5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b

Analysis

max time kernel
3s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
Size 5.4MB
Sample260822-cn8fcaem8t
SHA256 5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b
MD5 d5366bf771b5401bde240b16b78f0ba7
SHA1 b58e88e81939b53d7a9124e5faf2ae5ba7fed877
SHA512 2c48f142c502d9f2cbbb7601b9f16e3369c115cb2ad9926922190c2bf5618349b740c0fabdfa0ea9d38ae612e34cca0997ef5dc91a0cc716ec63646dc9484960
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRu:OrICteErownP0oTcMsABqlaOzU
TLSH
T146463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9723
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9284
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3694
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9682
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5504
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2891
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4161
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8952
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5194
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8421
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2325
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3116
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6905
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2093
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9586
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7988
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6637
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7957
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1816
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4791
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9311
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6146
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3133
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5787
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3186
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8351
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2170
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6192
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4321
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3227
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9244
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5039
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5989
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9952
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2254
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6733
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9833
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3597
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1644
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4632
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3788
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9808
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5372
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6980
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6925
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3012
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3546
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2019
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9090
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3725
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6056
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2568
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6809
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2404
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1346
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8739
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7803tv.exe	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7803tv.exe	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe

Loads dropped DLL 12 IoCs

pid	Process
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\zfszhyg6\\qhms8zax.exe"	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
594	ifconfig.me
1497	ifconfig.me
3060	ifconfig.me
1611	ifconfig.me
3351	ifconfig.me
300	ifconfig.me
381	ifconfig.me
540	ifconfig.me
1070	ifconfig.me
1786	ifconfig.me
1883	ifconfig.me
1961	ifconfig.me
3325	ifconfig.me
971	ifconfig.me
1	ifconfig.me
11	ifconfig.me
518	ifconfig.me
1094	ifconfig.me
1191	ifconfig.me
1554	ifconfig.me
2162	ifconfig.me
342	ifconfig.me
2384	ifconfig.me
3189	ifconfig.me
3830	ifconfig.me
414	ifconfig.me
485	ifconfig.me
915	ifconfig.me
1423	ifconfig.me
649	ifconfig.me
759	ifconfig.me
950	ifconfig.me
2000	ifconfig.me
2912	ifconfig.me
202	ifconfig.me
1100	ifconfig.me
822	ifconfig.me
2140	ifconfig.me
2933	ifconfig.me
4011	ifconfig.me
546	ifconfig.me
2271	ifconfig.me
2898	ifconfig.me
175	ifconfig.me
331	ifconfig.me
1625	ifconfig.me
136	ifconfig.me
1176	ifconfig.me
2130	ifconfig.me
2630	ifconfig.me
3173	ifconfig.me
521	ifconfig.me
572	ifconfig.me
2100	ifconfig.me
2845	ifconfig.me
3583	ifconfig.me
484	ifconfig.me
190	ifconfig.me
276	ifconfig.me
321	ifconfig.me
1485	ifconfig.me
3944	ifconfig.me
176	ifconfig.me
201	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4904	cmd.exe
3504	cmd.exe
6216	cmd.exe
3700	cmd.exe
4436	cmd.exe
4540	cmd.exe
6472	cmd.exe
7712	cmd.exe
4284	cmd.exe
2068	cmd.exe
6232	cmd.exe
6832	cmd.exe
6476	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2676	1032	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	89
PID 2676 wrote to memory of 3700	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	90
PID 3700 wrote to memory of 4964	3700	cmd.exe	92
PID 2676 wrote to memory of 1724	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	93
PID 2676 wrote to memory of 4296	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	94
PID 2676 wrote to memory of 2660	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	95
PID 2676 wrote to memory of 6020	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	96
PID 2676 wrote to memory of 5712	2676	5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe	97
PID 1724 wrote to memory of 5684	1724	msedge.exe	99
PID 1724 wrote to memory of 904	1724	msedge.exe	100
PID 1724 wrote to memory of 4860	1724	msedge.exe	101
PID 1724 wrote to memory of 4860	1724	msedge.exe	101
PID 1724 wrote to memory of 4860	1724	msedge.exe	101
PID 1724 wrote to memory of 3004	1724	msedge.exe	102
PID 1724 wrote to memory of 3004	1724	msedge.exe	102
PID 1724 wrote to memory of 5736	1724	msedge.exe	103
PID 1724 wrote to memory of 5736	1724	msedge.exe	103
PID 1724 wrote to memory of 5736	1724	msedge.exe	103
PID 1724 wrote to memory of 1764	1724	msedge.exe	104
PID 1724 wrote to memory of 1764	1724	msedge.exe	104
PID 1724 wrote to memory of 1764	1724	msedge.exe	104
PID 1724 wrote to memory of 1008	1724	msedge.exe	106
PID 1724 wrote to memory of 1932	1724	msedge.exe	279
PID 1724 wrote to memory of 4736	1724	msedge.exe	108
PID 1724 wrote to memory of 432	1724	msedge.exe	109
PID 1724 wrote to memory of 1008	1724	msedge.exe	106
PID 1724 wrote to memory of 1008	1724	msedge.exe	106
PID 1724 wrote to memory of 1932	1724	msedge.exe	279
PID 1724 wrote to memory of 1932	1724	msedge.exe	279
PID 1724 wrote to memory of 4736	1724	msedge.exe	108
PID 1724 wrote to memory of 4736	1724	msedge.exe	108
PID 1724 wrote to memory of 432	1724	msedge.exe	109
PID 1724 wrote to memory of 432	1724	msedge.exe	109
PID 1724 wrote to memory of 4572	1724	msedge.exe	241
PID 1724 wrote to memory of 2560	1724	msedge.exe	111
PID 1724 wrote to memory of 4572	1724	msedge.exe	241
PID 1724 wrote to memory of 4572	1724	msedge.exe	241
PID 1724 wrote to memory of 2560	1724	msedge.exe	111
PID 1724 wrote to memory of 2560	1724	msedge.exe	111

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6452	attrib.exe
5280	attrib.exe
624	attrib.exe
6504	attrib.exe
6484	attrib.exe
4836	attrib.exe
10432	attrib.exe
4964	attrib.exe
6044	attrib.exe
4976	attrib.exe
3748	attrib.exe
6288	attrib.exe
6900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
"C:\Users\Admin\AppData\Local\Temp\5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe
  "C:\Users\Admin\AppData\Local\Temp\5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe"
      4⤵
      Views/modifies file attributes
      PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c4,0x300,0x7ffebcadc188,0x7ffebcadc194,0x7ffebcadc1a0
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,13576990576813509046,8669005538631829961,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
      4⤵
      System Time Discovery
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,16854872465049353321,14643659772558226392,262144 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,17594650035657221953,11829793573835089071,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3272,i,8775875141367333259,3323315584885879603,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,10096325929150181040,7964142459152478178,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17893399647178355849,9812771959929586654,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,17220494119061794619,12570755232376553673,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,17753954499509833981,13071480621849334067,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4440,i,1875455000074332187,5028611209908023135,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4484,i,11844853733315103568,8556778334964267952,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4712,i,627047224861233968,14930104635577828238,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5908,i,5140965576559120100,11837647827089565855,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4702275405159950937,8260814171861442480,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6212,i,14351365047995817203,10563648482435079465,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6364,i,18130520448136599970,10256628387419565832,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,15385425410405736771,16730854598240561592,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,15385425410405736771,16730854598240561592,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4708,i,9642176991370977202,17226410098617517579,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7156,i,12983629883778390758,16802869537001547109,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:1
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7060,i,11163210601294177978,10832649692313977697,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7220,i,12988485209352802858,12426942714171082031,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,3720956600372736184,5637041567707512240,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7216,i,12448800182259706922,8593461789010306013,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:1
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7224,i,2123006517442240328,15545656926492893074,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7584,i,3878286258815240356,3660971112127831257,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7464,i,11790114782738412114,1157894422850385383,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:6396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,6536423662628169337,7152666848875117024,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9116 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7544,i,11882210654619495021,16508267519722937579,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7324,i,2603819553764046971,10137881105432218747,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7368,i,17062994577324888214,16645436631597688335,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7696,i,18397317473452350977,14651364851326450984,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7252,i,4768046932611829711,9002694663607591093,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7348,i,15169820955513299634,4939239636160674396,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7448,i,14352681422231871965,9531826835700867148,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6124,i,9939628409621874634,15515888838266281039,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7632,i,16923166184996063125,6190621138468747612,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7608,i,7833967853707865775,1179094394062905564,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5840,i,10517150861201349565,5506209336400746006,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6064,i,14488952490264694824,18087081821226328598,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7872,i,17170898263526708391,4036111914514096207,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6128,i,10310763079161574005,11864030563553046561,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7980,i,14649001792547301236,10637949874887260074,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9412 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6180,i,4975857527066120475,13508743447656854671,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7852,i,5900468857631850823,5596203481986758709,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2328485641977663266,7928463718372103527,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:14
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8044,i,15999711057463791837,7610185279806041108,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:14
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=4544,i,7788044231443543709,11184116234022054414,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8380,i,12522582753499790926,15769398893386407775,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9676 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8396,i,1973952015322678104,3288213785701411088,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
      4⤵
      PID:6904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7772,i,1485876786862962806,406783108948125201,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8340,i,16204528948531848458,13822559689714270216,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9584 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8236,i,9859855765222959041,8963599507264864755,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:1
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5124537052927108453,16976447267248509110,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:12
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8428,i,1477199721351094329,15106262261079788773,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7768,i,2986179316804031262,2035752429738805197,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4012,i,7269279833387194527,80181093939926876,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8452,i,18089673952197596796,10734883496039570368,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6060,i,2589017790530921717,4273882994850284437,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:1
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7924,i,4193130876172429929,17825189836767770677,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9904 /prefetch:1
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8268,i,4327341454103489208,1911090918708937762,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8300,i,581166890931990864,14304709192480895194,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9856 /prefetch:1
      4⤵
      PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8496,i,17327613093909517989,13801762187892452790,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:1
      4⤵
      PID:6892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8460,i,18402924034339070577,12740594574730222607,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10096 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7736,i,13576496765502929638,18172535088978216856,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10000 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7004,i,4969718433468268846,9839809221481528224,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
      4⤵
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8528,i,10210060818261430202,5596715193587317652,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:1
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8512,i,4773749229012153799,9434912780981531087,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8676,i,9519854326074785144,7330713882072441541,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10808 /prefetch:1
      4⤵
      PID:7200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8736,i,15527072343667799205,5089038077767616338,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10828 /prefetch:1
      4⤵
      PID:7208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8764,i,4792898972700023763,13786574681268124980,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10900 /prefetch:1
      4⤵
      PID:7216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8772,i,10026028686239931250,9170022732449395800,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10912 /prefetch:1
      4⤵
      PID:7224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8844,i,9769492945785446345,4880046257067007434,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
      4⤵
      PID:7248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8896,i,9854976130323955193,8005373464034520761,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11032 /prefetch:1
      4⤵
      PID:7256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8876,i,4832008773499527482,1491360263223526427,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11012 /prefetch:1
      4⤵
      PID:7264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8664,i,12530258957700991174,14478811559771202560,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:7272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=9048,i,10458810943578022474,280886119630876099,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11112 /prefetch:1
      4⤵
      PID:7280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=8936,i,1681912429969110074,58335388118094013,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11072 /prefetch:1
      4⤵
      PID:7288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=8992,i,180882772121470198,16133587512993130679,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11092 /prefetch:1
      4⤵
      PID:7304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8792,i,2802525281467483848,2345194929397737845,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11052 /prefetch:1
      4⤵
      PID:7296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8552,i,5859549751647771968,10822414178459775460,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10760 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5792,i,11179458939469292621,12125193028560721415,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10752 /prefetch:1
      4⤵
      PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8700,i,8900988612908273413,13616054582352382126,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10776 /prefetch:1
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8488,i,4698699865034783519,3191276095020280904,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10788 /prefetch:1
      4⤵
      PID:7176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8632,i,15565904100513773412,17739339755041766887,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:1
      4⤵
      PID:7184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4352,i,17063148618389942571,9541732230363275358,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
      4⤵
      PID:7232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8816,i,7803468255404861275,5794274326232530304,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10952 /prefetch:1
      4⤵
      PID:7240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8668,i,12682884189669812645,17074799969771909260,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10888 /prefetch:1
      4⤵
      PID:7192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=9000,i,108801450296144460,7298184662547972526,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11412 /prefetch:1
      4⤵
      PID:7312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9028,i,9178972175286831814,11241190988963943473,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11416 /prefetch:1
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9016,i,5473517403708225645,10795767308520857544,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=10856 /prefetch:1
      4⤵
      PID:7336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=9060,i,12556588389649124565,9770836286819450718,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11460 /prefetch:1
      4⤵
      PID:7344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=5452,i,12341128560479260679,631046088803267325,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:7328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=5424,i,3868530214098071308,18036755842111230329,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11440 /prefetch:1
      4⤵
      PID:7352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=7440,i,3852886829290279138,17381146813200317455,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11480 /prefetch:1
      4⤵
      PID:7360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=5484,i,4920489780995135734,15219834481218974001,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=11408 /prefetch:1
      4⤵
      PID:7368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10588,i,15381067687420034031,8435529398724796753,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:1
      4⤵
      PID:7376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10552,i,16296982015833021264,14553692478528156281,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16144 /prefetch:1
      4⤵
      PID:7384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10616,i,2259824172562514643,11121138504418375740,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16168 /prefetch:1
      4⤵
      PID:7392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10532,i,13438720919875095179,13450399577599112165,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16156 /prefetch:1
      4⤵
      PID:7400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10728,i,2808343407803758975,692959168273591104,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16220 /prefetch:1
      4⤵
      PID:7408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10672,i,7593433763704726105,2371077691913746212,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16200 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10584,i,10753111840924468155,607599408933606130,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16280 /prefetch:1
      4⤵
      PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10492,i,13256883049920123371,8185858268856740926,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16180 /prefetch:1
      4⤵
      PID:7416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10704,i,10721127998193985469,18034805078810342868,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=16240 /prefetch:1
      4⤵
      PID:7432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11954868112400441673,18140913055135219848,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:9064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,16392586079239132437,3949070623881099545,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:14
      4⤵
      PID:9072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,5447314700598767228,8428185788894005646,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=17952 /prefetch:14
      4⤵
      PID:9080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=7648,i,10500530265157525184,4262137546346381926,2097152 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=14072 /prefetch:1
      4⤵
      PID:9724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,13341186221566655550,10630102925855447302,524288 --field-trial-handle=2192,i,5906610637788455280,8021487905434695487,262144 --variations-seed-version --mojo-platform-channel-handle=20184 /prefetch:14
      4⤵
      PID:9840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe
1⤵
PID:4564
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe
  2⤵
  PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4436
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe"
      4⤵
      Views/modifies file attributes
      PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe
1⤵
PID:5272
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb8f68mu\n3cncvan.exe
  2⤵
  PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4284
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe"
      4⤵
      Views/modifies file attributes
      PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe
1⤵
PID:4588
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8vbxioc5\d2p7xpsn.exe
  2⤵
  PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe"
      4⤵
      Views/modifies file attributes
      PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3392

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe
1⤵
PID:5948
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x12cqg4d\n6dwwncd.exe
  2⤵
  PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe"
      4⤵
      Views/modifies file attributes
      PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4240

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe
1⤵
PID:860
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25o5w6oh\3wuwv6nk.exe
  2⤵
  PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe"
      4⤵
      Views/modifies file attributes
      PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe
1⤵
PID:6712
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp0ela8z\no646ukf.exe
  2⤵
  PID:6788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6832
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe"
      4⤵
      Views/modifies file attributes
      PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe
1⤵
PID:6376
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf9501h2\okvphyhx.exe
  2⤵
  PID:6404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6476
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe"
      4⤵
      Views/modifies file attributes
      PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe
1⤵
PID:6180
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8jv9yxla\tlry33gk.exe
  2⤵
  PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe"
      4⤵
      Views/modifies file attributes
      PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3476

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe
1⤵
PID:7080
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x2mv0t5n\0msxjyo3.exe
  2⤵
  PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4904
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe"
      4⤵
      Views/modifies file attributes
      PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7008

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe
1⤵
PID:6888
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m3km4h91\02ejc1fo.exe
  2⤵
  PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe"
      4⤵
      Views/modifies file attributes
      PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1932

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe
1⤵
PID:2920
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b7bk4x0r\z088tgsw.exe
  2⤵
  PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6216
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe"
      4⤵
      Views/modifies file attributes
      PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9112

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe
1⤵
PID:9740
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4tjni3q6\9rlj19dg.exe
  2⤵
  PID:9576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f872s6pn\eo83btij.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7712
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f872s6pn\eo83btij.exe"
      4⤵
      Views/modifies file attributes
      PID:10432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ce8ce4fdaf9fb9a8a8f5b517625e5d2dc8126800eb8f791269b3299401b32f8e
MD5 233439238cf995aaa7db5360042553cc
SHA1 a95c5e298fae8804946e5bc53978cd52d9276d08
SHA512 e5ead068f8f4e60ca1fc3baac6ceb05c43ad143815fde480612add43636371673370635062db830646c1f0d2584d2977da0c6275d316e9272b077374b3593213
TLSH
T130714096C3671493CB6CC87368D198B4B3FA858D82478F20244E9EF5C95AF28D0D1F6B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a07f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a07f0.TMP
Size 2KB
SHA256 5da40bfd71c2dc841a96af5263c8ef6b26df4a8fd31e82d6990da4ab5d33cfd3
MD5 e95e0541248af524b0d7c37d9d24b5c6
SHA1 f41f2ae33f7466b9d218e15d10d59484544a045d
SHA512 2fa8964463649e275e6af0fd30bff94001d72ac139586c54d6529eec729b17f6a600b727c49da55083600da58f0879952cc1895c9fc5bece2b34e58f7bc9b46b
TLSH
T17F51E6D4C32318A3CB6DD47369E195B8F2F7858D82438A10681E5EF5C90AF28E0C1F63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d4a7d34e229594be64e78ee909d38cc0ad67be89ad707edbbf3c4350c786f16
MD5 ceff8fcc2398c729e582b362d51d141f
SHA1 a42fcc71883ad1036c2981335d21d9f18ea8f9c3
SHA512 c3f8bff34b6d0b89551b0893d32f106c85ac4d428a0b68ade03d9c8047164818080b08ed0b10ded375e5e28ca97eab4ec5e35942ee1a03dd4787054dfb6659b4
SSDEEP 192:sxRRaRBCJ/f8sZd/Hm2Sm7agJzoD8pKIp2FXHg6+WNs079sbfYBDj2wKGvIgVT+J:sxRQ6J/f8sD/2S4t5XWfSho
TLSH
T1C642CA1A9A28A93B4CCBE219FA55BB53D3F9103261E15F94FBFC8A1C04E66DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c4652082099cc59f53f7fa071214ab94534a0ebd5ee56e7b04024caa697ae47b
MD5 d934ad8b48931b94faa2ad22a06a2c62
SHA1 5f421a1a9d96813b7cd5cb38905fe182128b5cd4
SHA512 6d18df5efbb3e38d88b66ed92e72fb8995d421b592164e7ea94be8570e84c0565f4308d07824d0e203017c49c5744a274a4897fabc28c39808f8ea0f770b44b9
SSDEEP 192:sxRRRRBCJ/f8sAdVHm2Sm7amJzoD8pKvq4uFXHg6+WNsRXzLgdXlrbYBDAmKGvIv:sxRT6J/f8swV2wZt52gDrb2O
TLSH
T10652EA5AA938997B4CCBE219FA55BB53D3F9103250E15F94EBFC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 296266fe47b7f0a5451a52bcbe24afc5f95895580fad0c54feb12d7e7d5da096
MD5 7389b05be8ff0163228d9a9ea2f4ed96
SHA1 f492fee5f32fd117bb94b7228282b74bef8b6e54
SHA512 0f5e0f4af36c78f6db090d27971ffe85a48b911b3e14e49ef74e7d5873f1a4b78fc5e10741961e0b2eb819b5213a7f44d3cf5c3d20893fc0dba346962ce53ba3
SSDEEP 192:sxRR5RBCJ/f8sAd/Hm2Sm7a2JzoD8pKJ02FXHg6+WNs07lMz9sbfYBD32wKGvIgO:sxR36J/f8sw/2Ykt5XqWfihO
TLSH
T19352EA1A9928A93B4CDAE218FA55BB53D3F9103261E15F94EBFC8A1C00E66DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 15a08d16912ba9d76ac4b1f246c624381b66296d2dbc9162fd95ab82b2fec15e
MD5 2659dca02847a7f7413460961d46ea61
SHA1 9c5fc904d4320384d26921e9799c666ddc9d7037
SHA512 538b4b66da0b619c1879e0c598003050fcc19a8885f982f5c3becf3b84ba2e43aaea26a775a2f28e36a0aa7563c7e24e1efae55494a593acea6b5532669197ba
SSDEEP 768:GTEbGo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQMWcIroS4ie:GTEbGUE7lkWg0CfKsu1jaPFczS3e
TLSH
T161C2EA7B740DCB7E4F804ADDA819BF9B6D6802CB5A98CD8047FE851C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 80ca99ceeae99ba8d580451e69e20b11b42c58457ab4867b4956d91f48b75366
MD5 27ee55cd53360f41dd44f53c102c730b
SHA1 3e386fd0fa6e9b9bd4f502aece516e0e65744179
SHA512 4400c456ee2ec1726635a876bc6b5036ce66c52bcc0c42de9302944dbfd037eebeb28d52112dcd41ff12a387cd3b037fce1eb1232a3ce3a2a51f4a63d74b6d85
SSDEEP 768:Mrv+4UNbd43AIc+wfZOcfV66cf066EvShCQs02bwWV:MbsbO3Bwfffc6cf36EvST0wO
TLSH
T13E03BF71E87865339EE39A44764ABB13BFB99263C4C54684DACD0B0D01C769E331BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 654c2c24e8c15fdfc4e526d5e89e8d01e6bd2a5ac096e332059d193047c77fcb
MD5 041cb75dc18d356ddac8e1f90e2e2093
SHA1 36d4274205f98a3cb79c6b3ecf34d815033c89cc
SHA512 d0f2b055d551c5bc0a32d5ea6e20a54083e404418e9bd641c6fb779fe88645daaee2e08e846ceb4e540847fe2484e3cce0fc378e410aecdccc2f7a94121af76e
SSDEEP 768:bt3PsU/Gc+wfZOcfV66cf0661vShCQR0fkyN:bt3kUMwfffc6cf361vSgfkyN
TLSH
T152F2AEB0DC7069738DE59784A7466B13BFE59233C5CC9A88DDDD4B0D01C36AE271B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5a35e273295d49725624fbcd4991e3913f2099d0254b55dae33295926b3e2ba2
MD5 3ed3da51d759bbfbf00acf89b07706fa
SHA1 a66ca7f58440933d03bfbc0acbe15792d3cf3555
SHA512 903bc6a7bb4f7304ad583c03b7551c64ec853c2affb1bbd84199643d66010e3bc57d48cb54d58e61ed95762663029209a48cd6d315898db09451a3f454c1cd70
SSDEEP 768:trv+4UNbdA3WsUQOc+wfZOcfV66cf0660vShCQR0oi:tbsbu31UPwfffc6cf360vSgoi
TLSH
T10403BF71EC7466338EE29744B2467B13BFA4626384C95A98DECD0B0C01C76EE370BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 eef3ce987951eaa80ce2e39644e25470bcb7309e53263cea310c609bb01000b7
MD5 b5946999ce27b1f9d9619df193108a9a
SHA1 9ae822335f369e3b9a0fad5452a679cd7b1ff7f4
SHA512 5f47fe1c647a2c8e9ea39c63d6cbd710e3b985b178e84320a8d00f403dfef22f4f1e4aeddfa881185809bf50b5a4ef540dbc5ffec7428e17c8c3887f8ccc0f26
SSDEEP 768:Dr3WsUqsc+wfZOcfV66cf066evShCQR0fkyN:Dr31UTwfffc6cf36evSgfkyN
TLSH
T1ABF2BEB0DCB069738DE59784B7466B13BFE59233C5C89A88CDDD4B0D01C36AE270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 19133d7dc5383c15deee3d49773ca151c380c957b5749d79906247e047e98133
MD5 a5cccfc19bac92cc63337589cc451798
SHA1 b2767ca1148f13e710ec88869fc6b8e777e5865a
SHA512 d539ea8b926d0e000a0afdb7f747061d16942b3d215492b362503ccd821aa60253c28e3b2dcd6d94b0b5de5a29e64b364fe5c85cdd7ec96a0f5c39145276950c
SSDEEP 768:DW3WsUGCc+wfZOcfV66cf0661vShCQR0fkyN:DW31U9wfffc6cf361vSgfkyN
TLSH
T166F2BEB0DCB469738DE59784A7466B13BFE59233C5C89A88CDDD4B0C01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f4828704faf17bfd5d41962e4eba0bed2cd002dd0584982e2c7a416ec8e1214
MD5 646a9b80622bcc38d786df96a91b32f4
SHA1 ecbd80bb5bab4e1fdbaf2a69a001070bc6ec2542
SHA512 ef6ebde87a72d0c452a0e1d5013b91d10e726c11b8c1e46597e2d498c6ce4d115b5b8c6785a1e5ffd671fde2caac8392a5dd1e7a5d8297c6c301fd47025cd73f
SSDEEP 768:Do3WsUHmc+wfZOcfV66cf0661vShCQR0fkyN:Do31U0wfffc6cf361vSgfkyN
TLSH
T175F2BE70DC7469738DE59784A7466B13BFE59233C5C89A88DDDD4B0C01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8b4d528548178d76ac66f7ca9f87db1fb31d6f9df1aa1e8fb7a5aec3d14ac1c0
MD5 b6378d5e9ebe0ba6736c0e1466de2a2e
SHA1 0546fdd6cd5d5cc930801ae0800b49ec02e45bde
SHA512 c6bbca4cc4093602ae1a4f373d616494a5567b49c7e35540d8edbb2921ec06258f4b576c094eaf4039de5ca25e7b27bd45566c31a325e116edb941152f74766a
SSDEEP 768:DR3WsUmsc+wfZOcfV66cf0661vShCQR0fkyN:DR31UPwfffc6cf361vSgfkyN
TLSH
T10EF2BEB0DC7069738DE59784A7466B13BFE59233C5C89A88DDDD4B0C01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5ba2943ef609875ee6c2e623315536dc982ac308715b3d47ebf9d864360f14e6
MD5 ed433158595b8ef4dd287f65afb6660c
SHA1 fbb4061c68d8d8897457ba885a409ef08863374c
SHA512 7718dbe11244e484bdf4a7422b709d5d3d8df0ff7ca15b736a0efc32315f7ae6cf714ae3accc6b178a3ed778fa02818fa87e8137197314b621a2366890f9653c
SSDEEP 768:Dy3WsUEqc+wfZOcfV66cf0661vShCQR0fkyN:Dy31Ufwfffc6cf361vSgfkyN
TLSH
T1E4F2BEB0DCB469738DE59784A7466B13BFE59233C5C89A88DDDD4B0C01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 208c88e73b7483d98fc7634835d09d11aa42bfd33f0802110a4716a9ee403e6f
MD5 b58f5f11f2fb82e3e602eeaf09c63410
SHA1 8a1c96296ccdb31c25acf878381e087d7c6ac60a
SHA512 f1043ec8d9e23fb3811c8161c39233d1532bb31c7dafc6307d56331abf229a77ed0b41179bdb138c3bb29bc19c4dfa4399076a980f313e51292499bf097cdea2
SSDEEP 768:D+3WsUQyc+wfZOcfV66cf0661vShCQR0fkyN:D+31U7wfffc6cf361vSgfkyN
TLSH
T102F2AEB0DCB069738DE59784A7466B13BFE59233C5C89A88DDDD4B0D01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0652de119c0ff3bf9d3cdb527d37bbdb76ec313fa9ba181ce97822a724e6ae58
MD5 e6bae63bdef4d06556079c82edfacceb
SHA1 c34771c2146d6600c3119e34993b9c85b58ba79f
SHA512 ff15216191de597b5c3827a4276e557260e9abdc7ad1934964bf0ecbc2e9adedf04d477e40f7cef6936e0136fcda494ffec01dac76c0ad4bdfb98d4aec37e1c6
SSDEEP 768:Dt3WsUWIc+wfZOcfV66cf0661vShCQR0fkyN:Dt31UHwfffc6cf361vSgfkyN
TLSH
T1ABF2AEB0DCB069738DE59784A7466B13BFE59233C5C89A88DDDD4B0D01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 54b0f472398fef0d98f59b57a2dd5e2da829dd4eb3c90306f3da1114b2acebeb
MD5 6282a3e3d736f6adb91486b1b9f3f110
SHA1 593ecb3e53009965a029a83ff10fa415fbc3fac9
SHA512 925373dc5e2d872d4851234bcb8735a6700160d4015ac5fce0554197afe505b6147595ac3f841085ac9821a9b5be37f157bc7a5dccfbac097310e84d55564519
SSDEEP 768:Dy3WsUSkc+wfZOcfV66cf0661vShCQR0fkyN:Dy31Unwfffc6cf361vSgfkyN
TLSH
T1A9F2BEB0DCB069738DE59784A7466B13BFE59233C5C89A88DDDD4B0D01C36AE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5c158119099c5f3dbde0111480f28fd46b0e1d6f93aa7294be9c392e03977dd6
MD5 d243168cd09349924d2293ebffd9bf83
SHA1 b9d1296fafc6cdb4b21fff95e554c301774f7b12
SHA512 39cf54bf1a7859ef7878afd2aa50d1388df8ab015b4e31dcecd85f0248b760f04cfb04b1aede61bd014cd4671f55acd5c694e43e6395dd5e43cdcb3c094bf1cf
SSDEEP 768:Rrv+4UNbd43ECkc+wfZOcfV66LvShCQtGy2bwWV:RbsbO3Enwfffc6LvSb0wO
TLSH
T15E03C072E86499339EE792487646BB637EB85273C8C54784DACD0B0D019369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a8dd684d241bfa941f6b149f7677ed6ef01b65eccfdef5b6c573e985dab4c6e3
MD5 942a78ab29620abe51c037ad9d1f49b8
SHA1 250b45c97392ccb1fce9ce224c2196666c2018ad
SHA512 1b2a2ce3685c69b32940a9609598ac0debc2e5c8c737f98d3d1371fee850fec55eb852fb24d9003996f73df7986295be00a07aba618af1b0768cd406b259187b
SSDEEP 768:9rv+4UNbd438mc+wfZOcfV66cf066EvShCQR02bwW2:9bsbO3rwfffc6cf36EvSg0w5
TLSH
T1C303CF71E87866339EE79A48764A7F53BFB95263C4C94684DACD0B0D018369E331BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f9487e3c618e043225d39c38d4cc1c4e78ab631f89e31c95ae575aa5025a996
MD5 08462a3af3bdc82559d9f70f7b3194c3
SHA1 47b7306c1a456c828407a0f48cba02f4b9f6e96a
SHA512 0ee93aeec4f74f9a52adb68d6d8a766aedfa518477787469d094635df36ea92e7361344c8c14c05cb4598e91470fdb5aaaa2b1dd1508335484844344f9ff580b
TLSH
T119E00203A38005EBD06C1330609A53283363C238138203C7DC0141A46D007001E219D5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59f999.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f999.TMP
Size 392B
SHA256 9022f8481cc9b3b77e0b4b73a828cd16589cbfe14ed9cbae651bb61a902686ef
MD5 b2152dbd6a59adc778d4bcc6b22b6ed7
SHA1 779c241cb9867a7b3a4faa35a6b660d0779b2830
SHA512 fa0afc04807ec90e051db49587e107192c52562a1f164c41a1dcd35e17ed2cc9121ed2ac286ab9775d4916549082db21e4065e37309cfdcfaa37fbe6483aa6cb
MD5 SHA1 SHA512

Submit Download

13b84249-9a9c-414c-84ee-4a5ff18e52e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13b84249-9a9c-414c-84ee-4a5ff18e52e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5974f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5974f7.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8567993-c8db-4209-949d-6b8969ea1bc5.tmp

Path C:\Users\Admin\AppData\Local\Temp\d8567993-c8db-4209-949d-6b8969ea1bc5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1724_1841310272\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhms8zax.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zfszhyg6\qhms8zax.exe
Size 5.4MB
SHA256 5cd05d1d94d9bf17d8bed88700a5f0b06f20c693110a1f7f2d0afda83082129b
MD5 d5366bf771b5401bde240b16b78f0ba7
SHA1 b58e88e81939b53d7a9124e5faf2ae5ba7fed877
SHA512 2c48f142c502d9f2cbbb7601b9f16e3369c115cb2ad9926922190c2bf5618349b740c0fabdfa0ea9d38ae612e34cca0997ef5dc91a0cc716ec63646dc9484960
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRu:OrICteErownP0oTcMsABqlaOzU
TLSH
T146463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads