288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50

Analysis

max time kernel
4s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
Size 5.4MB
Sample260826-v2cvpstbme
SHA256 288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50
MD5 ef24828fbecffab877aac2973302dbef
SHA1 5ab8b93d56211dfaffda234112808a1305d20e9f
SHA512 0eb9a565e6468cfb606c07ee3f41ba0b8dadb0b6bda03f78e432b99a553c4df4cb1c6ef6f63095444d05b403849df2b98cb7fdee7335c6e26f05363f4e02ded7
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uL:AsTICteErownP0oTcMsABqljkO
TLSH
T1B4463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6769
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9358
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2735
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2573
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3314
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9390
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6019
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5419
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9634
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2098
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8019
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7540
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3612
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3165
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5899
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1027
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4748
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4671
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8707
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5999

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q3hc00.exe	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q3hc00.exe	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe

Executes dropped EXE 2 IoCs

pid	Process
5824	5vi1x1bc.exe
4792	5vi1x1bc.exe

Loads dropped DLL 11 IoCs

pid	Process
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\09k3mg8k\\5vi1x1bc.exe"	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
234	ifconfig.me
246	ifconfig.me
359	ifconfig.me
2202	ifconfig.me
475	ifconfig.me
1791	ifconfig.me
2090	ifconfig.me
114	ifconfig.me
244	ifconfig.me
405	ifconfig.me
566	ifconfig.me
2158	ifconfig.me
3228	ifconfig.me
1465	ifconfig.me
94	ifconfig.me
1092	ifconfig.me
2126	ifconfig.me
2441	ifconfig.me
2459	ifconfig.me
2491	ifconfig.me
2865	ifconfig.me
3142	ifconfig.me
132	ifconfig.me
212	ifconfig.me
955	ifconfig.me
2693	ifconfig.me
2979	ifconfig.me
3147	ifconfig.me
3184	ifconfig.me
3327	ifconfig.me
617	ifconfig.me
2058	ifconfig.me
1547	ifconfig.me
2715	ifconfig.me
441	ifconfig.me
1619	ifconfig.me
2314	ifconfig.me
2862	ifconfig.me
119	ifconfig.me
2116	ifconfig.me
1	ifconfig.me
547	ifconfig.me
1710	ifconfig.me
2306	ifconfig.me
239	ifconfig.me
1108	ifconfig.me
1389	ifconfig.me
277	ifconfig.me
284	ifconfig.me
472	ifconfig.me
200	ifconfig.me
276	ifconfig.me
335	ifconfig.me
543	ifconfig.me
573	ifconfig.me
260	ifconfig.me
611	ifconfig.me
1588	ifconfig.me
1811	ifconfig.me
456	ifconfig.me
823	ifconfig.me
932	ifconfig.me
2517	ifconfig.me
128	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6260	cmd.exe
2052	cmd.exe
6128	cmd.exe
6952	cmd.exe
7156	cmd.exe
7268	cmd.exe
8240	cmd.exe
3360	cmd.exe
1912	cmd.exe
4764	cmd.exe
6340	cmd.exe
6408	cmd.exe
1580	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4632	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2392	4472	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe	89
PID 2392 wrote to memory of 3360	2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe	90
PID 3360 wrote to memory of 4600	3360	cmd.exe	92
PID 2392 wrote to memory of 4632	2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe	94
PID 4632 wrote to memory of 2340	4632	msedge.exe	95
PID 2392 wrote to memory of 948	2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe	146
PID 4632 wrote to memory of 1460	4632	msedge.exe	98
PID 4632 wrote to memory of 2580	4632	msedge.exe	99
PID 4632 wrote to memory of 2580	4632	msedge.exe	99
PID 4632 wrote to memory of 2580	4632	msedge.exe	99
PID 4632 wrote to memory of 5104	4632	msedge.exe	100
PID 4632 wrote to memory of 5104	4632	msedge.exe	100
PID 2392 wrote to memory of 932	2392	288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe	101
PID 4632 wrote to memory of 5760	4632	msedge.exe	103
PID 4632 wrote to memory of 6016	4632	msedge.exe	104
PID 4632 wrote to memory of 5760	4632	msedge.exe	103
PID 4632 wrote to memory of 5760	4632	msedge.exe	103
PID 4632 wrote to memory of 6016	4632	msedge.exe	104
PID 4632 wrote to memory of 6016	4632	msedge.exe	104
PID 5824 wrote to memory of 4792	5824	5vi1x1bc.exe	105
PID 4632 wrote to memory of 5656	4632	msedge.exe	106
PID 4632 wrote to memory of 2420	4632	msedge.exe	107
PID 4632 wrote to memory of 5656	4632	msedge.exe	106
PID 4632 wrote to memory of 5656	4632	msedge.exe	106
PID 4632 wrote to memory of 1580	4632	msedge.exe	257
PID 4632 wrote to memory of 2420	4632	msedge.exe	107
PID 4632 wrote to memory of 2420	4632	msedge.exe	107
PID 4632 wrote to memory of 1580	4632	msedge.exe	257
PID 4632 wrote to memory of 1580	4632	msedge.exe	257
PID 4632 wrote to memory of 4164	4632	msedge.exe	109
PID 4632 wrote to memory of 4164	4632	msedge.exe	109
PID 4632 wrote to memory of 4164	4632	msedge.exe	109

