hU7dYD:xnjfyEDoQDSpOsV2osQNRs54PK4I1AVi
TLSH
T125F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26602\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c03e1e6f-d3c0-46ff-b485-39b5de917ae2.tmp

Path C:\Users\Admin\AppData\Local\Temp\c03e1e6f-d3c0-46ff-b485-39b5de917ae2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dfb9ba61-4351-4bb9-aab9-12b8fa788a11.tmp

Path C:\Users\Admin\AppData\Local\Temp\dfb9ba61-4351-4bb9-aab9-12b8fa788a11.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d44e15-a958-48b1-a1aa-28ce59d3c0e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1596_2135649383\63d44e15-a958-48b1-a1aa-28ce59d3c0e9.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2t2xi3kn.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcv4psht\2t2xi3kn.exe
Size 5.4MB
SHA256 a99a96d8730b4de3404c4e2b05b102ca65d8baf0a61fb09e36c9cda912330327
MD5 92b8ac837f765f592c45352378724328
SHA1 4a9a12acbfbe41d5e70e5fb70d8196be6699b06b
SHA512 c4ec75b0f30c0a8c85c099526e5463529b1d76877ba9a44ffe2a554a7fb0477187751a6ee4af803c173e69a245b21114944c92e9a418349c672f5f185ef5d8d3
SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1b:Hdx2ICteErownP0oTcMsABqlqBnF
TLSH
T11A463308B3E809E1E9B3D13D85665221D573B4254BB0D5CF03AC9B662F777E0AE3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5468-912-0x000001DAC6E50000-0x000001DAC6F99000-memory.dmp

Download

memory/5468-826-0x000001DAC6E50000-0x000001DAC6F99000-memory.dmp

Download