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4600	attrib.exe
3808	attrib.exe
1892	attrib.exe
4748	attrib.exe
7024	attrib.exe
6360	attrib.exe
2716	attrib.exe
7324	attrib.exe
3812	attrib.exe
6400	attrib.exe
7108	attrib.exe
6060	attrib.exe
9852	attrib.exe

C:\Users\Admin\AppData\Local\Temp\288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
"C:\Users\Admin\AppData\Local\Temp\288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Temp\288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe
  "C:\Users\Admin\AppData\Local\Temp\288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe"
      4⤵
      Views/modifies file attributes
      PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x34c,0x7fff4b9cc188,0x7fff4b9cc194,0x7fff4b9cc1a0
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8842996889595324100,17795016897433061131,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
      4⤵
      System Time Discovery
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,14915384408899992270,14621730264028942664,262144 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,957880202483330900,13806295065619650349,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,11695260338174630538,15951228485972618462,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,3369414957459318464,8254864719641864777,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8923028948438759326,16653282954043217087,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,1022335666531156177,10255566103631187519,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,9567690012766545962,7022007493186439289,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4092,i,15080363633540478352,5134595525735945713,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5616,i,15388687240462365713,7276766069472811658,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5792,i,8683141395351387770,11234096393034299082,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,4406546658006254365,16600333675546514549,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6156,i,8801951998556354009,9811158330726707143,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5980,i,12971894397349059283,7965182429798660164,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6320,i,15240648748050904390,4110113750787062124,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,4560112334771535557,18404210640701550217,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15103461210304289695,12151183148456564208,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,7025368578628529926,12634831127024249229,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,7025368578628529926,12634831127024249229,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7036,i,7738355241216787685,18378515805983129205,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7072,i,2371501789935044653,14119139097131664919,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7088,i,101724055415715257,3273940792096172643,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7100,i,855345315920090264,6253683007860230420,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:1
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7156,i,4714473003453278383,1310457777090809155,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
      4⤵
      PID:6644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7180,i,5507275296273249154,3274731813265033334,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7208,i,8643898053009727173,2463412004737436756,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8828 /prefetch:1
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7656,i,3977209061597256356,5959389808462070052,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7720,i,5839692325206677999,4515993854592763818,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7748,i,18017794916853194054,4441731886352721589,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7976,i,15754250580306463579,13336107675336801696,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7996,i,9738705907162320362,3938967852511210972,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8040,i,12052395531959079591,8633788723607170419,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8012,i,1401969294348184780,10404290793547026016,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:1
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8088,i,4632045552413439504,12826401302867446502,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8196,i,4008300134130499672,8071867377530503547,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7780,i,9511536162216658600,495421577662003749,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7680,i,14841772331374912599,5611570315752210869,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7240,i,12227510308143417678,17480280106919955836,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7992,i,7831211115978368974,10518989201542417794,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8140,i,5017259657590148682,5336797775608561657,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:6808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8204,i,7729583359030084827,14878149413960032717,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:14
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7588,i,1149542940454712980,10300391949146780065,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8868 /prefetch:1
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,18377165638808584951,12702657225054946318,524288 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9180 /prefetch:14
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7628,i,14126705935460353684,3463899774246145923,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
      4⤵
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4516,i,3337130034218787796,9660683690823482353,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7496,i,1606249343143921385,4788462132340875432,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8444,i,10641242248535520661,2485250178130906975,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7600,i,7754732580356310740,11303616007066046408,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8456,i,5541304706256475500,163778342505181465,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7484,i,13775574657760124294,16198251746813076580,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8504,i,10749543279056844990,7411492251331556789,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:6996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8552,i,16877090005700047627,3235956083403739443,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8568,i,16670480597898458894,7154775240296253894,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9284 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8576,i,7191638771767501669,11529696731687438317,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:6984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8212,i,10359309553358291200,14116589555656973151,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8592,i,4437118389803521683,10444729460791487075,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8660,i,15070297394618499514,512823528408527003,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8640,i,13273308703221306630,4920946709234993993,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8664,i,1192673679535036363,15086406965792620316,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:1
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8704,i,9888922913233945378,9359210353340405362,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9380 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8720,i,10672424508197567006,16988610326120132310,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:1
      4⤵
      PID:6960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5696,i,3722234954393072238,13129363243025878713,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=5588,i,5585403917942247510,14082216764300394437,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:7764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=5636,i,2021734473659625036,18276834569435947758,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:7772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5008,i,12544483769305737728,13910858396100294565,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=4964,i,1188523411040341294,18291293047815432006,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:7788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5672,i,15620181983819059685,15328499313802144884,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      PID:7804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8520,i,11511492635709961425,16204511336430800006,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:7796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=5716,i,2681992993573203838,12214803863434606908,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:7812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10220,i,3329972561667222167,16868154051465482892,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=14892 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10196,i,13191684286756555911,3486624556130973872,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15176 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10208,i,7099223864360830374,2044740234384440919,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15172 /prefetch:1
      4⤵
      PID:7848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10156,i,1105804566379805115,7506828033089018285,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15200 /prefetch:1
      4⤵
      PID:7856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10292,i,7102961756101328937,121446421243051715,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15220 /prefetch:1
      4⤵
      PID:7864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10056,i,17191771285178035040,6152968439290326949,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15188 /prefetch:1
      4⤵
      PID:7840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=10380,i,372558950368288208,6373574759928062788,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15260 /prefetch:1
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10404,i,12810284064661112417,16784310807457224562,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15300 /prefetch:1
      4⤵
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=10416,i,4581576528695153656,9542439346916024010,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15280 /prefetch:1
      4⤵
      PID:7896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10468,i,11785608772107189998,4535514828582961120,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15396 /prefetch:1
      4⤵
      PID:7904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10356,i,12170230640281307252,14697803482849027901,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15416 /prefetch:1
      4⤵
      PID:7912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10540,i,10669673930454259941,16800222432438514616,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15456 /prefetch:1
      4⤵
      PID:7920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10508,i,1395584927629696877,5180789959969687166,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15436 /prefetch:1
      4⤵
      PID:7928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10612,i,10806047098519075103,14819133921247551154,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15536 /prefetch:1
      4⤵
      PID:7952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10320,i,15477481104023195516,3816003957350741158,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15240 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10556,i,6255065031878637726,4605955842729141792,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15476 /prefetch:1
      4⤵
      PID:7936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10336,i,1043136892812608025,8219593495714224406,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15496 /prefetch:1
      4⤵
      PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10684,i,3525982452100776360,159884285395196273,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15516 /prefetch:1
      4⤵
      PID:7960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10700,i,13209915539610596605,691141912261582788,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15556 /prefetch:1
      4⤵
      PID:7968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10584,i,3171354783212786668,8440358750805794571,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15824 /prefetch:1
      4⤵
      PID:7976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10744,i,21720652402981611,13005157226060192672,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15828 /prefetch:1
      4⤵
      PID:7984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10672,i,17262579572549932352,11856059873358285695,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15820 /prefetch:1
      4⤵
      PID:7992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10776,i,727834985211539251,1293121672667847035,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15704 /prefetch:1
      4⤵
      PID:8000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10780,i,2422437680592057671,2918693373114130974,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15944 /prefetch:1
      4⤵
      PID:8008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10848,i,12532352027711802246,13344541412669852696,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15948 /prefetch:1
      4⤵
      PID:8016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=7880,i,14286303387182962215,11481912961281073157,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15960 /prefetch:1
      4⤵
      PID:8024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=10856,i,5204671430061730706,9843502493688418945,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15992 /prefetch:1
      4⤵
      PID:8036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11020,i,10406315083744219474,11925338805883990677,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16060 /prefetch:1
      4⤵
      PID:8076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10996,i,15776225559793103127,15837266913810361021,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16100 /prefetch:1
      4⤵
      PID:8100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10908,i,12902752995945225954,2488856276718307276,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16032 /prefetch:1
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=7876,i,1965711380485143641,3796962614091387917,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16012 /prefetch:1
      4⤵
      PID:8052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10836,i,14089318996949374843,11463151561236231496,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15604 /prefetch:1
      4⤵
      PID:8060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=7884,i,5208927886799945097,7690927618818483625,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16040 /prefetch:1
      4⤵
      PID:8068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=10892,i,14560231606954825704,13817685674595208232,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=15972 /prefetch:1
      4⤵
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11000,i,928276505608201804,7167907832078079926,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16080 /prefetch:1
      4⤵
      PID:8092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=11080,i,14597251334185412100,1353515363973567694,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16152 /prefetch:1
      4⤵
      PID:8108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11152,i,10084759080323521425,3535331118533273148,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16284 /prefetch:1
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=11100,i,472503727827376995,16791174593404105288,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16288 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11116,i,9914936254248330389,14037783826991808812,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16268 /prefetch:1
      4⤵
      PID:8132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11120,i,14871540787881243795,11727053319149922686,2097152 --field-trial-handle=2104,i,5412312153587341777,2753644120786041399,262144 --variations-seed-version --mojo-platform-channel-handle=16280 /prefetch:1
      4⤵
      PID:8140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4704

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2052
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe"
      4⤵
      Views/modifies file attributes
      PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4564

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe
1⤵
PID:2672
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\brdxtf4r\ebp1ttpz.exe
  2⤵
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1912
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe"
      4⤵
      Views/modifies file attributes
      PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4760

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe
1⤵
PID:2908
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njh8lgqe\xayqo2gn.exe
  2⤵
  PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6128
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:948
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe"
      4⤵
      Views/modifies file attributes
      PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2828

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe
1⤵
PID:2552
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0p9k38m\g0b4i904.exe
  2⤵
  PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe"
      4⤵
      Views/modifies file attributes
      PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2072

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe
1⤵
PID:6216
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\elxitjmc\2fgseil3.exe
  2⤵
  PID:6292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6340
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe"
      4⤵
      Views/modifies file attributes
      PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6660

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe
1⤵
PID:6832
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7kwhhssu\4c4nz36d.exe
  2⤵
  PID:6904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe"
      4⤵
      Views/modifies file attributes
      PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6316

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe
1⤵
PID:6552
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2i6ridg1\g1amym3v.exe
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe"
      4⤵
      Views/modifies file attributes
      PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6564

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe
1⤵
PID:7116
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aisnqlr6\a1qoif6n.exe
  2⤵
  PID:6244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6408
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe"
      4⤵
      Views/modifies file attributes
      PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6488

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe
1⤵
PID:6420
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c5oh0kdf\zln7si8f.exe
  2⤵
  PID:6328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe"
      4⤵
      Views/modifies file attributes
      PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1540

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe
1⤵
PID:6488
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l170pd5g\m7p65xhi.exe
  2⤵
  PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6260
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe"
      4⤵
      Views/modifies file attributes
      PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe
1⤵
PID:6280
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\67oqsa7m\8nq5lksp.exe
  2⤵
  PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7268
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe"
      4⤵
      Views/modifies file attributes
      PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7600

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe
1⤵
PID:7716
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i4ex31z9\30ok27g8.exe
  2⤵
  PID:8352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j7izyv54\vk2c6t19.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j7izyv54\vk2c6t19.exe"
      4⤵
      Views/modifies file attributes
      PID:9852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13972fae-3831-4635-a379-59e61a5aaffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13972fae-3831-4635-a379-59e61a5aaffc.tmp
Size 39KB
SHA256 606339f302775fa1b4f2d0f37e91f721abe1bdc990777bffd8fd6a4b1cc112e3
MD5 044970394cf9c638608279d3a782d03d
SHA1 74f4878c6d63a25dc61c462eb1ec6aa63973d555
SHA512 588c1d8ad15f8214d0bf86f91ce625238c508bce22d694ae955c1c7467085d8e9e2d9acaf24ddf948a1b0e0de5fb8d07e42316215809370793181ae680ed49ee
SSDEEP 768:Wrv+4UNbdD3bkJxNp8+p3bd66j+4BRv86aLITN2bwCl1:Wbsbp3OL8+p3Z6n4yg0ww
TLSH
T18E03BE72F4A9ED739CE6C644B24677837FB811A399C10ED4E4D96B8E005A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 42KB
SHA256 326f4e187050c074444e5ad53e90117d02a58fa8c610594fc194331dcf9910d4
MD5 863e9af8b3fd0e5369224a2d0614b207
SHA1 1b33f68a0e901b2dd16f45000e8a6082f0d03d25
SHA512 6fb7956976a11a61d0927e7de1c89d7487d72cb2061a7734efca10fdf5346a34501092d8e630fd32db65d2e9fa8951bc398adc56e2c75c59fb6c29231b7783bf
SSDEEP 768:qu7yxLKx2Db7X2dlyqW7jc7/8NvJnWTAt2BjCjJY7+5gzaENw/PloL6IPZlb8bK1:qA4y2GdAqh8NvJqAtyjCtlazZIPdd7ar
TLSH
T11313F132E312ADD73564D0FCBCA36EB4E7E5771A5C5180071235A668ED0A36EAC68892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 75KB
SHA256 c211bec311a2fd8ba6601882b020e3afb8a6f5f1f33cc40a455258bf6077e5de
MD5 7eacb7853020981ba75b93f4942e4aaa
SHA1 b8d9ba38680975588bb89c095c0768bac1d7a313
SHA512 90c227eed13f415451af71209dccce7c47a7407c7a8262f465f1310e3e58b42c9f3425d3b18cacdbf452e55eaa4d5dc2fd4e2a8dd145dce51583ff4166e0ed55
SSDEEP 1536:+qfhLTkIKY49Uc+iH1QBOHuBh1ZkBHBaQzTZpR/ORUH://RiH1QGuT1OVyRUH
TLSH
T1DF73028997F99AFC9F773F19970C5800FA57796EAF32010C5EFA520DA6C6159D00B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 219KB
SHA256 8900cd732c221da94e4907ea5aa83891d6e4006d14522eb9d36d1195bc08bae2
MD5 4709f7251ed97f6490ff0df8313099eb
SHA1 740d1ecbbb4eded97c7df384ac3f7ec9e7d817fd
SHA512 5b28508a229c2ea8aff7da25a40113ef2394bb5bf27d79cdc674ca9c8a7f0f99037c3a83505550909469069acf23842d0129bae8fcf7313b87cf0fde297546c6
SSDEEP 6144:Jz4qLf6scXGmpts3a6Ofy3lLwQjLtumtC:JcqLKXlptIaJfqcSImA
TLSH
T1842423E6C1B2475DDF0C8E3E532AFF862B2518829BF3FC595B8AC45714CF16A14B4162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 281KB
SHA256 22b4fd3ffe961a4c92dcb22d3eaebd202bd3f2f0a6054c63dd247bb3c874c1eb
MD5 260b857b997e2317bd2381bdf2355430
SHA1 a4d05a19fc48d0104bc8d061d2e4f6fb346f4c84
SHA512 a1a3f92ad147fddcc537169fc77fe347f3369c64a53a995f6f589860bc1634fc45542375b03d4d507f2e6c076ea5ff9aa9c675f0a26780104480ec93a54932e1
SSDEEP 6144:K7eRkHhzc5OaM4LhvEIrIbhqax/+xKFB+37mCtE3qEhXQ5:ORFc5CBrhqax/NfMmpq4U
TLSH
T1335423365B70DA15474D936BFA6D2762F09AF0DDC022A09CD687D83F373B899AD23844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 633KB
SHA256 f4df8b78831cea718e0e151616d663cb2912b0cfad0275c98ad8424fb9f4772e
MD5 2780ca0f31e39a809e393d8f41114477
SHA1 7805658cc5e5a95c9c4727c17e9743785dc61c38
SHA512 49f1e6f99855ef3af56e6e949aa0faf8190cc74dc931f50cc07d64d99bb98e15226a0aa21b1aae4cb5f6b924f227ed7957193da9dc5a6590e388d2358c8babb0
SSDEEP 12288:Gsc1mjLRtJ23uwzP/hka2xxRpysO8jA2GizoNT4mt+7r0F1bsRntDo6C:GF1mjLRnsuwVka27XAwYTm7UbsFa
TLSH
T1DCD4237B1BCC5B3207C0BABEFBA3606FA7327DF95903562C95B15DF7081685A85608B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f0da9cd3efde283cc229a9b09a41d18e144dae59768a513ee23d6cb926352f4
MD5 838041291fd7ff35f044af1c21a95e17
SHA1 40a5d001e8ade9d97f61435ee41b27d9cc3086fa
SHA512 b27b8b92b06beba0286f5ebd7e7b69f17364693af47bdc895ed0ee937994926d4593daba7cdaa873988d0ca9e8105f79e7ad0a5707a62ea53b8904a1691ea712
TLSH
T13A31BEF3C6E85A3D894146F87B153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8557a92764948ca65f914120641fcff69b2dcd941cc7511d35a1d3ec70e39aa5
MD5 515e78ad3f85c2e9a328cb1d5ba4d761
SHA1 ffea093ea2123a8d3118aaa00fcb77497af73582
SHA512 5cdd50dbb1d6236c71a0c0839051817135ebf0606f209cb7afa3823fb34e70268c9d0d85aa584b9ff9182230de4a72be79771131ea74da8006e709cff08b6f66
SSDEEP 192:sxRUR/tC6/fssTnDde5lSvzoD8pKdcEFcHg6+WNsvY9pDfYBTHIuO+GjIgVEJ:sxRURM6/fssTnc5lOOa59PfBBO
TLSH
T12042EA1669289D3B4CD7D25DFA15BF63E2F91033A1D11E44E7FC8A2C04EAADD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10c19612f0eee9d6aaa7bca5aa0ceb525410a1c9dc4efc43f82d00c030db8f16
MD5 2f51b6a8e562c3e76b8697f74b24808c
SHA1 6a79bba63e56bded84d56f7b7de8b04984c22538
SHA512 59b111025602fe5d1d5b2aa5622b4a97f786260faad30837cae169c90c2c64bce2563f82d6b9fd9f2553c6dcfcbc427a1e57341e5139efb079324d2139ffef27
SSDEEP 192:sxRfR/tC6/fssjZDde5lSQ4zoD8pKwoVFcHg6+WNsvYlcSd7gxEpB/YBTAQuO+G8:sxRfRM6/fssjZc5laca59vyW/WBQ
TLSH
T1FD52EA16A9789D3B4CE7D218FE15BF63E2F51033A1D11E44A7FC8A2C14EAADD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 350c6825719ee8c595826e9ed45e0bb3302162bd283548f95c76c25344fe43ff
MD5 e1720e1d2c507a811ab208f427381da8
SHA1 8783fee2d7e0f3dceff4ff127a9d69d6b0ed56f3
SHA512 bf46515cf1a135536f1940d22bf194eec3e0f6e10759a7709a41399113242a07defbdcb134f7a8bb98f0620b447b102356af2721898a64366597b705ce56f9c1
SSDEEP 192:sxRfR/tC6/fssjnDde5lSxzoD8pKSZEFcHg6+WNsvYlcSdpDnEpB/YBTLIuO+GjQ:sxRfRM6/fssjnc5l4Ia59vvE/hBQ
TLSH
T1AB52EA16A9689D3B4CE7D218FE15BF63E2F51033A1D11E44E7FC8A2C14EAADD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 674fa45ffddcd52ed45180cc720dccb5abc20e80874368e1f8864f6c8e02e36e
MD5 ff168ffe445051713f2bbd7a24eb3a8f
SHA1 a5c6ec478bc173be24b86ae0fe7a35a91b64da63
SHA512 5c12ede7b2685dea9d544b99a54b1b8143644859d60b176c213bf80befcecc9d0e37e2eb389eb4286c9ac9d4e946fb50a487fe57c132325c8b435812a680e608
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaQqcProZZ:jC+vA7E7JQWgQ+f4+u1jadVccL
TLSH
T1AEC2EA7B640CCB7F4F800ADDED197E9B6DA802CB5698CD9047FE941C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 def476e18e97708631d5fbe0163582ea93bd9dd8f98186bb6265ff40cf93f9ba
MD5 1241d6747aee402d6581246e7825c7b6
SHA1 d875bbb92b8f97f476f8e97cd17bddd576c4d784
SHA512 203b49bd1ff90c3c348251abda615e8b220917a2dfb7ee666b2d4b75764446de1470dc8421d22e04af926ac8e8fe687bde775f495600c3696e0effb0fb7b27aa
SSDEEP 768:33Izhk3TMJxup8+p3bd66j+4BRv86aLIWNNNGPFe:33IS3Oo8+p3Z6n4yvNNl
TLSH
T12CF2AEB1F8A9DD238CE5D685B25633C3BFB015A795C00E98D4E96F1E058729D270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7870a0840abd2307461ba0a0f5b6a249aaddf551b821d8299131ebdedb7e1f81
MD5 8f100a8d4a5f6d1e39811d30aa0a1f68
SHA1 0b32ad9a111f4eab82de2f7a640f9023f98b69fb
SHA512 fe340b73727ddb9efae5eaa3db3e34238369d7e13c1c5491b6a21f3df26b82d14793156f2ba83fc14d48b127e2c541bb7b1b32b2273027b9873c47748bc72889
SSDEEP 768:wrv+4UNbdu3xeJxtp8+p3bd66j+4BRv86aLIWNVce:wbsbI3+r8+p3Z6n4yvP
TLSH
T1C0039E71E8A9ED738CF6C644B14777837FB814A399C00ED4E9D96B5E018619E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c9fa8e0f514c6d5f931a9e7e65467e972f6de18c0c96f9cf9da5ea8ad896dbe5
MD5 30465327c73d9c0c26dc9b57f6caa09c
SHA1 15e0ad4ede0a2a81d917bbb8eaf479850c1cde7d
SHA512 0c22c92b129fabd18fd89e8647fceaca90a76efc6b5ed14d864786cab054f843e1a9119f0f2f2bc1c91b3d674ff01cb9e66ec807c2548a48dd52c0bcd0de125a
SSDEEP 768:srv+4UNbds3wsJxop8+p3bd66j+4BRv86aLIWNVc/:sbsbi3v28+p3Z6n4yvu
TLSH
T1B7039E71E8A9ED738CF6C644B14777837FB814A395C00ED4E9D96B5E018B19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1e8b57bc93fb4e9daaee0170a42ee9acb47a41914bace09fdc45e1749b9d40f1
MD5 9c320ad4eae32411ebc70f2d98029ef1
SHA1 d74ea9a791f87db45ee4012fdf6bdcf18e40390c
SHA512 af0be5142200396b2620b5b131e247d3ce250c3bb0c98c730b5e4ce7f7725583d691d9461a630c625939c8620e61a3a325f2d591f7be493686de451537f66c51
SSDEEP 768:x3IzhA3B0Jxkp8+p3bd66j+4BRv86aLIWNNNGPFe:x3Ii38y8+p3Z6n4yvNNl
TLSH
T102F2AEB1F8A9DD238CE5D285B25633C3BFB015A795C00E98D4D96F1E058729D270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 61690258c5a73058068546063ef8cbe4a46b2486d8ff319ca24e75e6bf354687
MD5 14def3086003e25f25d8923ba2dca69f
SHA1 81be0b9da0b00f00571e878fddd49b9c2fa6c310
SHA512 1d118f614fa884f976e05c5eb5546e6b33eb66b6504fd003395aa9d1d807ec24d7b545e6a30498d36a9c9fa1b285b3464114c77253c49342a8250f12ba2982ac
SSDEEP 768:x3Izho3p2Jxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3Ie32o8+p3Z6n4yvNNl
TLSH
T1B6F2AEB1F8A9DD238CE5D685B21A33C3BFB415A795C00E98D4D96F1E058729D270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 277f8fecbbd48c78b9fc7378eb94b5c0879e37a299f4e314ea67c40c0eb694d4
MD5 8b4afacbb5f1c2c4248a3338978be355
SHA1 e52937e0d19fe7f01f688c603826725d13935c33
SHA512 f5b37e7190c3d5e37de42501dc3823ab745e1eb5cb88b4eeb9d7cf967ca9c093374ac98dff11720b019c3d4db917ece900db621a8aae1e1e2f194133842ba8d9
SSDEEP 768:x3Izhc3SiJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3Ii3Ho8+p3Z6n4yvNNl
TLSH
T182F2AEB1F8A9DD238CE5D285B25A33C3BFB015A795C00E98D4D96F1E058729D270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a594a75abdd8689eeb48456d22b6e466e63b51e4ef444476195fa4499154a36c
MD5 721ce0ea45d45a4ece863719bf42d28a
SHA1 bce39cdeec2af45287f316b4d7cfed8f818e590f
SHA512 5b189a2c17ad92cbbf15c885bfa3eadc8bb0528bc988119e4a6e1a2b56bea130185936b624ab80571852ea5e1b5ed912695484d7300b75b649f82be7ec933405
SSDEEP 768:x3Izh03PMJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3I+3qo8+p3Z6n4yvNNl
TLSH
T163F2AEB1F8A9DD238CE5D285B21633C3BFB415A795C01E98D4D96F1E058729D270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dbe3fa43d9ae27da0e0e0d39eab7877525659735dd137f1086212189998d0d14
MD5 dcb77a975fb5c906293d23f71f29a5b7
SHA1 3d1bc1cda9be1fea3588bd5131cba843945ce73f
SHA512 a71de534e15d9d20d85145fe34ff69aff374fef61f926f2d0ea42f328d99e641467c48a526f68c9619a231bfdc1544615867f03a4bf1a6c63060e7afb682b28c
SSDEEP 768:x3Izhv3lQJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3Ip38o8+p3Z6n4yvNNl
TLSH
T191F2AEB1F8A9DD238CE5D285B25A33C3BFB015A795C00E98D4D96F1E058729D270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b6b3041ed2609d24c4f8c4d6ebac00ca6b21b9686be7f50e506a0497166926bb
MD5 286df522fbec68e935ce962af81ca76d
SHA1 ce9025979509961bc86ac0d36416be967d460931
SHA512 20ceb197453e99d3fbc4b746ae90d6bd94224bbddc50a5b45f816479ce3744a60c08bf5f6263a4b75dd0c14b4a5dc52c45de87194816af6618890195da1008d1
SSDEEP 768:x3Izhi35iJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3I03yo8+p3Z6n4yvNNl
TLSH
T182F2AEB1F8A9DD238CE5D285B21A33C3BFB415A795C00E98D4D96F1E058729D270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 de7bb361799c64779eff9dac22cfee182b793e19a73dc187c89baa4c47108ac3
MD5 40f293bddde58638ec90a824b92c2cb2
SHA1 ddcc2d5597779886e6f7fca3f4c06b5dc75eec7d
SHA512 40888de993b4af8867effee9ef095353359317fc6200ecd05ad8ce7c972515cc5bb61faaf4f7066c10bfdb84ac8fa04f23be59dc51ac3af3947da832542c8322
SSDEEP 768:x3IzhU3FKJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3Im3Wo8+p3Z6n4yvNNl
TLSH
T1F9F2AEB1F8A9DD238CE5D285B25A33C3BFB015A795C00E98D4D96F1E058729D270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 56e496be245f0f4ef220c1c8af64c73ba35419b685d505891dfafb06a302cca8
MD5 ee4ae5b78c22bae179eec7b168df3e41
SHA1 f8a1b2f68b5da3d5e6d156fd55087387f62d90d5
SHA512 0eaa5b7745db3f7e885ae29763cd0c792bd1fa5b69a037d906094cb4d819f8f611a2e53bd35f62a48d8e515934df6ce579ba66b8e8fcde99a58cb6438bc8ff5d
SSDEEP 768:x3IzhQ3ZkJxup8+p3bd66j+4BRv86aLIWNNNGPFe:x3IK3Uo8+p3Z6n4yvNNl
TLSH
T18AF2AEB1F8A9DD238CE5D281B21A33C3BFB415A795C01E98D4D96F1E058729D270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11e71d0436bdf56994b685f9369363b4ae8985b1b8013eb61af62048209ffe18
MD5 a36a7890df59829d6ef7da09baf2466f
SHA1 e01fd520145c14dff4062ba05db3989825028ec1
SHA512 5a42661e82b132b0050c6b87472a3ca0e8ab690028c5401518100f8eb5709c9cf0e108645941f8f0ff269eb0ec2bb35e0481012755f3c766d1e56c0d94d16cbc
SSDEEP 768:Irv+4UNbdD3cc4Np8+p3bd66j+4BRv86aLIin2bwCl1:Ibsbp38L8+p3Z6n4y50ww
TLSH
T1A603CE73F8A899739CE6C644B2467B433FF851A396C10EC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3b5290ea69b6d8a2f11a70e19e1400cf4ea26413a63fc189ac7acc9cdfbda40b
MD5 71da684f9f2a34c9c5b82f25ce41a333
SHA1 206f48d4a8d69cb2dfdd6a1b8d17e57aa5832edf
SHA512 270208f0d7fd54a41d9af004b9dd76326e0c07bdde5dd3ec50e109a12ee06ebd957b34a1be7a94283b1f4fb07b1bf1bc1c0e8ae122cfd101aeabda0f7e44a3cf
SSDEEP 768:arv+4UNbdD3EWJxNp8+p3bd66j+4BRv86aLITN2bwClW:absbp3hL8+p3Z6n4yg0wT
TLSH
T10403BE72F4A9ED739CF6C644B24A77837FB811A399C10EC4E5D96B4E005A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 22c218ddb413374b172f4f2cfeff1036c09ea3d8239e1547c63bfa6f900b9f9c
MD5 d5f6d9ef2053f3a9e1ab8f8bca4b7d73
SHA1 e98279ab642af9b86ead42e33a40b02377812a6a
SHA512 dc84d3428f61affbad0a3facef67315aaba4045f73a40b4523f90fc3015d594752e60086d7703f33c255561869c5ec193a05810fd3cb3d47378e0089d87c63ec
TLSH
T19CE00216D30015BAE83C173040476F345FD2D1A802F52347AE2041583E223002F31FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a5a75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a5a75.TMP
Size 392B
SHA256 0f958e198db89437a3ca746d5e8652ee7980a57b597bf3e4a7c9f45a9d0c2c92
MD5 41a8ef961da338f2f1523674b07f2764
SHA1 ecc65f10dedd7a6098154ba91040cce600ca159d
SHA512 7807a541239f314b74961cd2649ef95f1fcee22304203f45135899752de22e516f006edb63b0bf471987efeebebf856e829e5b3d708cc2957f481fbdaf4fa529
MD5 SHA1 SHA512

Submit Download

8197b6a3-19fc-4a94-981e-e1034fd47712.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8197b6a3-19fc-4a94-981e-e1034fd47712.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59aea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59aea5.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

6aac1c93-efaa-4c21-8b7f-7065b805c7f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\6aac1c93-efaa-4c21-8b7f-7065b805c7f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI44722\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vi1x1bc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\09k3mg8k\5vi1x1bc.exe
Size 5.4MB
SHA256 288cb6e137a52837c4b4913703ed29591b48c652cbedb2597480e97a262c3a50
MD5 ef24828fbecffab877aac2973302dbef
SHA1 5ab8b93d56211dfaffda234112808a1305d20e9f
SHA512 0eb9a565e6468cfb606c07ee3f41ba0b8dadb0b6bda03f78e432b99a553c4df4cb1c6ef6f63095444d05b403849df2b98cb7fdee7335c6e26f05363f4e02ded7
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uL:AsTICteErownP0oTcMsABqljkO
TLSH
T1B4463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads